VS-NfD on mobile
Smartphones, secure voice and UEM for German classified information
What VS-NfD means for mobile work
VS-NfD stands for VS-NUR FÜR DEN DIENSTGEBRAUCH ("restricted, for official use only"), the lowest of the four German security classification levels defined in Section 4 of the Security Clearance Check Act (SÜG). A federal authority classifies information at this level if disclosure to unauthorized persons could be detrimental to the interests of Germany or one of its states. On smartphones and tablets, that has a direct consequence: the security functions that protect such information on the device and in transit have to come from products the BSI has approved or issued an operating permission (Einsatzerlaubnis) for.
The legal basis is the VSA (Verschlusssachenanweisung), the federal administrative regulation on protecting classified information, dated 1 April 2023. It requires products that perform IT security functions to protect classified information to be approved (BSI, notes on the list of approved IT security products). Under Section 51(1) VSA, the BSI decides which products this applies to. The approval rule does not apply to sensitive information that is not classified.
The BSI works with two instruments here. An approval is a binding statement on the security value of a product, valid for a specific version and under specified operating conditions. The BSI issues an operating permission under Section 51(5) VSA when no approved product is available or cannot be provided in time. It is time-limited and comes with conditions, and the organization using the product assesses the risks under Section 50 VSA and documents them in a risk analysis (BSI, FAQ on evaluation and approval). A Common Criteria certification is different: any IT product with security functions can obtain one, it does not relate to classified information, and it is not an approval under the VSA.
Five building blocks and what the BSI has issued for each
Working with VS-NfD on the move involves the device, voice, device management and apps. For each building block, this section shows which instrument exists, who holds it and how long it is valid. Register data comes from BSI publication 7164, the list of approved IT security products and systems.
indigo from Apple
indigo is Apple's solution for using standard iPhones and iPads with VS-NfD; the hardware security anchor is the Secure Enclave rather than an external smart card. BSI approvals for Apple's indigo: up to VS-NfD (BSI-VSA-10900) and NATO RESTRICTED (BSI-VSA-11003), plus an operating permission up to VS-NfD (BSI-VSA-10901), all valid until 31 October 2027. According to Apple, BSI-VSA-10900 covers iOS and iPadOS 18 and BSI-VSA-11003 covers iOS and iPadOS 26. The approvals are held by Apple Inc.; ISEC7 is the integrator.
ISEC7 designs the architecture, builds the environment including UEM, defines the operating processes and runs it. ISEC7 SPHERE shows the compliance status of indigo devices in a dedicated dashboard.
Samsung Knox Native Solution
For Samsung Android devices, the BSI lists the Knox Native Solution, with an embedded Secure Element as the hardware security anchor. This covers Samsung devices with the Knox Native Solution, for which Samsung holds a BSI operating permission up to VS-NfD (BSI-VSA-11044, valid until 31 August 2027). The operating permission applies to Knox Native Solution version 3.13 and is held by Samsung Electronics GmbH. Because it is an operating permission, your organization assesses and documents the risks.
ISEC7 connects the devices to your UEM, sets up zero-touch enrollment through Knox Mobile Enrollment and runs the environment.
Encrypted calls with ISEC7 MANAGED SECURE VOICE
ISEC7 MANAGED SECURE VOICE is a managed service for encrypted mobile calls on Apple and Samsung devices. The service is built on Secusmart's SecuVOICE app. The SecuVOICE app holds a BSI operating permission (Einsatzerlaubnis) up to VS-NfD, BSI-VSA-11057, valid until 31 August 2027; it covers SecuVOICE for iOS and Android version 6.x and is held by Secusmart GmbH. Secusmart makes the app, ISEC7 runs the service.
Only end-to-end calls between SecuVOICE users and Secure Landing calls to lines behind secured government phone systems reach VS-NfD. A breakout call to any other number is encrypted only as far as the federal infrastructure, so classified content does not belong in breakout calls. Because the service uses German federal cryptographic material, we provide it only to German companies and public authorities.
Sovereign Cloud for BlackBerry UEM
In the Sovereign Cloud for BlackBerry UEM, ISEC7 hosts and runs BlackBerry UEM in Germany. Data stays in Germany, neither the vendor nor third parties have access, and the environment is operated by ISEC7 GmbH staff in Germany. The Regulated package is designed for public authorities and for environments with indigo devices and Samsung Knox Native.
The platform, BlackBerry UEM, holds Common Criteria certificate BSI-DSZ-CC-1235-2025, issued on 8 September 2025 (BlackBerry UEM Server 12.21.1, EAL4+, valid until 7 September 2030). The certificate holder is BlackBerry Ltd.; ISEC7 is the operator. The certificate is not an approval under the VSA, and no UEM appears in BSI list 7164.
ISEC7 MAIL
ISEC7 MAIL is ISEC7's mobile client for email, calendar, contacts, tasks and notes from Exchange and Microsoft 365 on iOS and Android, with S/MIME, smart card support via YubiKey, and the ability to read and set classification markings. ISEC7 develops the app.
No BSI instrument for VS-NfD has been issued for ISEC7 MAIL, the messenger or Secure File.
Who is responsible for what
Approvals sit with the products in use, with the BSI and with the vendors. ISEC7 has no entry of its own in BSI list 7164 and acts as integrator and operator: ISEC7 designs and builds the environments, runs UEM and voice services and is your contractual partner for that work. The approval belongs to the platform, not to us.
| Building block | Instrument | Reference | Holder | Valid until | ISEC7's role |
|---|---|---|---|---|---|
| indigo | Approval up to VS-NfD | BSI-VSA-10900 | Apple Inc. | 31 October 2027 | Integrator |
| indigo | Operating permission up to VS-NfD | BSI-VSA-10901 | Apple Inc. | 31 October 2027 | Integrator |
| indigo | Approval NATO RESTRICTED | BSI-VSA-11003 | Apple Inc. | 31 October 2027 | Integrator |
| Knox Native Solution 3.13 | Operating permission up to VS-NfD | BSI-VSA-11044 | Samsung Electronics GmbH | 31 August 2027 | Integrator and operations |
| SecuVOICE for iOS and Android 6.x (basis of ISEC7 MANAGED SECURE VOICE) | Operating permission up to VS-NfD | BSI-VSA-11057 | Secusmart GmbH | 31 August 2027 | Service operator |
| BlackBerry UEM Server 12.21.1 | Common Criteria certificate EAL4+, not an approval | BSI-DSZ-CC-1235-2025 | BlackBerry Ltd. | 7 September 2030 | Operator in the Sovereign Cloud |
| ISEC7 MAIL | No BSI instrument for VS-NfD | None | None | Not applicable | Developer |
ISEC7 Group AG, ISEC7 GmbH, ISEC7 Software GmbH and ISEC7 Inc. hold DIN EN ISO 27001:2022 and DIN EN ISO 9001:2015 certificates, valid until 2 September 2027. They cover ISEC7's management systems, not the products in the table.
ISEC7 Group certificates · Endpoint management at ISEC7
As of 8 October 2026 · Register data from BSI publication 7164, checked on 8 October 2026. All indigo approvals expire on 31 October 2027.
Frequently asked questions about VS-NfD on mobile devices
Which smartphones are approved for VS-NfD?
Apple Inc. holds a BSI approval up to VS-NfD for indigo, its solution for standard iPhones and iPads (BSI-VSA-10900, valid until 31 October 2027), plus an operating permission up to VS-NfD (BSI-VSA-10901, also valid until 31 October 2027). For Samsung devices with Knox Native Solution version 3.13, Samsung Electronics GmbH holds a BSI operating permission up to VS-NfD (BSI-VSA-11044, valid until 31 August 2027). The BSI lists further solutions in its overview of mobile communication and in list 7164. ISEC7 integrates indigo and Samsung Knox and runs the environments.
Can I use a regular iPhone for VS-NfD?
Yes, with Apple's indigo. indigo works with standard iPhones and iPads and uses the Secure Enclave as its hardware security anchor instead of an external smart card. According to Apple, the approval up to VS-NfD (BSI-VSA-10900) covers iOS and iPadOS 18, and the operating permission up to VS-NfD (BSI-VSA-10901) covers iOS and iPadOS 18 and 26; both are valid until 31 October 2027 and held by Apple Inc. Besides the device, the platform includes a UEM, VPN gateways, a PKI and fixed IT policies. ISEC7 builds and runs this environment as the integrator.
Is NATO RESTRICTED possible on an iPhone?
Yes. Apple Inc. holds a BSI approval at NATO RESTRICTED level for indigo (BSI-VSA-11003, valid until 31 October 2027), which according to Apple covers iOS and iPadOS 26. For SecuVOICE, the BSI register lists no NATO level; its operating permission (BSI-VSA-11057, SecuVOICE for iOS and Android version 6.x, held by Secusmart GmbH, valid until 31 August 2027) goes up to VS-NfD.
Can I make VS-NfD calls on a work phone?
Yes, with Secusmart's SecuVOICE app. The SecuVOICE app holds a BSI operating permission (Einsatzerlaubnis) up to VS-NfD, BSI-VSA-11057, valid until 31 August 2027; it covers SecuVOICE for iOS and Android version 6.x and is held by Secusmart GmbH. Only end-to-end calls between SecuVOICE users and Secure Landing calls to lines behind secured government phone systems reach VS-NfD. A breakout call to any other number is encrypted only as far as the federal infrastructure, so classified content does not belong in breakout calls. ISEC7 runs SecuVOICE as a service under the name ISEC7 MANAGED SECURE VOICE. Because the service uses German federal cryptographic material, we provide it only to German companies and public authorities.
What is the difference between an approval, an operating permission and a certification?
An approval is a binding BSI statement on the security value of an IT security product for classified information, for example for indigo (BSI-VSA-10900, up to VS-NfD, held by Apple Inc., valid until 31 October 2027). The BSI issues an operating permission under Section 51(5) VSA when no approved product is available or cannot be provided in time; it is time-limited, comes with conditions and requires the user organization to assess the risks. Examples are SecuVOICE for iOS and Android 6.x (BSI-VSA-11057, up to VS-NfD, held by Secusmart GmbH, valid until 31 August 2027) and Knox Native Solution 3.13 (BSI-VSA-11044, up to VS-NfD, held by Samsung Electronics GmbH, valid until 31 August 2027). Any IT product with security functions can obtain a Common Criteria certification, which does not relate to classified information. Certificate BSI-DSZ-CC-1235-2025 for BlackBerry UEM Server 12.21.1 (EAL4+, held by BlackBerry Ltd., valid until 7 September 2030) is such a certification, not an approval.
Which UEM do I need for VS-NfD smartphones?
The BSI describes indigo as compatible with common MDM solutions without naming products, and no UEM appears in BSI list 7164. ISEC7 runs BlackBerry UEM, optionally from the Sovereign Cloud for BlackBerry UEM in the Regulated package, which is designed for indigo devices and Samsung Knox Native. The platform, BlackBerry UEM Server 12.21.1, holds Common Criteria certificate BSI-DSZ-CC-1235-2025 (EAL4+, valid until 7 September 2030); the certificate holder is BlackBerry Ltd., and ISEC7 is the operator. For ISEC7 MANAGED SECURE VOICE, the UEM configuration has to meet the requirements for the cryptographic material; where that is not possible, ISEC7 provides the Full Managed Secure Voice Smartphone.
Is there a VS-NfD-capable mail app for the iPhone?
According to the BSI, the operating permission for indigo includes email with S/MIME (BSI-VSA-10901, up to VS-NfD, held by Apple Inc., valid until 31 October 2027). That applies to the mail function of the indigo platform. No BSI instrument for VS-NfD has been issued for ISEC7 MAIL, the messenger or Secure File.
Who applies for an approval, and can companies use VS-NfD solutions?
According to the BSI, the federal authority that uses the product applies for the approval, not a company. Companies under German classified-information protection contact the Federal Ministry for Economic Affairs. For products with an operating permission, the user organization assesses the risks under Section 50 VSA, documents them in a risk analysis and carries the residual risk. For ISEC7 MANAGED SECURE VOICE, ISEC7 requests the key material from the BSI.
Plan mobile work with VS-NfD
Tell us which devices, apps and call paths your organization needs. We will work out with you which building blocks fit, which BSI instruments exist for them and which part ISEC7 takes on. You can also reach us at sales@isec7.com or +49 40 325076 0.