iOS in Government Operations.
From certified MDM to approval-compliant operation.
indigo stands for iOS Native Devices in Government Operation and enables use of Mail, Contacts and Calendar on iPhone and iPad for NATO RESTRICTED level data. The BSI certifies the MDM server as the Target of Evaluation — the Operational Environment outside that certification boundary is what determines whether a deployment succeeds or fails. Platform6 takes responsibility for exactly that.
- ADE/DEP enrollment pipeline for BSI-compliant VS-NfD deployments
- Platform SSO, Managed Apple IDs, SCEP/EST certificate infrastructure
- Governance documentation: operating concept, RACI, ADRs, runbooks
- Approval
- VS-NfD / NATO-RESTRICTED
- Standard
- Mobile Solutions for Government Operations
- MDM
- Certified · BSI-DSZ-CC-1235-2025
- iOS/iPadOS 26
- BSI-VSA-11003 · valid until 31 Oct 2027
- Platform6 scope
- Operational environment, outside the TOE
01 Boundary and scope
The certification boundary is the architecture boundary.
The MDM server sits on the perimeter: the device reaches it directly over the internet, without a tunnel — at enrollment time the VPN profile does not exist yet. That exposure is why the certificate under BSI-CC-PP-0115 is required. The gateway carries the payload. Enrollment, identity, PKI and governance sit outside the certification boundary.
The always-on tunnel to the approved VPN gateway is the only way in. The MDM server is not reachable from outside; Apple services for device and MDM run through the gateway's controlled handoff point. That is why no MDM-TS certificate is required — in return every external dependency in the stack needs an architecture decision.
What BSI certifies
The MDM server. BSI Protection Profiles PP-0115 (MDM-TS) and PP-0116 (MDM-TS + TCC module) define the security requirements for the MDM server component — not the surrounding operational environment. BlackBerry UEM currently holds full certification (BSI-DSZ-CC-1235-2025, EAL4+). Samsung SDS EMM and Relution UEM still run under a transition period, until 30 Nov and 31 Dec 2026 respectively. Omnissa Workspace ONE and Ivanti EPMM dropped out of their window without a certificate. Cloud and SaaS architectures remain structurally out of scope as long as no Protection Profile for cloud services exists and SOGIS harmonisation is pending.
What must be built
The OE is explicitly defined in the BSI Protection Profile as outside the TOE. indigo requires no additional software — but it requires a defined architecture: ADE/DEP enrollment pipeline, Platform SSO, Managed Apple IDs, SCEP/EST certificate infrastructure, and complete governance documentation. No certified MDM configures this environment automatically. The OE must be architecturally designed, implemented, and documented.
A certified MDM is a necessary but not sufficient condition for compliant operations. Organizations that fail in the indigo approval process or delay deployment do not fail because of MDM certification — they fail because of an incompletely defined Operational Environment. That is the architecture gap Platform6 closes.
The indigo stack and Platform6 scope
What BSI-indigo requires
- iPhone/iPad — only approved endpoints. Approved apps: Mail, Contacts, Calendar. Apple silicon with Secure Enclave; MIE (Memory Integrity Enforcement) on A19/M5 devices.
- BSI-approved VPN gateway — iOS supports IKEv2, Cisco IPsec, and L2TP over IPsec natively; primary gateway primarily Rohde & Schwarz
- BSI-certified MDM — currently BlackBerry UEM (PP-0116, EAL4+). indigo requires no additional software beyond MDM supervision.
Operational Environment — outside the TOE
- ADE/DEP enrollment pipeline design and implementation documentation
- Platform SSO architecture: identity binding, Managed Apple IDs, federated authentication
- SCEP/EST certificate infrastructure: design, issuance, lifecycle
- Security baseline with indigo High profile (VS-NfD operational standard)
- Governance: operating concept, RACI matrix, ADRs, runbooks
02 Operations and approval status
Two deployment modes — distinct OE requirements
Reachable, and sovereign in operation
The MDM server is reachable from the internet — the device contacts it directly at enrollment, before any VPN profile exists — while running on premises on sovereign infrastructure under German operational control. The exposure is the reason for the MDM-TS certificate; the second requirement decides more: it determines which MDM architectures qualify at all. Cloud and SaaS hosted products do not meet it in their standard architecture, regardless of data centre location. OE requirements here centre on certificate infrastructure and identity architecture.
Covert / network-isolated
No direct internet connection. Enrollment pipeline, ADE communication and certificate infrastructure must operate entirely on-premises or at a controlled handoff point. Highest OE complexity. Requires explicit architecture decisions for every external dependency point in the indigo stack.
Certification status of the management plane
The certified field is contracting rather than growing: five eligible MDM servers in March, three in October. One product holds the full certificate; the others were listed with fixed transition windows. Two of those have expired without a certificate, two run until the end of the year. Status: 13 October 2026.
| Product | Status | Deadline |
|---|---|---|
| BlackBerry UEM | Fully certified | 7 Sep 2030 |
| Samsung SDS EMM | Transition period | 30 Nov 2026 |
| Relution UEM | Transition period | 31 Dec 2026 |
| Omnissa Workspace ONE | Window expired | 30 Sep 2026 |
| Ivanti EPMM | Window expired | 30 Jun 2026 |
| Cloud and SaaS architectures | Structurally out of scope | — |
Applies to Brightsite operation: there the MDM server is reachable from the internet and requires a certificate under BSI-CC-PP-0115. In Darksite operation at VS-NfD behind an approved VPN gateway, no MDM-TS certificate is required.
Cloud and SaaS stay structurally out of scope while no Protection Profile for cloud services exists and SOGIS harmonisation is pending.
The transitional route that allowed deployment during an ongoing evaluation is closed: products not already listed need a completed certification. For procurement this means an ongoing procedure is no longer a basis for planning. A PP-0115 certification realistically takes around 24 months, 30 in the downside case. What decides that timeline.
Amber: the same approach, on the Mac
Amber stands for Apple macOS Based Environment for Restricted and is the macOS counterpart to indigo, currently in BSI certification. Where indigo runs an iOS device with a small, fixed set of approved applications, Amber is a system-high approach: the entire workstation is classified.
What that means for choosing a management plane is better discussed in a conversation than on a web page.
indigo baselines: Base and High
The mSCP indigo baselines v1.4 (branch ios26_rev2, NIST GitHub) define two configuration profiles. Platform6 translates these baseline definitions into deployment-ready MDM configuration profiles with documented rationale for each setting — embedded in the governance framework of the Operational Environment.
~70 rules. Core hardening for iOS in government use. Foundation for all indigo deployments.
Base + full iCloud isolation, mandatory S/MIME with defined certificate rules, known networks only, Safari JS disable, RCS disable, TLS untrusted disable. VS-NfD operational standard.
Platform6 is responsible for what the stack leaves open.
For every certified component in the indigo stack, there is an established actor. Not for the operational environment.
Platform6 closes this gap: the architecture that connects VPN stack, MDM server and app layer and that is explicitly outside the certified range in the BSI Protection Profile.
The following companies supply certified or approved components of the indigo stack. No sales or partner relationship with Platform6 exists; the list describes the market.
- Rohde & Schwarz Cybersecurity — BSI-approved VPN stack
- BlackBerry UEM — BSI-certified MDM server (Target of Evaluation)
- agilimo Consulting — defence and federal operations
- Materna Virtual Solution — SecurePIM, Trust products, app layer
- ADE/DEP enrollment pipeline: design, sequence, documentation
- Identity architecture: Platform SSO, Managed Apple IDs, federated authentication
- SCEP/EST certificate infrastructure: design, issuance, lifecycle
- Governance: operating concept, RACI matrix, ADRs, runbooks
03 Reach and collaboration
NATO-RESTRICTED: Same MDM requirements. 32 member states.
In February 2026 Apple confirmed that iPhone and iPad are approved to handle information classified as NATO RESTRICTED. The NATO IAPC expansion in February 2026 to 32 member states carries the identical MDM requirements profile as indigo. For system integrators advising NATO procurement across multiple member states, the OE architecture is the invariant core. The BSI-certified MDM server is the common denominator; the Operational Environment must be designed for each national deployment reality. Platform6 addresses procurement advisors and SI architects at this level.
- BSI-DSZ-CC-1235-2025: BlackBerry UEM, fully certified (MDM server, PP-0116, EAL4+)
- BSI-DSZ-CC-1241: procedure for Ivanti EPMM, transition period expired 30 June 2026 with no certificate
- Omnissa Workspace ONE: transition period expired 30 September 2026 with no certificate
- BSI-VSA-11003: iOS/iPadOS 26, NATO RESTRICTED, valid until 2027-10-31
- BSI-VSA-10901: indigo, deployment permission for classified use, valid until 2027-10-31
Who this is relevant for
System integrators with government mandates
Your teams deliver MDM operations and VPN stack. The Operational Environment architecture — enrollment pipeline, identity model, certificate infrastructure, governance documentation — is the gap between a certified MDM and a compliant deployment. Platform6 closes exactly this gap.
Federal agencies and NATO procurement advisors
A certified MDM in your tender is necessary but not sufficient. Without a defined Operational Environment, you get a certified product in an undocumented environment — and therefore no defensible compliance argument. Platform6 delivers the architectural responsibility for the OE that allows you to move from compliance evidence to procurement decision.
Initial OE Architecture Consultation
Platform6 conducts structured initial consultations for indigo deployments in planning or active procurement. The focus is the assessment of the Operational Environment — deployment mode, identity infrastructure, certificate requirements and governance scope — in relation to the BSI certification boundary.
To prepare: deployment mode (Brightsite/Darksite), MDM selection, existing identity infrastructure, and whether the deployment is led by a system integrator or the agency directly.