<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=1732033&amp;fmt=gif">
Skip to content
Contact us
All posts

Classified phone calls: why voice needs its own channel

  ISEC7 Editorial Team  ·  5 minute read

Under Germany's federal rules on classified information, a phone call is treated like any other electronic transmission. Section 55 of the Verschlusssachenanweisung (VSA), the federal instruction on handling classified material, requires classified information sent over technical communication links to be encrypted, in principle with IT security products that meet requirements set by the BSI, the German Federal Office for Information Security.

Email and documents have well-established tools for this: containers, markings, encrypted delivery. A phone call needs a channel of its own, and that channel behaves differently from email.

This is about the German classification level VS-NfD (Verschlusssache, Nur für den Dienstgebrauch), the lowest of the four levels in the VSA. The service described further down is available only to German companies and public bodies.

What the rules say about phone calls

For federal authorities, the VSA of 13 March 2023 is the reference. Alongside the principle in section 55(1), section 55(3) allows an exception where the protected route would mean an unacceptable loss of time. VS-NfD may then travel over an unprotected connection, chosen to keep the risk of eavesdropping as low as possible. Section 55(5) adds precautions for that case, including confirming who is on the other end before the conversation begins.

For companies that handle VS-NfD on behalf of public bodies, the VS-NfD-Merkblatt of 1 September 2023 is more specific. Point 3.4.3 permits telephony once a risk assessment has been carried out, provided it is end-to-end encrypted. Point 1.1 specifies the tools: IT security products that carry a BSI approval statement, meaning either a Zulassung (approval) or an Einsatzerlaubnis (operating permit), used in the context they are intended for. The products that qualify are listed in BSI publication 7164.

The exception in section 55(3) hinges on an unacceptable loss of time. If your people discuss classified matters by phone on a regular basis, plan around the protected route as the normal case.

Why voice is not like email

Section 2(1) of the VSA names the spoken word explicitly among the forms classified information can take. The difference lies in the marking. A document carries its classification marking before anyone opens it. A conversation carries none. Whether a call becomes classified can emerge halfway through, by which point it is already running over whichever channel was picked at the start.

Then there is the other end. End-to-end encryption works between two participants using the same system. A secured phone on one side does little if the crisis team, the management board or a partner agency calls back from an ordinary mobile. So planning starts with a list: who has to reach whom when it matters?

Voice has also found its way into the law outside classified information. For particularly important and important entities (besonders wichtige und wichtige Einrichtungen), section 30(2) no. 10 of the BSI Act (BSIG), the German act implementing NIS2, lists secured voice, video and text communication among the minimum measures, subject to the proportionality clause in section 30(1). That is not a VS-NfD requirement. It does show that telephony is treated as a channel in its own right there too. Whether your organisation falls under section 30 BSIG can be checked on our NIS2 page.

And when people work from home?

For companies, point 3.5 of the Merkblatt answers this. Handling VS-NfD purely electronically in a private home is permitted when five conditions are met:

  • the IT used has been approved by the person responsible for VS-NfD,
  • the home is in Germany,
  • that person has given consent,
  • the employee has been briefed on the specific risks of mobile working,
  • the employee has signed part 6 of the Merkblatt and the company keeps it on file.

In companies, then, working from home starts with a sign-off by the responsible person. For federal authorities, section 28 of the VSA refers to point 7 of its Annex V for taking VS-NfD off the premises. Point 3.4.3 on telephony makes no distinction by location, so a call from home is held to the same requirement as a call from the office.

What the operating permit covers

ISEC7 MANAGED SECURE VOICE is built on the SecuVOICE app from Secusmart, which uses the BSI's SNS standard for secure cross-network voice communication.

For SecuVOICE for iOS and Android, version 6.x, BSI publication 7164 lists an Einsatzerlaubnis up to VS-NfD, reference BSI-VSA-11057, issued on 14 August 2026 and valid until 31 August 2027, as listed on 28 September 2026. It applies to the app in that version. The BSI provides the accompanying conditions of use and operation to authorised users, and the Merkblatt makes them mandatory.

According to Secusmart, the app has three calling routes. Between two SecuVOICE users, the call is end-to-end encrypted. Secure Landing connects, up to VS-NfD, to extensions behind secured phone systems in public authorities. Breakout reaches any number on the public telephone network, with encryption on the section up to the federal infrastructure. For classified content, that leaves the first two routes.

What the operator takes on, and what stays with you

The permit covers the app. Someone still has to put the conditions of use into practice every day. That is the work ISEC7 MANAGED SECURE VOICE, our service for encrypted mobile telephony based on SecuVOICE, divides up: Secusmart makes the app, ISEC7 runs the service.

ISEC7 takes on

  • onboarding in three steps:
    1. a workshop on architecture, the security concept in the VS-NfD context and responsibilities,
    2. applying to the BSI for the key material, delivering it securely and assigning it to users,
    3. rolling out and configuring the app through your MDM or UEM, with functional testing and go-live,
  • day-to-day operation by security-cleared staff of ISEC7 GmbH in Germany,
  • the device itself, if you prefer: with the Full Managed Secure Voice Smartphone, device, management and support come as one service, with no UEM of your own required.

What stays with you

  • deciding who may make classified calls, and the sign-offs by the person responsible for VS-NfD, including for home working,
  • for companies, the risk assessment the Merkblatt requires before telephony,
  • with the app-only variant, a UEM of your own whose configuration meets the requirements for handling VS-NfD key material.

The app runs on iOS and Samsung Knox. Because it uses German federal key material, we supply the service only to German companies and public bodies.

Before the first user makes a call

  1. List the other ends. Crisis team, management, on-call staff, partner agencies: who needs to reach whom over an encrypted line?
  2. Pick the variant. If your UEM meets the requirements for VS-NfD key material, the app goes onto your devices. If not, the device comes with the service.
  3. Settle the sign-offs. Who is responsible for VS-NfD, and who may make calls from home?
  4. Allow time. ISEC7 applies to the BSI for the key material. Put that step early in the project plan.

Variants and prerequisites are on the ISEC7 MANAGED SECURE VOICE page. If the whole iPhone or iPad, not just the call, is to handle VS-NfD, the relevant framework is indigo, defined by the BSI for standard iOS devices. What ISEC7 does there as an integrator is described on our indigo page. For pricing and documentation on the register entry, contact sales@isec7.com.

Sources

ISEC7 resources