Device lost. Protect the data.

Field service, remote work and business travel regularly take corporate devices out of the controlled office environment. These devices hold not only deliberately saved documents but also local working files and application data. We record which devices, storage media and operating states need to be protected. From this, we develop a suitable rollout concept for regular business use. Whether an approved configuration is additionally required is decided by the information processed and your deployment requirements, not by the size of your company.

For small teams, an easy-to-understand sign-in, a named administrator and reliably documented emergency access are central. In larger organizations, we plan rollout groups, software distribution, different device profiles and collaboration with the service desk. A pilot tests representative hardware, updates and recovery before further groups follow. Device changes, repairs and staff departures also receive a defined process. This way, the project does not end with encryption that is switched on just once.

Disk encryption is aimed in particular at preventing the reading of stored data without the required authorization, for example after the loss of a device or storage medium. Its effectiveness depends on the specific setup and the device state. That is why we consider the intended use, including sign-in, shutdown and resume. Selection must not be based on an encryption algorithm alone: key management and the actual permitted operation are equally part of the assessment.

After a successful sign-in, the operating system and authorized applications can access data. Disk encryption then does not automatically prevent malware, abusive actions by a signed-in user or data loss through other channels. File and folder encryption can address additional protection requirements; however, it follows a different permission model. Together, we determine which combination is needed. This gives your company a clear scope of protection and avoids the assumption that an encrypted storage medium eliminates every risk at the workstation.

Rolling out encryption affects the device’s lifecycle. Planning covers new employees, changed roles, lost credentials, repairs and decommissioning. Recovery must be available without undermining the intended access controls. For this, owners, identity verification and approvals are defined. A technically available recovery key alone is not yet a usable procedure. It must be clear who may use it, under what conditions and how this process remains traceable.

In the pilot, the intended devices and maintenance steps are tested together with encryption. This includes changes to hardware or system configuration relevant to the project and collaboration with existing management procedures. The results determine the rollout plan and the necessary briefing. For ongoing operation, inventory information, open exceptions and responsibilities are documented. This makes it possible to later identify which devices were actually included in the scope of protection and where a deliberate decision is still required.

DiskEncrypt version 9.10 from Utimaco IS GmbH is approved under BSI-VSA-10717 up to VS-NfD. The approval, issued on February 15, 2025, is valid until February 29, 2028, with a status date of February 15, 2025. The entry names RESTREINT UE/EU RESTRICTED as of March 10, 2025, and NATO RESTRICTED as of February 15, 2025. These details apply to the product version named and its permitted use. Before the rollout, we match the specific hardware, platform and configuration against the associated documentation and coordinate deployment with your responsible parties.

For military clients, additional requirements may apply to premises, devices, access and the personnel deployed. A required Ü3 is a requirement relating to the individual, not evidence of a product’s technical suitability. The project therefore separates personnel clearances from the selection of encryption and the approval of the environment. We plan these interfaces with you; this does not imply a blanket claim that every OTOKO® service or every team member is approved for every classified environment.

As the exclusive EMEA distributor for DiskEncrypt, OTOKO® combines delivery of the solution with technical implementation at your organization. We handle customer-specific adaptations and modifications, installation and commissioning. First, we determine which systems and workflows are to be connected, which functions are needed and who will administer the solution afterward. This results in an agreed implementation scope, a pilot and a rollout plan. Modifications are documented and assessed against the respective approval: the approval of the original version does not automatically apply to every modified setup.

After commissioning, maintenance and Level 1-3 support remain part of our offering. Level 1 handles structured intake and initial triage, Level 2 the in-depth analysis of configuration and integration, Level 3 the resolution of complex technical root causes and the required coordination with the vendor. Support scope, availability, response times and permitted remote access are agreed to fit the project. In classified environments, we take the permitted access and communication channels into account. Maintenance changes are assessed and tested in a traceable way and put into operation through the agreed approvals.