Under Germany's federal rules on classified information, a phone call is treated like any other electronic transmission. Section 55 of the Verschlusssachenanweisung (VSA), the federal instruction on handling classified material, requires classified information sent over technical communication links to be encrypted, in principle with IT security products that meet requirements set by the BSI, the German Federal Office for Information Security.
Email and documents have well-established tools for this: containers, markings, encrypted delivery. A phone call needs a channel of its own, and that channel behaves differently from email.
This is about the German classification level VS-NfD (Verschlusssache, Nur für den Dienstgebrauch), the lowest of the four levels in the VSA. The service described further down is available only to German companies and public bodies.
For federal authorities, the VSA of 13 March 2023 is the reference. Alongside the principle in section 55(1), section 55(3) allows an exception where the protected route would mean an unacceptable loss of time. VS-NfD may then travel over an unprotected connection, chosen to keep the risk of eavesdropping as low as possible. Section 55(5) adds precautions for that case, including confirming who is on the other end before the conversation begins.
For companies that handle VS-NfD on behalf of public bodies, the VS-NfD-Merkblatt of 1 September 2023 is more specific. Point 3.4.3 permits telephony once a risk assessment has been carried out, provided it is end-to-end encrypted. Point 1.1 specifies the tools: IT security products that carry a BSI approval statement, meaning either a Zulassung (approval) or an Einsatzerlaubnis (operating permit), used in the context they are intended for. The products that qualify are listed in BSI publication 7164.
The exception in section 55(3) hinges on an unacceptable loss of time. If your people discuss classified matters by phone on a regular basis, plan around the protected route as the normal case.
Section 2(1) of the VSA names the spoken word explicitly among the forms classified information can take. The difference lies in the marking. A document carries its classification marking before anyone opens it. A conversation carries none. Whether a call becomes classified can emerge halfway through, by which point it is already running over whichever channel was picked at the start.
Then there is the other end. End-to-end encryption works between two participants using the same system. A secured phone on one side does little if the crisis team, the management board or a partner agency calls back from an ordinary mobile. So planning starts with a list: who has to reach whom when it matters?
Voice has also found its way into the law outside classified information. For particularly important and important entities (besonders wichtige und wichtige Einrichtungen), section 30(2) no. 10 of the BSI Act (BSIG), the German act implementing NIS2, lists secured voice, video and text communication among the minimum measures, subject to the proportionality clause in section 30(1). That is not a VS-NfD requirement. It does show that telephony is treated as a channel in its own right there too. Whether your organisation falls under section 30 BSIG can be checked on our NIS2 page.
For companies, point 3.5 of the Merkblatt answers this. Handling VS-NfD purely electronically in a private home is permitted when five conditions are met:
In companies, then, working from home starts with a sign-off by the responsible person. For federal authorities, section 28 of the VSA refers to point 7 of its Annex V for taking VS-NfD off the premises. Point 3.4.3 on telephony makes no distinction by location, so a call from home is held to the same requirement as a call from the office.
ISEC7 MANAGED SECURE VOICE is built on the SecuVOICE app from Secusmart, which uses the BSI's SNS standard for secure cross-network voice communication.
For SecuVOICE for iOS and Android, version 6.x, BSI publication 7164 lists an Einsatzerlaubnis up to VS-NfD, reference BSI-VSA-11057, issued on 14 August 2026 and valid until 31 August 2027, as listed on 28 September 2026. It applies to the app in that version. The BSI provides the accompanying conditions of use and operation to authorised users, and the Merkblatt makes them mandatory.
According to Secusmart, the app has three calling routes. Between two SecuVOICE users, the call is end-to-end encrypted. Secure Landing connects, up to VS-NfD, to extensions behind secured phone systems in public authorities. Breakout reaches any number on the public telephone network, with encryption on the section up to the federal infrastructure. For classified content, that leaves the first two routes.
The permit covers the app. Someone still has to put the conditions of use into practice every day. That is the work ISEC7 MANAGED SECURE VOICE, our service for encrypted mobile telephony based on SecuVOICE, divides up: Secusmart makes the app, ISEC7 runs the service.
ISEC7 takes on
What stays with you
The app runs on iOS and Samsung Knox. Because it uses German federal key material, we supply the service only to German companies and public bodies.
Variants and prerequisites are on the ISEC7 MANAGED SECURE VOICE page. If the whole iPhone or iPad, not just the call, is to handle VS-NfD, the relevant framework is indigo, defined by the BSI for standard iOS devices. What ISEC7 does there as an integrator is described on our indigo page. For pricing and documentation on the register entry, contact sales@isec7.com.