Mobile communication for public authorities
and administration
Which smartphone solutions can German authorities use for VS-NfD?
Those the BSI, Germany's Federal Office for Information Security, lists with an approval or an operating permission (Einsatzerlaubnis) up to VS-NfD in its list of approved IT security products (BSI-Schrift 7164). For the federal administration, the classified information directive (VSA) of 1 April 2023 requires products that perform security functions to protect classified information to be approved; the federal states have their own rules. VS-NfD is the lowest of Germany's four classification levels under Section 4 of the Security Clearance Act (SÜG), used where unauthorized access could be detrimental to the interests of Germany or one of its states.
For mobile devices and calls, the register currently includes these entries:
- BSI approvals for Apple's indigo: up to VS-NfD (BSI-VSA-10900) and NATO RESTRICTED (BSI-VSA-11003), plus an operating permission up to VS-NfD (BSI-VSA-10901), all valid until 31 October 2027. The approvals are held by Apple Inc.; ISEC7 is the integrator.
- Samsung devices with the Knox Native Solution 3.13, for which Samsung holds a BSI operating permission up to VS-NfD (BSI-VSA-11044, valid until 31 August 2027). ISEC7 integrates them into the UEM and runs the environment.
- The SecuVOICE app for iOS and Android, version 6.x, holds a BSI operating permission (Einsatzerlaubnis) up to VS-NfD, BSI-VSA-11057, valid until 31 August 2027. Secusmart makes the app, ISEC7 runs the service.
With an operating permission, the authority deploying the product weighs and documents the residual risks itself, and the BSI's conditions of use and operation apply to it as well.
How does an authority make encrypted calls on a smartphone?
With ISEC7 MANAGED SECURE VOICE, a managed service for encrypted mobile calls on Apple and Samsung devices. It runs on Secusmart's SecuVOICE app, for which the BSI has issued an operating permission up to VS-NfD (BSI-VSA-11057, valid until 31 August 2027). ISEC7 handles onboarding, applies to the BSI for the key material and runs the service day to day. Because the service uses German federal key material, we supply it only to German companies and public bodies.
Which calls reach VS-NfD
Calls between two SecuVOICE users are encrypted end to end. Calls to extensions behind secured phone systems in public authorities run as Secure Landing, up to VS-NfD. Breakout reaches any other number, but only the section up to the federal infrastructure is encrypted. Classified content therefore does not belong in a Breakout call.
The app in your own UEM
You deploy the app to your existing iOS and Samsung devices through your UEM, provided its configuration meets the requirements for handling VS-NfD key material. Term of 24 months with an extension option.
A ready-made smartphone
Without a suitable UEM, you receive a fully configured device. Management and support come from the Regulated Sovereign Cloud, operated by ISEC7 GmbH staff in Germany. Term of 24 or 36 months.
The service is built for state authorities, public administration, cities and municipalities in Germany. In the tender documents, that puts a named operator on the page instead of a list of prerequisites you have to meet yourself.
How do authorities mark email and documents by classification?
With a marking that is set while writing, stays visible on the email or document and is checked before sending. ISEC7 CLASSIFY works as an add-in for Outlook, Outlook on the web, Word, Excel, PowerPoint and SharePoint Pages and ships with standard schemes for BUND (German federal), NATO and Traffic Light. An email without a classification cannot be sent, and untrusted recipient domains can be blocked. The schemes reflect marking rules; they do not come with an approval from the BSI or NATO.
Email on the work phone
On iOS and Android, marking runs in ISEC7 MAIL, the mobile client for Exchange and Microsoft 365. It brings delegate, functional and shared mailboxes to the phone without anyone sharing a password, and signs and encrypts with S/MIME, including certificates on a YubiKey or smart card. No BSI instrument for VS-NfD has been issued for this client. For VS-NfD email on the iPhone, use the mail function of the indigo platform, whose operating permission covers email including S/MIME.
Where do operations run, and what does NIS2 require of federal authorities?
In Germany. In the Sovereign Cloud for BlackBerry UEM, ISEC7 hosts and operates the UEM in Germany, data stays in Germany, and neither the manufacturer nor third parties have access to systems or data. The Regulated package is designed for public authorities and for environments with indigo devices and Samsung Knox Native. The platform, BlackBerry UEM, holds Common Criteria certificate BSI-DSZ-CC-1235-2025, issued on 8 September 2025 (BlackBerry UEM Server 12.21.1, EAL4+, valid until 7 September 2030). The certificate holder is BlackBerry Ltd.; ISEC7 is the operator.
ISEC7 SPHERE shows which devices are on which version across several UEM platforms from different vendors, with a dedicated indigo dashboard. ISEC7 Group AG, ISEC7 GmbH, ISEC7 Software GmbH and ISEC7 Inc. are certified to DIN EN ISO 27001:2022 and ISO 9001:2015, valid until 2 September 2027.
NIS2 in the German federal administration
Since 6 December 2025, the German BSI Act treats federal administration bodies as particularly important entities, except for Sections 38, 40(3), 61 and 65 (Section 29 BSIG). The minimum measures in Section 30(2), sentence 2, no. 10 BSIG include secured voice, video and text communication and, where appropriate, secured emergency communication systems. State and municipal authorities are not covered by Section 29. The obligations stay with the authority; ISEC7 supplies the operations and the reports you use as evidence. More on our NIS2 page.
Frequently asked questions about mobile communication in German authorities
What does VS-NfD mean?
VS-NfD stands for VS-NUR FÜR DEN DIENSTGEBRAUCH, the lowest of the four German classification levels under Section 4 of the Security Clearance Act (SÜG). Information is classified this way when unauthorized access could be detrimental to the interests of Germany or one of its states. In practice, anyone handling such information on mobile devices needs products the BSI has approved or given an operating permission for.
Which iPhones and Samsung devices can German authorities use for VS-NfD?
Standard iPhones and iPads with Apple's indigo: approval BSI-VSA-10900 up to VS-NfD and operating permission BSI-VSA-10901, both valid until 31 October 2027, held by Apple Inc. For Samsung devices there is the Knox Native Solution 3.13 with operating permission BSI-VSA-11044 up to VS-NfD, valid until 31 August 2027, held by Samsung. ISEC7 holds no approval itself; it integrates and runs these platforms.
What is the difference between a BSI approval and an operating permission?
An approval is a binding statement by the BSI on a product's security value; classified information may then be processed up to the approved level. The BSI issues an operating permission when no approved product is available or cannot be provided in time, for a limited period and with conditions. The deploying organization then weighs and documents the residual risks. A Common Criteria certificate is a separate instrument and not an approval for classified information.
Does NIS2 apply to German federal authorities?
Yes. Under Section 29 of the BSI Act as amended on 6 December 2025, federal administration bodies count as particularly important entities, except for Sections 38, 40(3), 61 and 65. That brings in the risk management measures of Section 30, which include secured voice, video and text communication. Section 29(3) sets out further exemptions for the remit of the Federal Ministry of Defence.
Is there a VS-NfD email app for the iPhone?
Yes, as part of the indigo platform: operating permission BSI-VSA-10901 covers email including S/MIME. No BSI instrument for VS-NfD has been issued for ISEC7 MAIL. The client brings delegation, functional mailboxes, S/MIME with a YubiKey or smart card and marking with ISEC7 CLASSIFY to the work phone, for information below VS-NfD.
Who applies for the key material for encrypted calls up to VS-NfD?
With ISEC7 MANAGED SECURE VOICE, ISEC7 applies to the BSI for the key material. Onboarding runs through a workshop, the application for and assignment of the key material, and the rollout of the app via MDM or UEM. Because German federal key material is used, ISEC7 supplies the service only to German companies and public bodies.
Can authorities run BlackBerry UEM from a cloud in Germany?
Yes, with the Regulated package of the Sovereign Cloud for BlackBerry UEM. ISEC7 hosts and operates the UEM in Germany, data stays in Germany, and neither the manufacturer nor third parties have access to systems or data. The package is designed for public authorities and for environments with indigo devices and Samsung Knox Native; the platform's Common Criteria certificate is held by BlackBerry Ltd.
Information as of 8 October 2026 · Register entries from BSI-Schrift 7164, checked on 8 October 2026 · Legal references from gesetze-im-internet.de · For police and law enforcement see Mobile communication for police and law enforcement
Talk to us about your authority's setup
Tell us which devices, which UEM and which classification levels you work with today. We will show you which building blocks fit, where an operating permission has its limits and what ISEC7 takes on in operations.
You can also reach us directly at sales@isec7.com or +49 40 325076 0.