VS-NfD and confidentiality protection in the construction industry: Why IT compliance will be the entry ticket for large projects.

Defense, internal security, energy supply, administration, critical infrastructure: In hardly any segment is the construction volume currently growing as clearly as where the public sector itself is the builder. The legislator is accompanying this development. The draft of a Bundeswehr Infrastructure Acceleration Act, adopted by the Federal Cabinet in July 2026 and currently in the parliamentary process, classifies military infrastructure projects as of overriding public interest and significantly shortens approval and participation procedures.

This is an opportunity for planning and construction companies. However, it is subject to a condition that was long a footnote in tender documents: the verifiable handling of classified information.

German security clearance law recognizes four classification levels: TOP SECRET, SECRET, CONFIDENTIAL, and RESTRICTED FOR OFFICIAL USE ONLY (VS-NfD). VS-NfD is the lowest level - and at the same time the one that practically always occurs in construction projects. It affects precisely the documents that arise in every project anyway:

• Site and floor plans of security-relevant properties

• Schematics of technical building equipment as well as energy and network structures

• Security, access, and locking concepts

• Fire protection, escape, and evacuation planning

• As-built and revision documentation

Unlike higher classifications, VS-NfD generally does not trigger a security check for individuals. Instead, briefing and written commitment from all involved, a consistently practiced need-to-know principle, a designated responsible person with a reporting line to management, and the physical protection of the documents themselves: labeling, locked storage, transfer only with approval from the issuing office, and verifiable destruction are required.

Specific rules apply to electronic processing. Classified information does not belong in a regular email inbox or a standard cloud. Where VS-NfD is processed or transmitted digitally, approved procedures and authorized products are required; the relevant lists are maintained by the BSI.

This is where the real challenge arises. The construction and planning industry has consistently optimized its collaboration for openness over the years: common models, a central CDE, many participants, mobile devices on the construction site, short paths via messenger and distributor. Security requires the opposite - segmentation, traceability, documented access.

• Typical weaknesses are therefore rarely of a technical nature:

• Classified plans are unclassified in the general project area

• Specialist planners and subcontractors are not contractually bound

• There is a lack of clean separation between classified documents and the rest of the project inventory

• Plan excerpts are photographed and forwarded on-site

• No one can prove who received which document and when

Confidentiality protection is no longer a sideshow for the IT department in the construction industry but a prerequisite for market access. The good news is that the requirements are manageable and largely organizational in nature. Timing is crucial. Companies that are currently establishing classification, responsibilities, and protected work environments can demonstrate in procurement procedures what others are only promising - thereby gaining an advantage that is professionally difficult to catch up on.