Certification

(1) The BSI is the national certification body of the federal administration for IT security.
(2) A security certification, personal certification, or certification as an IT security service provider, may be applied for at the BSI for particular products or services. Applications are processed in the chronological order of their receipt; this may be departed from where, on account of the number and extent of pending examination procedures, the BSI cannot carry out an examination within a reasonable time and a public interest exists in the issuance of a certificate. The applicant must submit to the BSI those documents, and provide the information, the knowledge of which is necessary for the examination and assessment of the products and services or the suitability of the person, and for the issuance of the certificate. A certificate under the first sentence may be used for a product, a service, a person or an IT security service provider only where the BSI has issued a corresponding certificate and it has not been set aside or otherwise become invalid.
(3) Examination and assessment may be carried out by expert bodies recognised by the BSI under subsection (7).
(4) The security certificate is issued where
1. the information technology systems, components, products or protection profiles satisfy the criteria specified by the BSI, and
2. the Federal Ministry of the Interior has not prohibited issuance of the certificate under subsection (5). Before issuing the security certificate, the BSI submits the matter to the Federal Ministry of the Interior for examination under subsection (5).
(5) The Federal Ministry of the Interior may, in the individual case, prohibit the issuance of a certificate under subsection (4), where predominant public interests, in particular security-policy concerns of the Federal Republic of Germany, preclude its issuance.
(6) Subsection (4) applies accordingly to the certification of persons and IT security service providers.
(7) A body is recognised as an expert body within the meaning of subsection (3) where
1. the material and personnel resources, and the professional qualification and reliability, of the conformity assessment body satisfy the criteria specified by the BSI, and
2. the Federal Ministry of the Interior has determined that predominant public interests, in particular security-policy concerns of the Federal Republic of Germany, do not preclude its issuance. The BSI ensures, through the necessary measures, that the continued existence of the conditions under the first sentence is regularly reviewed.
(8) Security certificates of other recognised certification bodies from within the European Union are recognised by the BSI, provided they demonstrate a level of security equivalent to the BSI's security certificates and equivalence has been determined by the BSI.