2013/488/EU: Council Decision of 23 September 2013 on the security rules for protecting EU classified information

Article 1

Purpose, scope and definitions

Article 2

Definition of EUCI, security classifications and markings

• (a) TRÈS SECRET UE/EU TOP SECRET: information and material the unauthorised disclosure of which could cause exceptionally grave prejudice to the essential interests of the European Union or of one or more of the Member States;

• (b) SECRET UE/EU SECRET: information and material the unauthorised disclosure of which could seriously harm the essential interests of the European Union or of one or more of the Member States;

• (c) CONFIDENTIEL UE/EU CONFIDENTIAL: information and material the unauthorised disclosure of which could harm the essential interests of the European Union or of one or more of the Member States;

• (d) RESTREINT UE/EU RESTRICTED: information and material the unauthorised disclosure of which could be disadvantageous to the interests of the European Union or of one or more of the Member States.

Article 3

Classification management

Article 4

Protection of classified information

Article 5

Security risk management

Article 6

Implementation of this Decision

Article 7

Personnel security

• — a need-to-know,

• — been security cleared to the relevant level, where appropriate, and

• — been briefed on their responsibilities.

Article 8

Physical security

Article 9

Management of classified information

• (a) as a general rule, EUCI shall be transmitted by electronic means protected by cryptographic products approved in accordance with Article 10(6);

• (b) when the means referred to in point (a) are not used, EUCI shall be carried either:
• (i) on electronic media (e.g. USB sticks, CDs, hard drives) protected by cryptographic products approved in accordance with Article 10(6); or
• (ii) in all other cases, as prescribed by the competent security authority in accordance with the relevant protective measures laid down in Annex III.

Article 10

Protection of EUCI handled in communication and information systems

• (a) the confidentiality of information classified SECRET UE/EU SECRET and above shall be protected by cryptographic products approved by the Council as Crypto Approval Authority (CAA), upon recommendation by the Security Committee;

• (b) the confidentiality of information classified CONFIDENTIEL UE/EU CONFIDENTIAL or RESTREINT UE/EU RESTRICTED shall be protected by cryptographic products approved by the Secretary-General of the Council (‘the Secretary-General’) as CAA, upon recommendation by the Security Committee.

Notwithstanding point (b), within Member States’ national systems, the confidentiality of EUCI classified CONFIDENTIEL UE/EU CONFIDENTIAL or RESTREINT UE/EU RESTRICTED may be protected by cryptographic products approved by a Member State’s CAA.

• (a) an IA Authority (IAA);

• (b) a TEMPEST Authority (TA);

• (c) a Crypto Approval Authority (CAA);

• (d) a Crypto Distribution Authority (CDA).

• (a) a Security Accreditation Authority (SAA);

• (b) an IA Operational Authority.

Article 11

Industrial security

Article 12

Sharing EUCI

Article 13

Exchange of classified information with third States and international organisations

• (a) the Union shall conclude agreements with third States or international organisations on security procedures for exchanging and protecting classified information (‘security of information agreements’); or

• (b) the Secretary-General may enter into administrative arrangements on behalf of the GSC in accordance with paragraph 17 of Annex VI where the classification level of EUCI to be released is as a general rule no higher than RESTREINT UE/EU RESTRICTED.

Article 14

Breaches of security and compromise of EUCI

• (a) inform the originator;

• (b) ensure that the case is investigated by personnel not immediately concerned with the breach in order to establish the facts;

• (c) assess the potential damage caused to the interests of the Union or of the Member States;

• (d) take appropriate measures to prevent a recurrence; and

• (e) notify the appropriate authorities of the action taken.

Article 15

Responsibility for implementation

• (a) personnel of Member States’ Permanent Representations to the European Union, and national delegates attending meetings of the Council or of its preparatory bodies, or participating in other Council activities;

• (b) other personnel in Member States’ national administrations, including personnel seconded to those administrations, whether they serve on the territory of the Member States or abroad;

• (c) other persons in the Member States duly authorised by virtue of their functions to have access to EUCI; and

• (d) Member States’ contractors, whether on the territory of the Member States or abroad.

Article 16

The organisation of security in the Council

• (a) agreements referred to in Article 13(2)(a);

• (b) decisions authorising or consenting to the release of EUCI originating in or held by the Council to third States and international organisations, in accordance with the principle of originator consent;

• (c) an annual assessment visit programme recommended by the Security Committee for visits to assess Member States’ services and premises, Union bodies, agencies and entities which apply this Decision or the principles thereof, and for assessment visits to third States and international organisations in order to ascertain the effectiveness of measures implemented for protecting EUCI; and

• (d) security policies as foreseen in Article 6(1).

• (a) implement the Council’s security policy and keep it under review;

• (b) coordinate with Member States’ NSAs on all security matters relating to the protection of classified information relevant for the Council’s activities;

• (c) grant GSC officials, other servants and seconded national experts authorisation for access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above in accordance with Article 7(3);

• (d) as appropriate, order investigations into any actual or suspected compromise or loss of classified information held by or originating in the Council and request the relevant security authorities to assist in such investigations;

• (e) undertake periodic inspections of the security arrangements for protecting classified information on GSC premises;

• (f) undertake periodic visits to assess the security arrangements for protecting EUCI in Union bodies, agencies and entities which apply this Decision or the principles thereof;

• (g) undertake, jointly and in agreement with the NSA concerned, periodic assessments of the security arrangements for protecting EUCI in Member States’ services and premises;

• (h) ensure that security measures are coordinated as necessary with the competent authorities of the Member States which are responsible for protecting classified information and, as appropriate, third States or international organisations, including on the nature of threats to the security of EUCI and the means of protection against them; and

• (i) enter into the administrative arrangements referred to in Article 13(2)(b).

The Security Office of the GSC shall be at the disposal of the Secretary-General to assist in those responsibilities.

• (a) designate an NSA, as listed in Appendix C, responsible for security arrangements for protecting EUCI in order that:
• (i) EUCI held by any national department, body or agency, public or private, at home or abroad, is protected in accordance with this Decision;
• (ii) security arrangements for protecting EUCI are periodically inspected or assessed;
• (iii) all individuals employed within a national administration or by a contractor who may be granted access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above are appropriately security cleared or are otherwise duly authorised by virtue of their functions in accordance with national laws and regulations;
• (iv) security programmes are set up as necessary in order to minimise the risk of EUCI being compromised or lost;
• (v) security matters related to protecting EUCI are coordinated with other competent national authorities, including those referred to in this Decision; and
• (vi) responses are given to appropriate security clearance requests in particular from any Union bodies, agencies, entities, operations established under Title V, Chapter 2 of the TEU, and EU Special Representatives (EUSRs) and their teams which apply this Decision or the principles thereof;

• (b) ensure that their competent authorities provide information and advice to their governments, and through them to the Council, on the nature of threats to the security of EUCI and the means of protection against them.

Article 17

Security Committee

Representatives of Union bodies, agencies and entities which apply this Decision or the principles thereof may be invited to attend when questions concerning them are discussed.

Article 18

Replacement of previous decision

Article 19

Entry into force

This Decision shall enter into force on the date of its publication in the Official Journal of the European Union.

ANNEXES

ANNEX I	Personnel security
ANNEX II	Physical security
ANNEX III	Management of classified information
ANNEX IV	Protection of EUCI handled in CIS
ANNEX V	Industrial security
ANNEX VI	Exchange of classified information with third States and international organisations

ANNEX I

PERSONNEL SECURITY

I. INTRODUCTION

• 1.This Annex sets out provisions for implementing Article 7. It lays down criteria for determining whether an individual, taking into account his loyalty, trustworthiness and reliability, may be authorised to have access to EUCI and the investigative and administrative procedures to be followed to that effect.

II.   GRANTING ACCESS TO EUCI

• 2.An individual shall only be granted access to classified information after:

• (a) his need-to-know has been determined;

• (b) he has been briefed on the security rules and procedures for protecting EUCI and has acknowledged his responsibilities with regard to protecting such information; and

• (c) in the case of information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above:
• — he has been granted a PSC to the relevant level or is otherwise duly authorised by virtue of his functions in accordance with national laws and regulations, or
• — in the case of GSC officials, other servants or seconded national experts, he has been given authorisation for access to EUCI by the GSC Appointing Authority in accordance with paragraphs 16 to 25 up to a specified level and up to a specified date.

• 3.Each Member State and the GSC shall identify the positions in their structures which require access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above and therefore require security clearance to the relevant level.

III.   PERSONNEL SECURITY CLEARANCE REQUIREMENTS

• 4.After having received a duly authorised request, NSAs or other competent national authorities shall be responsible for ensuring that security investigations are carried out on their nationals who require access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above. Standards of investigation shall be in accordance with national laws and regulations with a view to issuing a PSC or providing an assurance for the individual to be granted authorisation for access to EUCI, as appropriate.

• 5.Should the individual concerned reside in the territory of another Member State or of a third State, the competent national authorities shall seek assistance from the competent authority of the State of residence in accordance with national laws and regulations. Member States shall assist one another in carrying out security investigations in accordance with national laws and regulations.

• 6.Where permissible under national laws and regulations, NSAs or other competent national authorities may conduct investigations on non-nationals who require access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above. Standards of investigation shall be in accordance with national laws and regulations.

Security investigation criteria

• 7.The loyalty, trustworthiness and reliability of an individual for the purposes of being security cleared for access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above shall be determined by means of a security investigation. The competent national authority shall make an overall assessment based on the findings of such a security investigation. The principal criteria used for that purpose include, to the extent possible under national laws and regulations, an examination of whether the individual:

• (a) has committed or attempted to commit, conspired with or aided and abetted another to commit any act of espionage, terrorism, sabotage, treason or sedition;

• (b) is, or has been, an associate of spies, terrorists, saboteurs, or of individuals reasonably suspected of being such or an associate of representatives of organisations or foreign states, including foreign intelligence services, which may threaten the security of the Union and/or Member States unless these associations were authorised in the course of official duty;

• (c) is, or has been, a member of any organisation which by violent, subversive or other unlawful means seeks, inter alia, to overthrow the government of a Member State, to change the constitutional order of a Member State or to change the form or the policies of its government;

• (d) is, or has been, a supporter of any organisation described in point (c), or who is, or who has been closely associated with members of such organisations;

• (e) has deliberately withheld, misrepresented or falsified information of significance, particularly of a security nature, or has deliberately lied in completing a personnel security questionnaire or during the course of a security interview;

• (f) has been convicted of a criminal offence or offences;

• (g) has a history of alcohol dependence, use of illegal drugs and/or misuse of legal drugs;

• (h) is or has been involved in conduct which may give rise to the risk of vulnerability to blackmail or pressure;

• (i) by act or through speech, has demonstrated dishonesty, disloyalty, unreliability or untrustworthiness;

• (j) has seriously or repeatedly infringed security regulations; or has attempted, or succeeded in, unauthorised activity in respect of communication and information systems; and

• (k) may be liable to pressure (e.g. through holding one or more non-EU nationalities or through relatives or close associates who could be vulnerable to foreign intelligence services, terrorist groups or other subversive organisations, or individuals whose aims may threaten the security interests of the Union and/or Member States).

• 8.Where appropriate and in accordance with national laws and regulations, an individual’s financial and medical background may also be considered relevant during the security investigation.

• 9.Where appropriate and in accordance with national laws and regulations, a spouse’s, cohabitant’s or close family member’s conduct and circumstances may also be considered relevant during the security investigation.

Investigative requirements for access to EUCI

Initial granting of a security clearance

• 10.The initial security clearance for access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET shall be based on a security investigation covering at least the last 5 years, or from age 18 to the present, whichever is the shorter, which shall include the following:

• (a) the completion of a national personnel security questionnaire for the level of EUCI to which the individual may require access; once completed, this questionnaire shall be forwarded to the competent security authority;

• (b) identity check/citizenship/nationality status — the individual’s date and place of birth shall be verified and his identity checked. Citizenship status and/or nationality, past and present, of the individual shall be established; this shall include an assessment of any vulnerability to pressure from foreign sources, for example, due to former residence or past associations; and

• (c) national and local records check — a check shall be made of national security and central criminal records, where the latter exist, and/or other comparable governmental and police records. The records of law enforcement agencies with legal jurisdiction where the individual has resided or been employed shall be checked.

• 11.The initial security clearance for access to information classified TRÈS SECRET UE/EU TOP SECRET shall be based on a security investigation covering at least the last 10 years, or from age 18 to the present, whichever is the shorter. If interviews are conducted as stated in point (e), investigations shall cover at least the last 7 years, or from age 18 to the present, whichever is the shorter. In addition to the criteria indicated in paragraph 7 above, the following elements shall be investigated, to the extent possible under national laws and regulations, before granting a TRÈS SECRET UE/EU TOP SECRET PSC; they may also be investigated before granting a CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET PSC, where required by national laws and regulations:

• (a) financial status — information shall be sought on the individual’s finances in order to assess any vulnerability to foreign or domestic pressure due to serious financial difficulties, or to discover any unexplained affluence;

• (b) education — information shall be sought to verify the individual’s educational background at schools, universities and other education establishments attended since his 18th birthday, or during a period judged appropriate by the investigating authority;

• (c) employment — information covering present and former employment shall be sought, reference being made to sources such as employment records, performance or efficiency reports and to employers or supervisors;

• (d) military service — where applicable, the service of the individual in the armed forces and type of discharge shall be verified; and

• (e) interviews — where provided for and admissible under national law, an interview or interviews shall be conducted with the individual. Interviews shall also be conducted with other individuals who are in a position to give an unbiased assessment of the individual’s background, activities, loyalty, trustworthiness and reliability. When it is national practice to ask the subject of the investigation for referrals, referees shall be interviewed unless there are good reasons for not doing so.

• 12.Where necessary and in accordance with national laws and regulations, additional investigations may be conducted to develop all relevant information available on an individual and to substantiate or disprove adverse information.

Renewal of a security clearance

• 13.After the initial granting of a security clearance and provided that the individual has had uninterrupted service with a national administration or the GSC and has a continuing need for access to EUCI, the security clearance shall be reviewed for renewal at intervals not exceeding 5 years for a TRÈS SECRET UE/EU TOP SECRET clearance and 10 years for SECRET UE/EU SECRET and CONFIDENTIEL UE/EU CONFIDENTIAL clearances, with effect from the date of notification of the outcome of the last security investigation on which they were based. All security investigations for renewing a security clearance shall cover the period since the previous such investigation.

• 14.For renewing security clearances, the elements outlined in paragraphs 10 and 11 shall be investigated.

• 15.Requests for renewal shall be made in a timely manner taking account of the time required for security investigations. Nevertheless, where the relevant NSA or other competent national authority has received the relevant request for renewal and the corresponding personnel security questionnaire before a security clearance expires, and the necessary security investigation has not been completed, the competent national authority may, where admissible under national laws and regulations, extend the validity of the existing security clearance for a period of up to 12 months. If, at the end of this 12-month period, the security investigation has still not been completed, the individual shall be assigned to duties which do not require a security clearance.

Authorisation procedures in the GSC

• 16.For officials and other servants in the GSC, the GSC Security Authority shall forward the completed personnel security questionnaire to the NSA of the Member State of which the individual is a national requesting that a security investigation be undertaken for the level of EUCI to which the individual will require access.

• 17.Where information relevant for a security investigation becomes known to the GSC concerning an individual who has applied for a security clearance for access to EUCI, the GSC, acting in accordance with the relevant rules and regulations, shall notify the relevant NSA thereof.

• 18.Following completion of the security investigation, the relevant NSA shall notify the GSC Security Authority of the outcome of such an investigation, using the standard format for the correspondence prescribed by the Security Committee.

• (a) Where the security investigation results in an assurance that nothing adverse is known which would call into question the loyalty, trustworthiness and reliability of the individual, the GSC Appointing Authority may grant the individual concerned authorisation for access to EUCI up to the relevant level until a specified date.

• (b) Where the security investigation does not result in such an assurance, the GSC Appointing Authority shall notify the individual concerned, who may ask to be heard by the Appointing Authority. The Appointing Authority may ask the competent NSA for any further clarification it can provide according to its national laws and regulations. If the outcome is confirmed, authorisation shall not be granted for access to EUCI.

• 19.The security investigation together with the results obtained shall be subject to the relevant laws and regulations in force in the Member State concerned, including those concerning appeals. Decisions by the GSC Appointing Authority shall be subject to appeals in accordance with the Staff Regulations of Officials of the European Union and the Conditions of Employment of Other Servants of the European Union, laid down in Council Regulation (EEC, Euratom, ECSC) No 259/68 ([^E0003]) (‘the Staff Regulations and Conditions of Employment’).

• 20.National experts seconded to the GSC for a position requiring access to EUCI classified CONFIDENTIEL UE/EU CONFIDENTIAL and above shall present a valid Personnel Security Clearance Certificate (PSCC) for access to EUCI to the GSC Security Authority prior to taking up their assignment, on the basis of which the Appointing Authority shall issue an authorisation for access to EUCI.

• 21.The GSC will accept the authorisation for access to EUCI granted by any other Union institution, body or agency, provided it remains valid. Authorisation will cover any assignment by the individual concerned within the GSC. The Union institution, body or agency in which the individual is taking up employment will notify the relevant NSA of the change of employer.

• 22.If an individual’s period of service does not commence within 12 months of the notification of the outcome of the security investigation to the GSC Appointing Authority, or if there is a break of 12 months in an individual’s service, during which time he has not been employed in the GSC or in a position with a national administration of a Member State, this outcome shall be referred to the relevant NSA for confirmation that it remains valid and appropriate.

• 23.Where information becomes known to the GSC concerning a security risk posed by an individual who has authorisation for access to EUCI, the GSC, acting in accordance with the relevant rules and regulations, shall notify the relevant NSA thereof and may suspend access to EUCI or withdraw authorisation for access to EUCI.

• 24.Where an NSA notifies the GSC of withdrawal of an assurance given in accordance with paragraph 18(a) for an individual who has authorisation for access to EUCI, the GSC Appointing Authority may ask for any clarification the NSA can provide according to its national laws and regulations. If the adverse information is confirmed, authorisation shall be withdrawn and the individual shall be excluded from access to EUCI and from positions where such access is possible or where he might endanger security.

• 25.Any decision to withdraw or suspend an authorisation from a GSC official or other servant for access to EUCI and, where appropriate, the reasons for doing so shall be notified to the individual concerned, who may ask to be heard by the Appointing Authority. Information provided by an NSA shall be subject to the relevant laws and regulations in force in the Member State concerned, including those concerning appeals. Decisions by the GSC Appointing Authority shall be subject to appeals in accordance with the Staff Regulations and Conditions of Employment.

Records of security clearances and authorisations

• 26.Records of PSCs and authorisations granted for access to information classified as CONFIDENTIEL UE/EU CONFIDENTIAL or above shall be maintained respectively by each Member State and by the GSC. These records shall contain as a minimum the level of EUCI to which the individual may be granted access, the date the security clearance was granted and its period of validity.

• 27.The competent security authority may issue a PSCC showing the level of EUCI to which the individual may be granted access (CONFIDENTIEL UE/EU CONFIDENTIAL or above), the date of validity of the relevant PSC for access to EUCI or authorisation for access to EUCI and the date of expiry of the certificate itself.

Exemptions from the PSC requirement

• 28.Access to EUCI by individuals in Member States duly authorised by virtue of their functions shall be determined in accordance with national laws and regulations; such individuals shall be briefed on their security obligations in respect of protecting EUCI.

IV.   SECURITY EDUCATION AND AWARENESS

• 29.All individuals who have been granted a security clearance shall acknowledge in writing that they have understood their obligations in respect of protecting EUCI and the consequences if EUCI is compromised. A record of such a written acknowledgement shall be kept by the Member State and by the GSC, as appropriate.

• 30.All individuals who are authorised to have access to, or required to handle EUCI, shall initially be made aware, and periodically briefed on the threats to security and must report immediately to the appropriate security authorities any approach or activity that they consider suspicious or unusual.

• 31.All individuals who cease to be employed in duties requiring access to EUCI shall be made aware of, and where appropriate acknowledge in writing, their obligations in respect of the continued protection of EUCI.

V. EXCEPTIONAL CIRCUMSTANCES

• 32.Where permissible under national laws and regulations, security clearance granted by a competent national authority of a Member State for access to national classified information may, for a temporary period pending the granting of a PSC for access to EUCI, allow access by national officials to EUCI up to the equivalent level specified in the table of equivalence in Appendix B where such temporary access is required in the interests of the Union. NSAs shall inform the Security Committee where national laws and regulations do not permit such temporary access to EUCI.

• 33.For reasons of urgency, where duly justified in the interests of the service and pending completion of a full security investigation, the GSC Appointing Authority may, after consulting the NSA of the Member State of whom the individual is a national and subject to the outcome of preliminary checks to verify that no adverse information is known, grant a temporary authorisation for GSC officials and other servants to access EUCI for a specific function. Such temporary authorisations shall be valid for a period not exceeding 6 months and shall not permit access to information classified TRÈS SECRET UE/EU TOP SECRET. All individuals who have been granted a temporary authorisation shall acknowledge in writing that they have understood their obligations in respect of protecting EUCI and the consequences if EUCI is compromised. A record of such a written acknowledgement shall be kept by the GSC.

• 34.When an individual is to be assigned to a position that requires a security clearance at one level higher than that currently possessed by the individual, the assignment may be made on a provisional basis, provided that:

• (a) the compelling need for access to EUCI at a higher level shall be justified, in writing, by the individual’s superior;

• (b) access shall be limited to specific items of EUCI in support of the assignment;

• (c) the individual holds a valid PSC or authorisation for access to EUCI;

• (d) action has been initiated to obtain authorisation for the level of access required for the position;

• (e) satisfactory checks have been made by the competent authority that the individual has not seriously or repeatedly infringed security regulations;

• (f) the assignment of the individual is approved by the competent authority; and

• (g) a record of the exception, including a description of the information to which access was approved, shall be kept by the registry or subordinate registry responsible.

• 35.The above procedure shall be used for one-time access to EUCI at one level higher than that to which the individual has been security cleared. Recourse to this procedure shall not be made on a recurring basis.

• 36.In very exceptional circumstances, such as missions in hostile environments or during periods of mounting international tension when emergency measures require it, in particular for the purposes of saving lives, Member States and the Secretary-General may grant, where possible in writing, access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET to individuals who do not possess the requisite security clearance, provided that such permission is absolutely necessary and there are no reasonable doubts as to the loyalty, trustworthiness and reliability of the individual concerned. A record shall be kept of this permission describing the information to which access was approved.

• 37.In the case of information classified TRÈS SECRET UE/EU TOP SECRET, this emergency access shall be confined to Union nationals who have been authorised access to either the national equivalent of TRÈS SECRET UE/EU TOP SECRET or information classified SECRET UE/EU SECRET.

• 38.The Security Committee shall be informed of cases when recourse is made to the procedure set out in paragraphs 36 and 37.

• 39.Where national laws and regulations of a Member State stipulate more stringent rules with respect to temporary authorisations, provisional assignments, one-time access or emergency access by individuals to classified information, the procedures foreseen in this Section shall be implemented only within any limitations set forth in the relevant national laws and regulations.

• 40.The Security Committee shall receive an annual report on recourse to the procedures set out in this Section.

VI.   ATTENDANCE AT MEETINGS IN THE COUNCIL

• 41.Subject to paragraph 28, individuals assigned to participate in meetings of the Council or of Council preparatory bodies at which information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above is discussed may only do so upon confirmation of the individual’s security clearance status. For delegates, a PSCC or other proof of security clearance shall be forwarded by the appropriate authorities to the GSC Security Office, or exceptionally be presented by the delegate concerned. Where applicable, a consolidated list of names may be used, giving the relevant proof of security clearance.

• 42.Where a PSC for access to EUCI is withdrawn for security reasons from an individual whose duties require attendance at meetings of the Council or of Council preparatory bodies, the competent authority shall inform the GSC thereof.

VII.   POTENTIAL ACCESS TO EUCI

• 43.Couriers, guards and escorts shall be security cleared to the relevant level or otherwise appropriately investigated in accordance with national laws and regulations, be briefed on security procedures for protecting EUCI and be instructed on their duties for protecting such information entrusted to them.

ANNEX II

PHYSICAL SECURITY

I. INTRODUCTION

• 1.This Annex sets out provisions for implementing Article 8. It lays down minimum requirements for the physical protection of premises, buildings, offices, rooms and other areas where EUCI is handled and stored, including areas housing CIS.

• 2.Physical security measures shall be designed to prevent unauthorised access to EUCI by:

• (a) ensuring that EUCI is handled and stored in an appropriate manner;

• (b) allowing for segregation of personnel in terms of access to EUCI on the basis of their need-to-know and, where appropriate, their security clearance;

• (c) deterring, impeding and detecting unauthorised actions; and

• (d) denying or delaying surreptitious or forced entry by intruders.

II.   PHYSICAL SECURITY REQUIREMENTS AND MEASURES

• 3.Physical security measures shall be selected on the basis of a threat assessment made by the competent authorities. The GSC and Member States shall each apply a risk management process for protecting EUCI on their premises to ensure that a commensurate level of physical protection is afforded against the assessed risk. The risk management process shall take account of all relevant factors, in particular:

• (a) the classification level of EUCI;

• (b) the form and volume of EUCI, bearing in mind that large quantities or a compilation of EUCI may require more stringent protective measures to be applied;

• (c) the surrounding environment and structure of the buildings or areas housing EUCI; and

• (d) the assessed threat from intelligence services which target the Union or Member States and from sabotage, terrorist, subversive or other criminal activities.

• 4.The competent security authority, applying the concept of defence in depth, shall determine the appropriate combination of physical security measures to be implemented. These can include one or more of the following:

• (a) a perimeter barrier: a physical barrier which defends the boundary of an area requiring protection;

• (b) intrusion detection systems (IDS): an IDS may be used to enhance the level of security offered by a perimeter barrier, or in rooms and buildings in place of, or to assist, security staff;

• (c) access control: access control may be exercised over a site, a building or buildings on a site or to areas or rooms within a building. Control may be exercised by electronic or electro-mechanical means, by security personnel and/or a receptionist, or by any other physical means;

• (d) security personnel: trained, supervised and, where necessary, appropriately security-cleared security personnel may be employed, inter alia, in order to deter individuals planning covert intrusion;

• (e) closed circuit television (CCTV): CCTV may be used by security personnel in order to verify incidents and IDS alarms on large sites or at perimeters;

• (f) security lighting: security lighting may be used to deter a potential intruder, as well as to provide the illumination necessary for effective surveillance directly by security personnel or indirectly through a CCTV system; and

• (g) any other appropriate physical measures designed to deter or detect unauthorised access or prevent loss of or damage to EUCI.

• 5.The competent authority can be authorised to conduct entry and exit searches to act as a deterrent to the unauthorised introduction of material or the unauthorised removal of EUCI from premises or buildings.

• 6.When EUCI is at risk from overlooking, even accidentally, appropriate measures shall be taken to counter this risk.

• 7.For new facilities, physical security requirements and their functional specifications shall be defined as part of the planning and design of the facilities. For existing facilities, physical security requirements shall be implemented to the maximum extent possible.

III.   EQUIPMENT FOR THE PHYSICAL PROTECTION OF EUCI

• 8.When acquiring equipment (such as security containers, shredding machines, door locks, electronic access control systems, IDS, alarm systems) for the physical protection of EUCI, the competent security authority shall ensure that the equipment meets approved technical standards and minimum requirements.

• 9.The technical specifications of equipment to be used for the physical protection of EUCI shall be set out in security guidelines to be approved by the Security Committee.

• 10.Security systems shall be inspected at regular intervals and equipment shall be maintained regularly. Maintenance work shall take account of the outcome of inspections to ensure that equipment continues to operate at optimum performance.

• 11.The effectiveness of individual security measures and of the overall security system shall be re-evaluated during each inspection.

IV.   PHYSICALLY PROTECTED AREAS

• 12.Two types of physically protected areas, or the national equivalents thereof, shall be established for the physical protection of EUCI:

• (a) Administrative Areas; and

• (b) Secured Areas (including technically Secured Areas).

• In this Decision, all references to Administrative Areas and Secured Areas, including technically Secured Areas, shall be understood as also referring to the national equivalents thereof.

• 13.The competent security authority shall establish that an area meets the requirements to be designated as an Administrative Area, a Secured Area or a technically Secured Area.

• 14.For Administrative Areas:

• (a) a visibly defined perimeter shall be established which allows individuals and, where possible, vehicles to be checked;

• (b) unescorted access shall be granted only to individuals who are duly authorised by the competent authority; and

• (c) all other individuals shall be escorted at all times or be subject to equivalent controls.

• 15.For Secured Areas:

• (a) a visibly defined and protected perimeter shall be established through which all entry and exit are controlled by means of a pass or personal recognition system;

• (b) unescorted access shall be granted only to individuals who are security-cleared and specifically authorised to enter the area on the basis of their need-to-know; and

• (c) all other individuals shall be escorted at all times or be subject to equivalent controls.

• 16.Where entry into a Secured Area constitutes, for all practical purposes, direct access to the classified information contained in it, the following additional requirements shall apply:

• (a) the level of highest security classification of the information normally held in the area shall be clearly indicated;

• (b) all visitors shall require specific authorisation to enter the area, shall be escorted at all times and shall be appropriately security cleared unless steps are taken to ensure that no access to EUCI is possible.

• 17.Secured Areas protected against eavesdropping shall be designated technically Secured Areas. The following additional requirements shall apply:

• (a) such areas shall be IDS equipped, be locked when not occupied and be guarded when occupied. Any keys shall be controlled in accordance with Section VI;

• (b) all persons and material entering such areas shall be controlled;

• (c) such areas shall be regularly physically and/or technically inspected as required by the competent security authority. Such inspections shall also be conducted following any unauthorised entry or suspicion of such entry; and

• (d) such areas shall be free of unauthorised communication lines, unauthorised telephones or other unauthorised communication devices and electrical or electronic equipment.

• 18.Notwithstanding point (d) of paragraph 17, before being used in areas where meetings are held or work is being performed involving information classified SECRET UE/EU SECRET and above, and where the threat to EUCI is assessed as high, any communications devices and electrical or electronic equipment shall first be examined by the competent security authority to ensure that no intelligible information can be inadvertently or illicitly transmitted by such equipment beyond the perimeter of the Secured Area.

• 19.Secured Areas which are not occupied by duty personnel on a 24-hour basis shall, where appropriate, be inspected at the end of normal working hours and at random intervals outside normal working hours, unless an IDS is in place.

• 20.Secured Areas and technically Secured Areas may be set up temporarily within an Administrative Area for a classified meeting or any other similar purpose.

• 21.Security operating procedures shall be drawn up for each Secured Area stipulating:

• (a) the level of EUCI which may be handled and stored in the area;

• (b) the surveillance and protective measures to be maintained;

• (c) the individuals authorised to have unescorted access to the area by virtue of their need-to-know and security clearance;

• (d) where appropriate, the procedures for escorts or for protecting EUCI when authorising any other individuals to access the area; and

• (e) any other relevant measures and procedures.

• 22.Strong rooms shall be constructed within Secured Areas. The walls, floors, ceilings, windows and lockable doors shall be approved by the competent security authority and afford protection equivalent to a security container approved for the storage of EUCI of the same classification level.

V. PHYSICAL PROTECTIVE MEASURES FOR HANDLING AND STORING EUCI

• 23.EUCI which is classified RESTREINT UE/EU RESTRICTED may be handled:

• (a) in a Secured Area;

• (b) in an Administrative Area provided the EUCI is protected from access by unauthorised individuals; or

• (c) outside a Secured Area or an Administrative Area provided the holder carries the EUCI in accordance with paragraphs 28 to 41 of Annex III and has undertaken to comply with compensatory measures laid down in security instructions issued by the competent security authority to ensure that EUCI is protected from access by unauthorised persons.

• 24.EUCI which is classified RESTREINT UE/EU RESTRICTED shall be stored in suitable locked office furniture in an Administrative Area or a Secured Area. It may temporarily be stored outside a Secured Area or an Administrative Area provided the holder has undertaken to comply with compensatory measures laid down in security instructions issued by the competent security authority.

• 25.EUCI which is classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET may be handled:

• (a) in a Secured Area;

• (b) in an Administrative Area provided the EUCI is protected from access by unauthorised individuals; or

• (c) outside a Secured Area or an Administrative Area provided the holder:
• (i) carries the EUCI in accordance with paragraphs 28 to 41 of Annex III;
• (ii) has undertaken to comply with compensatory measures laid down in security instructions issued by the competent security authority to ensure that EUCI is protected from access by unauthorised persons;
• (iii) keeps the EUCI at all times under his personal control; and
• (iv) in the case of documents in paper form, has notified the relevant registry of the fact.

• 26.EUCI which is classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET shall be stored in a Secured Area either in a security container or in a strong room.

• 27.EUCI which is classified TRÈS SECRET UE/EU TOP SECRET shall be handled in a Secured Area.

• 28.EUCI which is classified TRÈS SECRET UE/EU TOP SECRET shall be stored in a Secured Area under one of the following conditions:

• (a) in a security container in line with paragraph 8 with at least one of the following supplementary controls:
• (i) continuous protection or verification by cleared security staff or duty personnel;
• (ii) an approved IDS in combination with response security personnel;

• (b) in an IDS-equipped strong room in combination with response security personnel.

• 29.Rules governing the carriage of EUCI outside physically protected areas are set out in Annex III.

VI.   CONTROL OF KEYS AND COMBINATIONS USED FOR PROTECTING EUCI

• 30.The competent security authority shall define procedures for managing keys and combination settings for offices, rooms, strong rooms and security containers. Such procedures shall protect against unauthorised access.

• 31.Combination settings shall be committed to memory by the smallest possible number of individuals needing to know them. Combination settings for security containers and strong rooms storing EUCI shall be changed:

• (a) on receipt of a new container;

• (b) whenever there is a change in personnel knowing the combination;

• (c) whenever a compromise has occurred or is suspected;

• (d) when a lock has undergone maintenance or repair; and

• (e) at least every 12 months.

ANNEX III

MANAGEMENT OF CLASSIFIED INFORMATION

I. INTRODUCTION

• 1.This Annex sets out provisions for implementing Article 9. It lays down the administrative measures for controlling EUCI throughout its life-cycle in order to help deter and detect deliberate or accidental compromise or loss of such information.

II.   CLASSIFICATION MANAGEMENT

Classifications and markings

• 2.Information shall be classified where it requires protection with regard to its confidentiality.

• 3.The originator of EUCI shall be responsible for determining the security classification level, in accordance with the relevant classification guidelines, and for the initial dissemination of the information.

• 4.The classification level of EUCI shall be determined in accordance with Article 2(2) and by reference to the security policy to be approved in accordance with Article 3(3).

• 5.The security classification shall be clearly and correctly indicated, regardless of whether the EUCI is on paper, oral, electronic or in any other form.

• 6.Individual parts of a given document (i.e. pages, paragraphs, sections, annexes, appendices, attachments and enclosures) may require different classifications and shall be marked accordingly, including when stored in electronic form.

• 7.The overall classification level of a document or file shall be at least as high as that of its most highly classified component. When information from various sources is collated, the final product shall be reviewed to determine its overall security classification level, since it may warrant a higher classification than its component parts.

• 8.To the extent possible, documents containing parts with different classification levels shall be structured so that parts with a different classification level may be easily identified and detached if necessary.

• 9.The classification of a letter or note covering enclosures shall be as high as the highest classification of its enclosures. The originator shall indicate clearly at which level it is classified when detached from its enclosures by means of an appropriate marking, e.g.:

• CONFIDENTIEL UE/EU CONFIDENTIAL

• Without attachment(s) RESTREINT UE/EU RESTRICTED

Markings

• 10.In addition to one of the security classification markings set out in Article 2(2), EUCI may bear additional markings, such as:

• (a) an identifier to designate the originator;

• (b) any caveats, code-words or acronyms specifying the field of activity to which the document relates, a particular distribution on a need-to-know basis or restrictions on use;

• (c) releasability markings; or

• (d) where applicable, the date or specific event after which it may be downgraded or declassified.

Abbreviated classification markings

• 11.Standardised abbreviated classification markings may be used to indicate the classification level of individual paragraphs of a text. Abbreviations shall not replace the full classification markings.

• 12.The following standard abbreviations may be used within EU classified documents to indicate the classification level of sections or blocks of text of less than a single page:

TRÈS SECRET UE/EU TOP SECRET	TS-UE/EU-TS
SECRET UE/EU SECRET	S-UE/EU-S
CONFIDENTIEL UE/EU CONFIDENTIAL	C-UE/EU-C
RESTREINT UE/EU RESTRICTED	R-UE/EU-R

Creation of EUCI

• 13.When creating an EU classified document:

• (a) each page shall be marked clearly with the classification level;

• (b) each page shall be numbered;

• (c) the document shall bear a reference number and a subject, which is not itself classified information, unless it is marked as such;

• (d) the document shall be dated; and

• (e) documents classified SECRET UE/EU SECRET or above shall bear a copy number on every page, if they are to be distributed in several copies.

• 14.Where it is not possible to apply paragraph 13 to EUCI, other appropriate measures shall be taken in accordance with security guidelines to be established pursuant to Article 6(2).

Downgrading and declassification of EUCI

• 15.At the time of its creation, the originator shall indicate, where possible, and in particular for information classified RESTREINT UE/EU RESTRICTED, whether EUCI can be downgraded or declassified on a given date or following a specific event.

• 16.The GSC shall regularly review EUCI held by it to ascertain whether the classification level still applies. The GSC shall establish a system to review the classification level of EUCI which it has originated no less frequently than every five years. Such a review shall not be necessary where the originator has indicated from the outset that the information will automatically be downgraded or declassified and the information has been marked accordingly.

III.   REGISTRATION OF EUCI FOR SECURITY PURPOSES

• 17.For every organisational entity within the GSC and Member States’ national administrations in which EUCI is handled, a responsible registry shall be identified to ensure that EUCI is handled in accordance with this Decision. Registries shall be established as Secured Areas as defined in Annex II.

• 18.For the purposes of this Decision, registration for security purposes (‘registration’) means the application of procedures which record the life-cycle of material, including its dissemination and destruction.

• 19.All material classified CONFIDENTIEL UE/EU CONFIDENTIAL and above shall be registered in designated registries when it arrives at or leaves an organisational entity.

• 20.The Central Registry within the GSC shall keep a record of all classified information released by the Council and the GSC to third States and international organisations, and of all classified information received from third States or international organisations.

• 21.In the case of a CIS, registration procedures may be performed by processes within the CIS itself.

• 22.The Council shall approve a security policy on the registration of EUCI for security purposes.

TRÈS SECRET UE/EU TOP SECRET registries

• 23.A registry shall be designated in the Member States and in the GSC to act as the central receiving and dispatching authority for information classified TRÈS SECRET UE/EU TOP SECRET. Where necessary, subordinate registries may be designated to handle such information for registration purposes.

• 24.Such subordinate registries may not transmit TRÈS SECRET UE/EU TOP SECRET documents directly to other subordinate registries of the same central TRÈS SECRET UE/EU TOP SECRET registry or externally without the express written approval of the latter.

IV.   COPYING AND TRANSLATING EU CLASSIFIED DOCUMENTS

• 25.TRÈS SECRET UE/EU TOP SECRET documents shall not be copied or translated without the prior written consent of the originator.

• 26.Where the originator of documents classified SECRET UE/EU SECRET and below has not imposed caveats on their copying or translation, such documents may be copied or translated on instruction from the holder.

• 27.The security measures applicable to the original document shall apply to copies and translations thereof.

V. CARRIAGE OF EUCI

• 28.Carriage of EUCI shall be subject to the protective measures set out in paragraphs 30 to 41. When EUCI is carried on electronic media, and notwithstanding Article 9(4), the protective measures set out below may be supplemented by appropriate technical countermeasures prescribed by the competent security authority so as to minimise the risk of loss or compromise.