On 9 June 2026, Germany’s BSI (Bundesamt für Sicherheit in der Informationstechnik — Federal Office for Information Security) granted SAP an Einsatzerlaubnis (operational approval) at VS-NfD classification level for its SAP Cloud Infrastructure, hosted in Walldorf and St. Leon-Rot, Germany. This certification designates the infrastructure as suitable for processing sensitive official government data, formally opening the door to German federal public sector deployments and to highly regulated industries where security compliance is non-negotiable. SAP states it is the only cloud provider covering this scope for mixed deployments of SAP and third-party applications, per the official SAP announcement of 9 June 2026.
Background: What is VS-NfD and Why Does It Matter?
VS-NfD (Verschlusssachen — Nur für den Dienstgebrauch, or “Classified — For Official Use Only”) is the first tier of Germany’s official information classification scheme. It covers the bulk of internal federal administration exchanges: budget files, critical infrastructure data, sensitive public procurement information, and public health records. Obtaining this certification from the BSI is no quick process: the evaluation of SAP’s Cloud Infrastructure took approximately 12 months, according to the same official source.
The certified infrastructure features three independent availability zones spread across geographically separated data centres in Germany. This is a component-level certification (Einsatzerlaubnis) — an intermediate step toward full homologation (Zulassung). It is a strong signal, but not the final milestone.
What This Changes for CIOs and Finance Leaders
For German federal public-sector bodies and enterprises in regulated industries — energy, healthcare, defence, critical transport — this certification removes a major barrier. Organisations no longer need to fall back on on-premise deployments or isolated private infrastructure to handle VS-NfD data. A CIO can now consider running SAP ERP on certified public cloud without additional environment segmentation, provided the data processed actually falls within this classification level.
SAP’s position here is singular. The vendor states it is currently the only provider on which native SAP applications and third-party client applications can be run simultaneously in VS-NfD compliance (source: SAP News Center). Competitors such as proALPHA, Infor, or generic BSI-compatible cloud offerings do not cover this mixed-workload scope. This is a direct commercial argument in public tenders that involve existing SAP modules alongside third-party business tools on a shared platform.
For mid-market and enterprise companies in regulated supply chains — defence subcontractors, pharmaceutical laboratories, critical infrastructure operators — the impact is indirect but real. Public-sector clients will increasingly require VS-NfD compliance in service contracts. A company already running SAP in the cloud will hold a competitive advantage in those tenders, provided it operates on the certified SAP Cloud Infrastructure rather than a third-party hosted instance.
What to Watch Next
This certification is an intermediate step. Organisations handling data classified at higher levels — VS-Vertraulich or NATO equivalents — cannot yet rely on this authorisation. SAP has not communicated a timeline for higher-level homologation. Also worth monitoring: the relationship between this national certification and the forthcoming EUCS (European Union Cybersecurity Certification Scheme), whose convergence with national schemes such as VS-NfD is anticipated but not yet formalised by Brussels.
To go further, read our guide to ERP digital sovereignty (SecNumCloud, EUCS, sovereign cloud), our comparison of ERP cloud vs on-premise: pros and cons, and our analysis of SAP S/4HANA vs IFS Cloud vs Infor CloudSuite for industrial mid-market companies in 2026.
