Classified information security leaves no room for improvisation.

These terms describe requirements for handling information with the corresponding classification. For technical planning, however, it must be established more precisely which information is processed and where. Mobile work, shared storage and data media place different requirements on an encryption solution. We therefore describe the use case together with you before selecting a product. Responsible security officers are involved early so that the technical assumptions match the client’s requirements.

“NATO level” is too vague for a specific offer. The scope of services described here applies to NATO RESTRICTED and to use cases suited to it. This does not imply a general commitment for higher classifications. A national approval is likewise not transferred to a different framework without review. Which approvals are required and what documentation they need is recorded in the project. This precision makes the offer, the implementation and the later acceptance easier to verify.

An approved product comes with a defined scope of validity. Product version, platform and the associated conditions of use are part of the selection. Simply naming a vendor or an encryption method is therefore not enough to state suitability. OTOKO® helps review the specific solution against the planned setup and prepare the required operating procedures. Reviewing the approval documentation remains mandatory before deployment into production.

The environment also includes devices, users, administration and communication channels. Key management, recovery and maintenance must match the intended level of protection. A later update or a changed mode of operation can therefore require a new assessment. The handover documents the agreed state and any open items. It does not replace the project-specific approval by the responsible bodies but provides the technical and organizational basis needed for it within the contracted scope.

The extended security clearance with security investigations under section 10 of the Security Clearance Check Act (SÜG) applies to individuals and certain security-sensitive activities. It is not a technical security level for a hard drive, software or a cloud. If an engagement requires such prerequisites, they are clarified for the specific personnel deployed and the intended access. The project scope must also match the permitted activities and information channels. A personnel clearance replaces neither product approval nor system approval.

For the initial exchange, an unclassified description of the task and the support needed is sufficient. Classified documents do not belong in a general contact form, public scanning services or communication channels that have not been agreed. Once the collaboration becomes concrete, we agree on points of contact and permitted channels. This also allows smaller companies to prepare a project in an orderly way: the requirements are derived from the project, not from the size of the organization or a blanket “military environment” label.