Before employees are granted access to sensitive information or perform security-sensitive tasks as part of an assignment, their reliability must be verified through a special procedure. For example, a person is considered untrustworthy if they have a criminal record, do not profess allegiance to the free democratic basic order, or have ties to foreign intelligence services or criminal organizations.
The Security Screening Act (SÜG) and the corresponding state laws set out clear guidelines for the screening process. The procedure is less complicated than many companies initially assume.
However, companies looking to enter a security-related field for the first time face many practical questions. And there are some common mistakes that companies should avoid.
What does the Security Clearance Act regulate?
The subject matter of the Security Clearance Act is security clearance. Before an employee is permitted to work in a security-sensitive area, a review is conducted to determine whether the employee could pose a security risk.
This process is based on a security declaration in which the individual concerned—and often their spouse or domestic partner as well—must provide extensive personal information, such as details about their professional career, stays abroad, or personal circumstances. The individual concerned—and, if applicable, their spouse or domestic partner—must consent to the security screening and the associated processing of their data.
The company typically submits the documents through the safety officer to the
the public agency for which the work is being performed—for example, a federal agency or a ministry that awards the contract. That agency conducts the security clearance review.
In the economic sector (for example, for companies involved in defense or infrastructure), the responsible agency is often the Federal Ministry for Economic Affairs and Energy or an agency designated by it.
The Federal Office for the Protection of the Constitution regularly participates in the actual vetting process. It conducts significant portions of the vetting, particularly the inquiries and assessments of potential security risks.
Depending on the nature of the job, the law distinguishes between several levels of security clearance (Ü1, Ü2, Ü3), which differ in scope and intensity. For higher-level positions, certain information about close relatives—such as spouses or domestic partners—may also be included in the screening process.
Which individuals must undergo a security screening?
All companies must comply with the Security Clearance Act when operating in security-sensitive areas. However, only those employees who themselves perform security-sensitive duties must and may be screened.
Employees with access to classified information
On the one hand, these are employees who have access to classified information at the VS-CONFIDENTIAL, SECRET, or TOP SECRET levels, or who are even able to obtain such information. Whether classified information is involved in a specific contract or is classified accordingly is determined by the procurement and contract documents as well as the client’s security guidelines.
Employment at a location critical to life or national defense
In addition, employees working in facilities or divisions that are vital to life or national defense must be screened. The SÜFV specifies which ones these are. Examples of positions critical to national security or defense include, for instance, the operation of information and communications technology for the highest federal authorities, all procurement activities in security-related areas, and, in particular, the construction, maintenance, or repair of military vehicles, military equipment, or naval vessels.
Within this facility, the specific security-sensitive positions are identified. Since the 2026 amendment to the SÜG, operators of facilities critical to life or national defense must report these positions.
In light of the growing number of hybrid threats—including those targeting critical infrastructure—the federal government intends to expand the group of individuals who are to undergo security screening based on these criteria.
Three-Tier Security Screening
The SÜG distinguishes between three levels of security clearance, which differ significantly in the scope and depth of the screening. With each level, both the requirements and the organizational burden on companies increase.
- Ü1 (basic security clearance)
This level is typically used when employees are granted access to information classified as VS—CONFIDENTIAL. The focus is on the individual concerned. The screening is based primarily on the information provided in the security declaration as well as inquiries made with government authorities, in order to identify potential security risks at an early stage.
- Ü2 (Extended Security Clearance)
This level is generally applied to activities involving information classified as SECRET. The screening is expanded by taking into account—in addition to the information provided by the individual—certain details regarding their personal circumstances. The goal is to obtain a more comprehensive picture of potential security risks.
- Level 3 (extended security clearance with security investigations)
This level is intended for particularly sensitive duties, especially those involving information classified as TOP SECRET. In addition to the regular screenings, additional security investigations may be conducted, in which further insights into the individual’s reliability—beyond the mere evaluation of existing data—are obtained, among other things, through interviews with other individuals.
The security officer coordinates the process
A company involved in state security matters must have a security officer and a deputy security officer as soon as it becomes subject to state security regulations—for example, if it gains access to classified information or undertakes security-related contracts for government agencies. In such cases, the appointment of these officers is a prerequisite for participation in relevant projects. Without a security officer, collaboration on security-sensitive activities is not possible.
It may be a good idea to establish this role early on if relevant projects are already on the horizon or if the issue is already arising in specific areas of the company.
The safety officer serves as the central point of contact for the entire process. His responsibilities are clearly defined:
- He determines whether a security clearance is required.
- He initiates and coordinates the process.
- He checks the security declarations for completeness.
- He serves as the point of contact for the relevant authority.
- He maintains the necessary security records.
- And he ensures that ongoing obligations are met (for example, reporting changes).
The security officer must not be part of human resources or otherwise involved in personnel matters. A data protection officer may not additionally assume this role either. The security officer must maintain the required security records for the employees who have been vetted separately from other personnel records.
In practice, it has been shown that the more clearly this role is defined and the earlier it is incorporated, the more smoothly the process runs.
The Most Common Mistakes in Security Checks
In practice, the following errors often occur:
Unnecessary security clearances are initiated
In practice, security clearances are sometimes initiated as a precautionary measure even for employees who do not actually need one for their specific job duties. This is because not every job at a company with ties to government agencies, infrastructure, or defense is automatically security-sensitive.
Unnecessary security checks create an unnecessary burden and are, moreover, not permitted at all. This is because they constitute a significant intrusion into the rights of the data subject and require the processing of a large amount of personal data. They may therefore only be conducted if the legal requirements are actually met.
Companies should therefore carefully assess, even before initiating proceedings, whether the activity in question actually falls under the SÜG.
The security officer is not sufficiently independent
It happens repeatedly that the security officer lacks the necessary independence. The security officer is the central point of contact for the entire process. Their position within the company is therefore specifically defined. In particular, they must not be part of the human resources department. The Security Clearance Act (SÜG) provides for separate security officers for this purpose.
In practice, this separation is not always consistently implemented. Companies should ensure early on that the security officer is organizationally independent and can actually perform his or her duties separately from personnel decisions.
Security files are not maintained properly
Mistakes also often occur when handling security files. Legally, these are not personnel files and must therefore be kept separate from other employee data.
Special caution is also required when changing employers. The security file does not belong to the employee and must not be transferred to a new employer. Companies should therefore establish clear guidelines for the management, storage, and destruction of these documents.
The cooperation obligations of employees are underestimated.
Many companies underestimate the cooperation obligations of their employees. They focus on the initial security clearance. Less well known is that these obligations do not end there.
Employees must report certain changes even after the security clearance process has been completed. Depending on the type of clearance, these may include, for example, changes in residence or family status. In the case of the extended security clearance (Ü2)—the most common type in practice—spouses or domestic partners are also taken into account. Changes in these personal circumstances must therefore be reported on an ongoing basis.
Companies should inform employees of these obligations at an early stage and establish appropriate reporting channels.
Options Under Labor Law in the Event of a Security Risk
If a security screening reveals a risk and an employee cannot therefore be entrusted with security-related duties, the employer may, in principle, consider termination for personal reasons. However, the employer must first examine and, if necessary, implement less severe measures, such as transferring the employee to a position that is not security-sensitive.
According to the Lower Saxony Regional Labor Court , in the case of new hires, it would also be permissible under the law governing general terms and conditions to include a condition subsequent in the event of a security risk. This applies at least if the position in question involves security-sensitive work and it is not possible for the employee to be assigned to other duties.
FAQ
When is a job considered security-sensitive?
When employees have access to classified information or work on security-related facilities or projects.
How long does a security screening take?
It depends on the type of screening (Ü1, Ü2, Ü3) and can take several months.
Is an employee allowed to work before the background check is complete?
Generally speaking, no—at least not in a security-sensitive position.
Does every company have to have a safety officer?
If companies are involved in safety-related projects: yes.
Can a security screening be conducted without the employee’s consent?
No. Employees must consent to the security screening and the associated data processing. Without this consent, the process will not be carried out or will be terminated.
What happens if the security screening results are negative?
The employee cannot be assigned to the position in question; a transfer or—as a last resort—termination may be considered.
What is the difference between the Ü1, Ü2, and Ü3 security clearance levels?
The three levels differ primarily in the scope of the screening and the associated effort.
- Ü1 is the simplest form and focuses on the individual in question.
- Ü2 expands the screening to include additional information, particularly regarding the individual’s personal circumstances.
- Ü3 also includes so-called security investigations—that is, more extensive measures to assess potential security risks.
These levels are typically aligned with the classification levels:
VS—CONFIDENTIAL (Ü1), SECRET (Ü2), and TOP SECRET (Ü3).
