diff --git a/news/237.bugfix b/news/237.bugfix
new file mode 100644
index 00000000..c69e4f77
--- /dev/null
+++ b/news/237.bugfix
@@ -0,0 +1 @@
+Move 'DEFAULT_PERMISSION', 'DEFAULT_PERMISSION_SECURE', 'PERMISSIONS' to plone.app.vocabularies.security [ksuess]
diff --git a/plone/app/content/browser/vocabulary.py b/plone/app/content/browser/vocabulary.py
index f7693cd7..e2189a02 100644
--- a/plone/app/content/browser/vocabulary.py
+++ b/plone/app/content/browser/vocabulary.py
@@ -33,19 +33,33 @@
 import itertools
 
 
+import zope.deferredimport
+
 logger = getLogger(__name__)
 
 MAX_BATCH_SIZE = 500  # prevent overloading server
 
-DEFAULT_PERMISSION = "View"
-DEFAULT_PERMISSION_SECURE = "Modify portal content"
-PERMISSIONS = {
-    "plone.app.vocabularies.Catalog": "View",
-    "plone.app.vocabularies.Keywords": "Modify portal content",
-    "plone.app.vocabularies.SyndicatableFeedItems": "Modify portal content",
-    "plone.app.vocabularies.Users": "Modify portal content",
-    "plone.app.multilingual.RootCatalog": "View",
-}
+zope.deferredimport.defineFrom(
+    'plone.app.vocabularies.security',
+    'DEFAULT_PERMISSION', 'DEFAULT_PERMISSION_SECURE', 'PERMISSIONS',
+)
+if not 'PERMISSIONS' in globals():
+    DEFAULT_PERMISSION = "View"
+    DEFAULT_PERMISSION_SECURE = "Modify portal content"
+    PERMISSIONS = {
+        "plone.app.vocabularies.Catalog": "View",
+        "plone.app.vocabularies.Keywords": "Modify portal content",
+        "plone.app.vocabularies.SyndicatableFeedItems": "Modify portal content",
+        "plone.app.vocabularies.Users": "Modify portal content",
+        "plone.app.multilingual.RootCatalog": "View",
+    }
+    deprecated("DEFAULT_PERMISSION",
+            "Import from plone.app.vocabularies.security instead.")
+    deprecated("DEFAULT_PERMISSION_SECURE",
+            "Import from plone.app.vocabularies.security instead.")
+    deprecated("PERMISSIONS",
+            "Import from plone.app.vocabularies.security instead.")
+
 TRANSLATED_IGNORED = [
     "author_name",
     "cmf_uid",