Protect data. Check files. Make software resilient.

First, we determine which information, applications and business processes need to be protected. From this we derive a manageable sequence, for example clarifying access and recovery, encrypting mobile devices and securing public file uploads. A penetration test is scheduled where its results enable concrete decisions. You receive a clearly scoped starting point with responsibilities and documented work results.

The two cover different situations. Disk encryption protects stored data on a powered-off or correctly locked storage medium within the scope of the respective solution. File encryption can enforce permissions across storage locations and transfer paths. Whether both make sense depends on device operation, collaboration, data paths and protection needs. An already logged-in, authorized user remains a separate security case.

We align the scope with the use case: from a modest corporate network to a project with classified information. For VS-NfD or NATO RESTRICTED, specific products, versions, conditions of use and the operating concept are reviewed. If an assignment requires security-cleared personnel, the required evidence and access must be clarified in advance on a project basis. Ü3 denotes a security clearance for people, not a level of encryption.

Before the start, we agree on a fixed amount and a specific, reproducibly provable security finding within a permitted test scope. If this agreed proof is not provided, the agreed success-based penetration test fee does not apply. The result criteria, preconditions and acceptance are set out in writing. Remediation, additional consulting or retests are charged only if ordered separately. A test without a matching finding is not a guarantee of complete security.

This is clarified before the architecture decision. Depending on the edition, MetaDefender can also be operated in your own environment. Data transfer, external analysis, telemetry and update paths must match the respective data class. An on-premises scanner alone does not yet make a transition between classified networks permissible. We therefore take into account the complete approval process and the responsible bodies.

An actionable finding describes preconditions, affected functions, reproduction steps, technical impact and a classification within the business process. We discuss with your team where the root cause should be fixed. If agreed, a retest verifies the specific correction. For AI applications, we additionally consider model variability, data sources and the permissions of connected tools.

File encryption for small businesses, midsize companies and enterprises: plan, roll out and operate LAN Crypt. Standard use and VS-NfD are considered separately.

We determine protection needs, the number of users and the operational requirements. You receive a suitable selection for regular business use or a separately reviewed, approved edition. Product, version and included services are specified in detail in the quote.

Which documents belong together, who needs to read them and how do project members change? Together, we translate these workflows into protection domains and policies. Existing file shares and applications are factored in, so that encryption follows your actual work processes.

Keys require designated owners and a process for joiners, leavers, deputies and emergencies. Administration and business-side data access are deliberately kept separate. A recovery concept is agreed with the authorized parties and tested in practice.

A pilot tests opening, editing, saving and the intended exchange of files. Business applications, synchronization and backup are examined for how well they work together with the selected solution. The rollout follows only after these results have been evaluated.

We plan deployment of the version approved under BSI-VSA-10966 based on your data pathways and protection domains. Installation, configuration and customer-specific adaptations are assessed against the approved deployment conditions. The agreed commissioning and handover into maintenance and support follow afterward.

Personnel files, development documents, quotes and customer data already deserve protection in normal business operations. Your company does not need to handle government contracts or process classified information for this. Together, we determine which files are encrypted, who needs access on the business side and how deputies can be arranged. The standard solution is aligned with these workflows; an approved edition is added when your specific protection needs require it.

A small business can start with a protected storage area for management and HR. In midsize companies, for example, separate project teams, multiple sites and external collaboration come into play. For enterprise structures, we additionally plan delegated administration, systematic permission changes and clearly assigned key responsibilities. The selection takes into account client versions, existing storage locations, application compatibility and how authorized people continue working even after a device change.

A file share first governs who may access data through a specific access path. File and folder encryption adds to this protection: access to the content additionally depends on the keys required. What matters is which data pathways the chosen solution actually covers. Together, we look at local storage, shared directories, copy operations and exchange with partners. This shows where confidential content is processed and where different or additional protection is needed. The application perspective remains important here. Authorized people still need to be able to edit files; at that moment, plaintext can exist. Encryption therefore does not automatically prevent data loss through an already authorized or compromised user. Endpoint protection, sensible roles and secure exchange procedures remain part of the overall setup. In the pilot, we examine the intended workflows and document their limits. This gives your team a clear statement of what is protected and what responsibility remains elsewhere.