Cloud MDM and BSI certification: three open dependencies

Discussions about cloud MDM in a classified context routinely blur three levels that are at very different stages of maturity. Taken separately, the picture is clearer.

What is established today

NIAP certified Microsoft Intune as the world's first cloud MDM under Common Criteria, on US assumptions. In Germany, BSI-CC-PP-0115-2021 is structurally designed for on-premises operation, and BlackBerry UEM is the only fully BSI-certified MDM. A US certification says nothing about transferability to Europe.

What is methodologically open

Two questions remain unanswered by any European body. How do you bound a Target of Evaluation whose infrastructure changes daily? And how does assurance continuity work for a continuously updated service? NIAP itself documented that cloud-specific security requirements are missing from the MDM Protection Profile.

What is politically open

EUCS Level High demands operational immunity from third-country access. US providers are subject to the CLOUD Act, and German data centres mitigate that without resolving it. The EU is discussing EU-controlled models, none of them operational. No date, no decision, no timeline.

Three dependencies, and all three have to be met

A new Protection Profile. Common Criteria requirements for cloud MDM do not exist. A new profile has to be drafted, consulted on and harmonised at European level. That is procedural work with the inertia it implies.

SOGIS harmonisation. A certification issued in one EU member state has to be recognised in Germany. That requires agreement among the national certification bodies. There is no automatic route and no fast track.

Clarity on EUCS Level High. Whether and under which conditions US hyperscalers can meet sovereign data requirements is politically unresolved. While that remains open, any cloud MDM certification stays contestable in a classified context.

This is not a technology problem

It is a question of accountability. The technology behind a cloud MDM is not weaker than that of an on-premises system. What is missing is an evaluation method that fits it, and a political answer to the question of who has access when it matters.

While these three dependencies remain open, on-premises MDM on sovereign infrastructure is the verifiable architecture for classified deployments. Not the only conceivable one, but the only one with no open evidence gap to explain today.

In an indigo deployment the choice of MDM also fixes the deployment mode. What follows from that for the operational environment is covered on the indigo page.