Your situation
You are developing an IT product for processing classified information and need an approval from the BSI? We support you with evaluation, manufacturer documentation and technical coordination in the approval procedure.
Free of charge and without obligation.
Your situation
A public authority wants to use your IT product for classified information, for example so that staff can also access VS-NfD data from home or mobile workplaces. Alongside Common Criteria certification, there is a separate approval procedure defined by the BSI for this purpose, which partly uses the Common Criteria methodology. The area is specially regulated; in the procedure, the manufacturer and the BSI communicate directly with each other.
It starts with the sponsoring authority (Bedarfsträger): a public authority must be convinced of your product and submit a request to the BSI for its use with classified information. The approval documents are then prepared, and your manufacturer tests may need to be complemented by an independent evaluation.
Our BSI evaluation facility supports you with evaluation, advice on the approval documents and in the direct dialogue with the BSI, with the aim of completing the approval efficiently. For example, we accompanied Ecos in the approval process for the Secure Boot Stick SX. If you want to process classified information within your own organisation, we support you with information security concepts for processing classified information.
Services & results
You receive support in the approval procedure for your IT product for processing classified information, for example for accessing VS-NfD (classified information – RESTRICTED) data from home or mobile workplaces: advice on the approval documents, evaluation to complement your manufacturer tests, and support in the direct dialogue with the BSI. An unclassified description is sufficient for the informal initial consultation.
The approval procedure is conducted by the manufacturer and the BSI. We contribute our evaluation facility's experience from Common Criteria evaluations, whose methodology the procedure partly uses.
In the informal initial consultation we get to know your current situation in concrete terms: product, intended use with classified information, sponsoring authority and status of the procedure. An unclassified description is sufficient for this first exchange.
Clarified starting point
An agreed evaluation subject and the next steps in the approval procedure.
We advise your team on preparing the documents for the approval.
Our evaluation facility evaluates the product to complement or compensate for your manufacturer tests. Which evaluation contributions are needed depends on the product and the approval framework.
We advise you in the direct dialogue with the BSI so that the approval can be carried out efficiently. The approval decision is made by the BSI.
Our evaluation facility has been recognised by the BSI (Federal Office for Information Security) since 1992 and is the longest-serving evaluation facility in Germany. Our consultants for product manufacturers are trained by the BSI as evaluators for Common Criteria and ITSEC – the methodology that the approval procedure for classified information also partly uses.
In the approval context, we have among other things evaluated Deutsche Telekom's SiMKo3 (secure mobile communication) for smartphones and tablets in preparation for approval. We supported Ecos in the approval process for the Secure Boot Stick SX, which allows public authorities to use VS-NfD data from home or mobile workplaces.
Getting started
An approval first requires a request from a public authority, the so-called sponsoring authority (Bedarfsträger). This authority must be convinced of the product and submit a request to the BSI for its use with classified information.
In the preliminary discussion we clarify product, use and status of the procedure on the basis of a suitable description. We agree separately on how classified or otherwise sensitive information is exchanged.
The sponsoring authority and the BSI determine the relevant approval framework. An evaluation by secuvera does not replace the approval decision.
Yes. In the procedure described, a request from a public authority is required first. This sponsoring authority must request the intended use with classified information from the BSI. The requirement therefore belongs at the start of procedure planning.
Common Criteria and approval for classified information are different procedures. The approval process partly uses Common Criteria methodology, but is based on the specific use with classified information and the requirements of the sponsoring authority and the BSI.
The independent evaluation can complement manufacturer tests or compensate for them to a defined extent. Which evaluation contributions are needed is agreed for the product and the approval framework. Existing test results are an important starting point for this.
Yes. We advise on manufacturer documentation and technical questions in the direct dialogue with the BSI. The communication interfaces and contributions are clarified in the approval procedure.
Sensitive or classified information is only transmitted once a suitable exchange channel has been agreed. For the preliminary discussion, use a suitable description of the product, use and status of the procedure.
