jump to content
go to searchDemo

Video conferencing for government agencies: requirements & secure solutions

How to meet the requirements of public administration

  • Sichere Kommunikation
A woman in business attire at a desk, focused on a laptop with documents beside her, symbolizes office work and document management. The openVisavid logo is in the bottom right corner.

The digitalization of public administration has significantly increased the need for powerful and at the same time legally compliant tools for official communication. Online meetings and online conferences are now an integral part of the daily work routine in government agencies and public institutions. This brings the question to the forefront of what requirements a video conferencing solution must meet in order to be used in the context of public administration. In addition to functional aspects, legal, data protection and security-related requirements play a central role.

Legal and data protection requirements for video conferencing systems

The use of video conferencing solutions in public authorities is subject to strict data protection standards. The Conference of Independent Data Protection Authorities of the Federation and the States (DSK) has published a guide to video conferencing systems together with the Federal Commissioner for Data Protection and Information Freedom (BfDI), which is specifically aimed at public authorities. It defines the key requirements for secure video conferencing:

  • Lawfulness of processing: Video conferencing systems must also be designed in accordance with Articles 24, 25 and 32 of the GDPR, using appropriate technical and organizational measures to comply with the requirements of the GDPR.
  • Authentication: Access to a video conference session and the associated data must only be possible for authorized persons. Participants must authenticate themselves to the service.
  • Encryption: Encryption in line with the state of the art is required, at a minimum, transport encryption in accordance with the technical guidelines of the Federal Office for Information Security (BSI).
  • Two-factor authentication: Where there is an increased risk to the rights and freedoms of natural persons, two-factor authentication in line with the state of the art is required.

These requirements make it clear that a video conferencing solution for government agencies cannot be judged solely on its communication features. Data protection and IT security are integral parts of the requirements and must be taken into account when selecting a system.

BSI requirements catalog for video conferencing systems

The BSI framework for video conferencing systems was fundamentally revised in 2025. The previous Video Conferencing Systems compendium from 2020, on the basis of which requirements were previously divided into basic, standard, and requirements with increased security needs, was replaced by the Compendium for Internal Telecommunications Systems with Increased Security Requirements (KomTK) on 5 March 2025. The KomTK also replaces the previous Technical Guideline Secure Telecommunications Systems (TLSTK II) and thus covers a broader range of telecommunications systems, including video conferencing solutions.

For the use of a video conferencing solution in government agencies, two documents are particularly relevant at present:

  • Minimum standard of the BSI for video conferencing services: It regulates both functional requirements for the service itself as well as specifications for conception, planning, procurement, operation and use.
  • KomTK: The compendium is aimed at planners, purchasers, operators, administrators, auditors and users and accompanies telecommunications systems with increased security requirements throughout their entire lifecycle. From planning to procurement, operation and decommissioning. It includes a management summary as well as a procurement guide and examples of security concepts.

In practice, this means that when choosing a video conferencing solution, authorities should check whether the specific use case falls under the general minimum standard or, for example, when communicating with increased security requirements, the more stringent requirements of the KomTK should be applied.

Digital sovereignty as a strategic factor

In addition to legal and technical requirements, digital sovereignty is becoming increasingly important when choosing a video conferencing solution. For government agencies and public enterprises, this means that communication data should not be subject to the control of third parties. This applies to data processing, the infrastructure used, and the traceability of the software used. An open source video conferencing solution offers a decisive advantage here: the source code can be viewed and checked, which creates transparency and reduces dependence on individual providers. When combined with a hosting option on your own or European infrastructure, digital sovereignty can be consistently implemented.

Security as a fundamental principle of system architecture

The requirements mentioned show that security in a video conferencing solution for government agencies must not be an afterthought, but must be part of the system architecture from the beginning. This is where the openVisavid approach comes in: the video conferencing solution follows the principle of Security by Design, where security requirements are considered during development rather than added later. As an open source video conferencing solution, the source code is visible, which allows government agencies and companies to independently verify the security mechanisms used.

Another feature that is relevant in the context of the encryption and authentication requirements described is that openVisavid is currently the only open source video conferencing solution that provides both native apps and end-to-end encryption. This combination is particularly relevant for use cases with increased security requirements, as described in the BSI requirements catalog.

Conclusion

Choosing the right video conferencing solution for use in government agencies requires consideration of several levels: data protection requirements under the GDPR, technical requirements of the BSI, and overarching aspects such as digital sovereignty. A secure video conference is not defined by individual features, but by an overall concept that combines encryption, authentication, and transparency of the software used. For public institutions that want to conduct online meetings and conferences in a legally compliant and secure manner, this combination forms the basis for a future-proof communication infrastructure.