Clarify requirements. Implement safeguards. Prepare self-accreditation.
Does your organisation need to process information classified as VS-NUR FÜR DEN DIENSTGEBRAUCH (VS-NfD, a German security classification)? Responsibilities, working practices and IT must meet the requirements of the specific contract.
SITsolutions helps interpret these requirements, assess existing safeguards and establish a clear implementation approach. You receive a basis for management and IT decisions, together with the documentation your responsible person needs.
We consider the complete workflow. An encrypted file must also be protected where it is opened and edited. Technical planning therefore goes hand in hand with clear responsibilities and practical operating rules.
When our support is useful
- You are preparing for a contract with VS-NfD requirements.
- You want to assess which existing processes and IT systems are suitable.
- You need to choose between a standalone workstation, your own VS-NfD environment and IT provided by the contracting authority.
- You need support with documentation, training or self-accreditation preparation.
- You want to review an existing solution following technical or organisational changes.
Our services
Clarifying requirements and the starting point
Together, we identify intended workflows, roles, locations and information flows. Contractual requirements are compared with existing safeguards. Questions requiring clarification with the contracting authority are recorded.
Your outcome: an overview of applicable requirements, gaps and necessary coordination.
Planning a suitable implementation
We assess operating models and their organisational and technical implications with you. This includes access rights, system boundaries, data transfer, backups, administration and mobile working. The relevant BSI IT-Grundschutz requirements are determined by the specific system configuration.
Your outcome: a reasoned target design with prioritised actions, responsibilities and dependencies to inform resource and investment planning.
For networked environments, we also help describe system boundaries and communications. A communication matrix clarifies which connections are needed, their purpose and how they should be protected. Initial implementation effort and ongoing operating tasks are considered together.
Developing organisation and documentation
We support role descriptions, work instructions, access concepts and evidence. Where required for the selected environment, we help develop the information security concept and risk analysis. Existing ISMS documents are reviewed for suitability and supplemented as needed.
Your outcome: coordinated documentation for operational handling of VS-NfD information.
Preparing self-accreditation
We help your responsible person review implementation of the IT requirements, compile evidence and identify outstanding actions. Self-accreditation and the required confirmation remain with the person responsible for VS-NfD in your organisation.
Your outcome: a structured evidence register and a documented basis for internal assessment.
Raising awareness and supporting operations
We explain the rules relevant to each role and help plan recurring checks. Particular attention goes to everyday situations: information sharing, meetings, mobile working, storage media and responding to security incidents.
Your outcome: clear practical guidance and an agreed approach to maintaining safeguards.
How we work together
We begin by clarifying your use case and defining the scope. You then receive a baseline review with concrete next steps. Building on this, we support agreed measures through preparation for internal assessment and, if required, ongoing operation.
Consultancy focuses on requirements, processes and safeguards. Classified content is generally not needed. The need-to-know principle continues to apply when using external support.
The scope and outcomes are agreed to suit your contract. The basis is the contractually incorporated version of the VS-NfD guidance and any additional contract-specific requirements. You clarify unresolved requirements with your contracting authority; we help you prepare.