This document discusses BSI approval for network security solutions in Germany. It provides an overview of BSI and its role in evaluating and approving solutions for transporting classified German data. Key points covered include: - BSI is the German Federal Office for Information Security that develops security criteria and evaluates IT systems used by the German government. - BSI approval is required for transporting classified German data and corresponds to high-level Common Criteria or FIPS certifications. - ADVA's FSP 3000 DWDM system is currently the only one with BSI approval for transport of classified data up to VS-V level, allowing use for EU and NATO classified data as well.

1. BSI approval and what it means for network security
January 2021
Ensuring robust and effective protection for data in motion
BSI: German Federal Office for Information Security

2. © 2021 ADVA. All rights reserved.2
How can you protect data in motion?
Cyberattacks have a high cost – and not just from the loss of sensitive data
Reputational damage and
regulatory penalties may
have a much more harmful
impact!
Data in motion is vulnerable

3. © 2021 ADVA. All rights reserved.3
Layer 1 encryption, which is integrated into the DWDM transport equipment, has
proven to be a robust and cost-efficient solution to secure data in motion
Data encryption: securing data in motion
DWDM
transport
Server
Storage
Y-bridge for
service activities Fiber coupling device
Apps
SAN, HPC
switches
SAN, HPC
switches
Server
Storage
Apps
DWDM
transport
Data center A Data center B

4. © 2021 ADVA. All rights reserved.4
Certifications and approvals prove that a security system lives up to its claims
To ensure that:
• The solution delivers the levels of security that it
claims to
• The evaluation has been conducted in a rigorous,
standard and repeatable manner
• The evaluation tests are efficient to prove the
validity of the solution for the target applications
Why security certifications and approvals?

5. © 2021 ADVA. All rights reserved.5
For Layer 1 data encryption equipment (cryptographic modules)
Common Criteria (CC)
certification
FIPS 140-2
certification
BSI approval for transport of
German classified data
Developed by International agreement (CCRA)
US government and
industry group
German Federal Office for
Information Security (BSI)
Certificate issued by
National authority defined by
CCRA members. In Germany, BSI
US National Institute for
Standards and Technology
(NIST)
German Federal Office for
Information Security (BSI)
Tests performed by Any licensed lab Any licensed lab BSI
Evaluation levels
(levels of security)
7 levels: EAL1 to EAL7 4 levels: Level 1 to level 4
4 levels: VS-NfD, VS-V, Geheim,
Streng Geheim
Evaluation approach
Product-centric for lower levels;
holistic for higher levels
Product-centric Holistic (HW, SW, vendor, …)
Who can be tested? Any vendor, on demand Any vendor, on demand BSI choice, driven by demand
Key certifications and approvals

6. © 2021 ADVA. All rights reserved.6
BSI approval
• The BSI develops criteria and methods for the
evaluation of the security of IT systems used by
German government, business and society
• The BSI evaluation criteria are very strict and have a
holistic approach; they correspond to a high-level
Common Criteria or FIPS certification
• Only systems that pass the BSI evaluation process
receive BSI approval for transport of German-
classified data (and therefore also EU- and NATO-
classified data)
Main roles of the BSI for the networking industry
German Office for Information Security (BSI)
• Germany is a member of the Common Criteria
recognition agreement (CCRA)
• In Germany, Common Criteria certification is issued
by the BSI
• System vendors interested in obtaining a certificate
of compliance up to a specific security level will
perform the corresponding tests in a licensed
laboratory
• If tests are passed, the BSI will issue a certificate
Common Criteria accreditation bodyGerman cybersecurity authority
Common Criteria certification

7. © 2021 ADVA. All rights reserved.7
ADVA offers the most robust and reliable Layer 1 encryption on the market
• As of today, the FSP 3000 is the only
DWDM system that has BSI approval to
be used for the transport of German-
classified data up to VS-V level
• The approval also allows the use of ADVA
FSP 3000 equipment for the transport of
EU and NATO classified data
• The details of the BSI approval as well as
the complete list of systems approved by
the BSI can be found on the official BSI
page here
FSP 3000 has BSI approval

8. Thank you
IMPORTANT NOTICE
ADVA is the exclusive owner or licensee of the content, material, and information in this presentation. Any reproduction, publication or reprint, in whole or in part, is strictly prohibited.
The information in this presentation may not be accurate, complete or up to date, and is provided without warranties or representations of any kind, either express or implied. ADVA shall not be responsible for and disclaims any liability for any loss or damages, including without limitation,
direct, indirect, incidental, consequential and special damages, alleged to have been caused by or in connection with using and/or relying on the information contained in this presentation.
Copyright © for the entire content of this presentation: ADVA.
www.adva.com | info@adva.com