2013/488/EU: Council Decision of 23 September 2013 on the security rules for protecting EU classified information

• 29.The competent security authorities in the GSC and in Member States shall issue instructions on the carriage of EUCI in accordance with this Decision.

Within a building or self-contained group of buildings

• 30.EUCI carried within a building or self-contained group of buildings shall be covered in order to prevent observation of its contents.

• 31.Within a building or self-contained group of buildings, information classified TRÈS SECRET UE/EU TOP SECRET shall be carried in a secured envelope bearing only the addressee’s name.

Within the Union

• 32.EUCI carried between buildings or premises within the Union shall be packaged so that it is protected from unauthorised disclosure.

• 33.The carriage of information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET within the Union shall be by one of the following means:

• (a) military, government or diplomatic courier, as appropriate;

• (b) hand carriage, provided that:
• (i) EUCI does not leave the possession of the bearer, unless it is stored in accordance with the requirements set out in Annex II;
• (ii) EUCI is not opened en route or read in public places;
• (iii) individuals are briefed on their security responsibilities; and
• (iv) individuals are provided with a courier certificate where necessary;

• (c) postal services or commercial courier services, provided that:
• (i) they are approved by the relevant NSA in accordance with national laws and regulations; and
• (ii) they apply appropriate protective measures in accordance with minimum requirements to be laid down in security guidelines pursuant to Article 6(2).

• In the case of carriage from one Member State to another, the provisions of point (c) shall be limited to information classified up to CONFIDENTIEL UE/EU CONFIDENTIAL.

• 34.Information classified RESTREINT UE/EU RESTRICTED may also be carried by postal services or commercial courier services. A courier certificate is not required for the carriage of such information.

• 35.Material classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET (e.g. equipment or machinery) which cannot be carried by the means referred to in paragraph 33 shall be transported as freight by commercial carrier companies in accordance with Annex V.

• 36.The carriage of information classified TRÈS SECRET UE/EU TOP SECRET between buildings or premises within the Union shall be by military, government or diplomatic courier, as appropriate.

From within the Union to the territory of a third State

• 37.EUCI carried from within the Union to the territory of a third State shall be packaged in such a way that it is protected from unauthorised disclosure.

• 38.The carriage of information classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET from within the Union to the territory of a third State shall be by one of the following means:

• (a) military or diplomatic courier;

• (b) hand carriage, provided that:
• (i) the package bears an official seal, or is packaged so as to indicate that it is an official consignment and should not undergo customs or security scrutiny;
• (ii) individuals carry a courier certificate identifying the package and authorising them to carry the package;
• (iii) EUCI does not leave the possession of the bearer, unless it is stored in accordance with the requirements set out in Annex II;
• (iv) EUCI is not opened en route or read in public places; and
• (v) individuals are briefed on their security responsibilities.

• 39.The carriage of information classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET released by the Union to a third State or international organisation shall comply with the relevant provisions under a security of information Agreement or an administrative arrangement in accordance with Article 13(2)(a) or (b).

• 40.Information classified RESTREINT UE/EU RESTRICTED may also be carried by postal services or commercial courier services.

• 41.The carriage of information classified TRÈS SECRET UE/EU TOP SECRET from within the Union to the territory of a third State shall be by military or diplomatic courier.

VI.   DESTRUCTION OF EUCI

• 42.EU classified documents which are no longer required may be destroyed, without prejudice to the relevant rules and regulations on archiving.

• 43.Documents subject to registration in accordance with Article 9(2) shall be destroyed by the responsible registry on instruction from the holder or from a competent authority. The logbooks and other registration information shall be updated accordingly.

• 44.For documents classified SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET, destruction shall be performed in the presence of a witness who shall be cleared to at least the classification level of the document being destroyed.

• 45.The registrar and the witness, where the presence of the latter is required shall sign a destruction certificate, which shall be filed in the registry. The registry shall keep destruction certificates of TRÈS SECRET UE/EU TOP SECRET documents for a period of at least 10 years and of documents CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET for a period of at least five years.

• 46.Classified documents, including those classified RESTREINT UE/EU RESTRICTED, shall be destroyed by methods which meet relevant Union or equivalent standards or which have been approved by Member States in accordance with national technical standards so as to prevent reconstruction in whole or in part.

• 47.The destruction of computer storage media used for EUCI shall be in accordance with paragraph 37 of Annex IV.

• 48.In the event of an emergency, if there is an imminent risk of unauthorised disclosure EUCI shall be destroyed by the holder in such a way that it cannot be reconstructed in whole or in part. The originator and originating registry shall be informed of the emergency destruction of registered EUCI.

VII.   ASSESSMENT VISITS

• 49.The term ‘assessment visit’ shall be used hereinafter to designate any:

• (a) inspections or assessment visits in accordance with Article 9(3) and points (e), (f) and (g) of Article 16(2); or

• (b) assessment visit in accordance with Article 13(5);

• to evaluate the effectiveness of measures implemented for protecting EUCI.

• 50.Assessment visits shall be carried out, inter alia, to:

• (a) ensure that the required minimum standards for protecting EUCI laid down in this Decision are respected;

• (b) emphasise the importance of security and effective risk management within the entities inspected;

• (c) recommend countermeasures to mitigate the specific impact of loss of confidentiality, integrity or availability of classified information; and

• (d) reinforce security authorities’ ongoing security education and awareness programmes.

• 51.Before the end of each calendar year, the Council shall adopt the assessment visit programme foreseen in point (c) of Article 16(1) for the following year. The actual dates for each assessment visit shall be determined in agreement with the Union body or agency, Member State, third State or international organisation concerned.

Conduct of assessment visits

• 52.Assessment visits shall be conducted in order to check the relevant rules, regulations and procedures in the visited entity and verify whether the entity’s practices comply with the basic principles and minimum standards laid down in this Decision and in the provisions governing the exchange of classified information with that entity.

• 53.Assessment visits shall be conducted in two phases. Prior to the visit itself a preparatory meeting shall be organised, if necessary, with the entity concerned. After this preparatory meeting the assessment team shall establish, in agreement with the entity concerned, a detailed assessment visit programme covering all areas of security. The assessment visit team should have access to any location where EUCI is handled, in particular registries and CIS points of presence.

• 54.Assessment visits to Member States’ national administrations, third States and international organisations shall be conducted in full cooperation with the officials of the entity, third State or international organisation being visited.

• 55.Assessment visits to Union bodies, agencies and entities which apply this Decision or the principles thereof shall be conducted with assistance from experts of the NSA on whose territory the body or agency is located.

• 56.In the case of assessment visits to Union bodies, agencies and entities which apply this Decision or the principles thereof, and to third States and international organisations, assistance and contributions from NSA experts may be requested in accordance with detailed arrangements to be agreed by the Security Committee.

Reports

• 57.At the end of the assessment visit the main conclusions and recommendations shall be presented to the visited entity. Thereafter, a report on the assessment visit shall be drawn up. Where corrective action and recommendations have been proposed, sufficient details shall be included in the report to support the conclusions reached. The report shall be forwarded to the appropriate authority of the visited entity.

• 58.For assessment visits conducted in Member States’ national administrations:

• (a) the draft assessment report will be forwarded to the NSA concerned to verify that it is factually correct and that it contains no information classified higher than RESTREINT UE/EU RESTRICTED; and

• (b) unless the Member State NSA in question requests general distribution to be withheld, assessment reports shall be circulated to the Security Committee The report shall be classified RESTREINT UE/EU RESTRICTED.

• A regular report shall be prepared under the responsibility of the GSC Security Authority (Security Office) to highlight the lessons learned from the assessment visits conducted in Member States over a specified period and examined by the Security Committee.

• 59.For assessment visits of third States and international organisations, the report shall be distributed to the Security Committee. The report shall be classified at least RESTREINT UE/EU RESTRICTED. Any corrective action shall be verified during a follow-up visit and reported to the Security Committee.

• 60.For assessment visits to any Union bodies, agencies and entities which apply this Decision or the principles thereof, assessment visit reports shall be distributed to the Security Committee. The draft assessment visit report shall be forwarded to the agency or body concerned to verify that it is factually correct and that it contains no information classified higher than RESTREINT UE/EU RESTRICTED. Any corrective action shall be verified during a follow up visit and reported to the Security Committee.

• 61.The GSC Security Authority shall conduct regular inspections of organisational entities in the GSC for the purposes laid down in paragraph 50.

Checklist

• 62.The GSC Security Authority (Security Office) shall draw up and update a checklist of items to be verified in the course of an assessment visit. This checklist shall be forwarded to the Security Committee.

• 63.The information to complete the checklist shall be obtained in particular during the visit from the security management of the entity being inspected. Once completed with the detailed responses, the checklist shall be classified in agreement with the inspected entity. It shall not form part of the inspection report.

ANNEX IV

PROTECTION OF EUCI HANDLED IN CIS

I. INTRODUCTION

• 1.This Annex sets out provisions for implementing Article 10.

• 2.The following IA properties and concepts are essential for the security and correct functioning of operations on CIS:

Authenticity	:	the guarantee that information is genuine and from bona fide sources;
---	---	---
Availability	:	the property of being accessible and usable upon request by an authorised entity;
---	---	---
Confidentiality	:	the property that information is not disclosed to unauthorised individuals, entities or processes;
---	---	---
Integrity	:	the property of safeguarding the accuracy and completeness of information and assets;
---	---	---
Non-repudiation	:	the ability to prove an action or event has taken place, so that this event or action cannot subsequently be denied.

II.   INFORMATION ASSURANCE PRINCIPLES

• 3.The provisions set out below shall form the baseline for the security of any CIS handling EUCI. Detailed requirements for implementing these provisions shall be defined in IA security policies and security guidelines.

Security risk management

• 4.Security risk management shall be an integral part of defining, developing, operating and maintaining CIS. Risk management (assessment, treatment, acceptance and communication) shall be conducted as an iterative process jointly by representatives of the system owners, project authorities, operating authorities and security approval authorities, using a proven, transparent and fully understandable risk assessment process. The scope of the CIS and its assets shall be clearly defined at the outset of the risk management process.

• 5.The competent authorities shall review the potential threats to CIS and shall maintain up-to-date and accurate threat assessments which reflect the current operational environment. They shall constantly update their knowledge of vulnerability issues and periodically review the vulnerability assessment to keep up with the changing information technology (IT) environment.

• 6.The aim of security risk treatment shall be to apply a set of security measures which results in a satisfactory balance between user requirements, cost and residual security risk.

• 7.The specific requirements, scale and the degree of detail determined by the relevant SAA for accrediting a CIS shall be commensurate with the assessed risk, taking account of all relevant factors, including the classification level of the EUCI handled in the CIS. Accreditation shall include a formal residual risk statement and acceptance of the residual risk by a responsible authority.

Security throughout the CIS life-cycle

• 8.Ensuring security shall be a requirement throughout the entire CIS life-cycle from initiation to withdrawal from service.

• 9.The role and interaction of each actor involved in a CIS with regard to its security shall be identified for each phase of the life-cycle.

• 10.Any CIS, including its technical and non-technical security measures, shall be subject to security testing during the accreditation process to ensure that the appropriate level of assurance is obtained and to verify that they are correctly implemented, integrated and configured.

• 11.Security assessments, inspections and reviews shall be performed periodically during the operation and maintenance of a CIS and when exceptional circumstances arise.

• 12.Security documentation for a CIS shall evolve over its life-cycle as an integral part of the process of change and configuration management.

Best practice

• 13.The GSC and the Member States shall cooperate to develop best practice for protecting EUCI handled on CIS. Best practice guidelines shall set out technical, physical, organisational and procedural security measures for CIS with proven effectiveness in countering given threats and vulnerabilities.

• 14.The protection of EUCI handled on CIS shall draw on lessons learned by entities involved in IA within and outside the Union.

• 15.The dissemination and subsequent implementation of best practice shall help achieve an equivalent level of assurance for the various CIS operated by the GSC and by Member States which handle EUCI.

Defence in depth

• 16.To mitigate risk to CIS, a range of technical and non-technical security measures, organised as multiple layers of defence, shall be implemented. These layers shall include:

• (a) Deterrence : security measures aimed at dissuading any adversary planning to attack the CIS;

• (b) Prevention : security measures aimed at impeding or blocking an attack on the CIS;

• (c) Detection : security measures aimed at discovering the occurrence of an attack on the CIS;

• (d) Resilience : security measures aimed at limiting impact of an attack to a minimum set of information or CIS assets and preventing further damage; and

• (e) Recovery : security measures aimed at regaining a secure situation for the CIS.

• The degree of stringency of such security measures shall be determined following a risk assessment.

• 17.The NSA or other competent authority shall ensure that:

• (a) cyber defence capabilities are implemented to respond to threats which may transcend organisational and national boundaries; and

• (b) responses are coordinated and information about these threats, incidents and the related risk is shared (computer emergency response capabilities).

Principle of minimality and least privilege

• 18.Only the essential functionalities, devices and services to meet operational requirements shall be implemented in order to avoid unnecessary risk.

• 19.CIS users and automated processes shall be given only the access, privileges or authorisations they require to perform their tasks in order to limit any damage resulting from accidents, errors, or unauthorised use of CIS resources.

• 20.Registration procedures performed by a CIS, where required, shall be verified as part of the accreditation process.

Information Assurance awareness

• 21.Awareness of the risks and available security measures is the first line of defence for the security of CIS. In particular all personnel involved in the life-cycle of CIS, including users, shall understand:

• (a) that security failures may significantly harm the CIS;

• (b) the potential harm to others which may arise from interconnectivity and interdependency; and

• (c) their individual responsibility and accountability for the security of CIS according to their roles within the systems and processes.

• 22.To ensure that security responsibilities are understood, IA education and awareness training shall be mandatory for all personnel involved, including senior management and CIS users.

Evaluation and approval of IT-security products

• 23.The required degree of confidence in the security measures, defined as a level of assurance, shall be determined following the outcome of the risk management process and in line with the relevant security policies and security guidelines.

• 24.The level of assurance shall be verified by using internationally recognised or nationally approved processes and methodologies. This includes primarily evaluation, controls and auditing.

• 25.Cryptographic products for protecting EUCI shall be evaluated and approved by a national CAA of a Member State.

• 26.Prior to being recommended for approval by the Council or the Secretary-General in accordance with Article 10(6), such cryptographic products shall have undergone a successful second party evaluation by an Appropriately Qualified Authority (AQUA) of a Member State not involved in the design or manufacture of the equipment. The degree of detail required in a second party evaluation shall depend on the envisaged maximum classification level of EUCI to be protected by these products. The Council shall approve a security policy on the evaluation and approval of cryptographic products.

• 27.Where warranted on specific operational grounds, the Council or the Secretary-General as appropriate may, upon recommendation by the Security Committee, waive the requirements under paragraphs 25 or 26 of this Annex and grant an interim approval for a specific period in accordance with the procedure laid down in Article 10(6).

• 28.The Council, acting upon recommendation by the Security Committee, may accept the evaluation, selection and approval process of cryptographic products of a third State or international organisation and accordingly deem such cryptographic products approved for protecting EUCI released to that third state or international organisation.

• 29.An AQUA shall be a CAA of a Member State that has been accredited on the basis of criteria laid down by the Council to undertake the second evaluation of cryptographic products for protecting EUCI.

• 30.The Council shall approve a security policy on the qualification and approval of non-cryptographic IT security products.

Transmission within Secured and Administrative Areas

• 31.Notwithstanding the provisions of this Decision, when transmission of EUCI is confined within Secured Areas or Administrative Areas, unencrypted transmission or encryption at a lower level may be used based on the outcome of a risk management process and subject to the approval of the SAA.

Secure interconnection of CIS

• 32.For the purposes of this Decision, an interconnection shall mean the direct connection of two or more IT systems for the purpose of sharing data and other information resources (e.g. communication) in a unidirectional or multidirectional way.

• 33.A CIS shall treat any interconnected IT system as untrusted and shall implement protective measures to control the exchange of classified information.

• 34.For all interconnections of CIS with another IT system the following basic requirements shall be met:

• (a) business or operational requirements for such interconnections shall be stated and approved by the competent authorities;

• (b) the interconnection shall undergo a risk management and accreditation process and shall require the approval of the competent SAAs; and

• (c) Boundary Protection Services (BPS) shall be implemented at the perimeter of all CIS.

• 35.There shall be no interconnection between an accredited CIS and an unprotected or public network, except where the CIS has approved BPS installed for such a purpose between the CIS and the unprotected or public network. The security measures for such interconnections shall be reviewed by the competent IAA and approved by the competent SAA.

• When the unprotected or public network is used solely as a carrier and the data is encrypted by a cryptographic product approved in accordance with Article 10, such a connection shall not be deemed to be an interconnection.

• 36.The direct or cascaded interconnection of a CIS accredited to handle TRÈS SECRET UE/EU TOP SECRET to an unprotected or public network shall be prohibited.

Computer storage media

• 37.Computer storage media shall be destroyed in accordance with procedures approved by the competent security authority.

• 38.Computer storage media shall be reused, downgraded or declassified in accordance with security guidelines to be established pursuant to Article 6(2).

Emergency circumstances

• 39.Notwithstanding the provisions of this Decision, the specific procedures described below may be applied in an emergency, such as during impending or actual crisis, conflict, war situations or in exceptional operational circumstances.

• 40.EUCI may be transmitted using cryptographic products which have been approved for a lower classification level or without encryption with the consent of the competent authority if any delay would cause harm clearly outweighing the harm entailed by any disclosure of the classified material and if:

• (a) the sender and recipient do not have the required encryption facility or have no encryption facility; and

• (b) the classified material cannot be conveyed in time by other means.

• 41.Classified information transmitted under the circumstances set out in paragraph 39 shall not bear any markings or indications distinguishing it from information which is unclassified or which can be protected by an available cryptographic product. Recipients shall be notified of the classification level, without delay, by other means.

• 42.Should recourse be made to paragraph 39 a subsequent report shall be made to the competent authority and to the Security Committee.

III.   INFORMATION ASSURANCE FUNCTIONS AND AUTHORITIES

• 43.The following IA functions shall be established in the Member States and the GSC. These functions do not require single organisational entities. They shall have separate mandates. However, these functions, and their accompanying responsibilities, may be combined or integrated in the same organisational entity or split into different organisational entities, provided that internal conflicts of interests or tasks are avoided.

Information Assurance Authority

• 44.The IAA shall be responsible for:

• (a) developing IA security policies and security guidelines and monitoring their effectiveness and pertinence;

• (b) safeguarding and administering technical information related to cryptographic products;

• (c) ensuring that IA measures selected for protecting EUCI comply with the relevant policies governing their eligibility and selection;

• (d) ensuring that cryptographic products are selected in compliance with policies governing their eligibility and selection;

• (e) coordinating training and awareness on IA;

• (f) consulting with the system provider, the security actors and representatives of users in respect to IA security policies and security guidelines; and

• (g) ensuring appropriate expertise is available in the expert sub-area of the Security Committee for IA issues.

TEMPEST Authority

• 45.The TEMPEST Authority (TA) shall be responsible for ensuring compliance of CIS with TEMPEST policies and guidelines. It shall approve TEMPEST countermeasures for installations and products to protect EUCI to a defined level of classification in its operational environment.

Crypto Approval Authority

• 46.The Crypto Approval Authority (CAA) shall be responsible for ensuring that cryptographic products comply with national cryptographic policy or the Council’s cryptographic policy. It shall grant the approval of a cryptographic product to protect EUCI to a defined level of classification in its operational environment. As regards the Member States, the CAA shall in addition be responsible for evaluating cryptographic products.

Crypto Distribution Authority

• 47.The Crypto Distribution Authority (CDA) shall be responsible for:

• (a) managing and accounting for EU crypto material;

• (b) ensuring that appropriate procedures are enforced and channels established for accounting, secure handling, storage and distribution of all EU crypto material; and

• (c) ensuring the transfer of EU crypto material to or from individuals or services using it.

Security Accreditation Authority

• 48.The SAA for each system shall be responsible for:

• (a) ensuring that CIS comply with the relevant security policies and security guidelines, providing a statement of approval for CIS to handle EUCI to a defined level of classification in its operational environment, stating the terms and conditions of the accreditation, and criteria under which re-approval is required;

• (b) establishing a security accreditation process, in accordance with the relevant policies, clearly stating the approval conditions for CIS under its authority;

• (c) defining a security accreditation strategy setting out the degree of detail for the accreditation process commensurate with the required level of assurance;

• (d) examining and approving security-related documentation, including risk management and residual risk statements, system-specific security requirement statements (‘SSRSs’), security implementation verification documentation and security operating procedures (‘SecOPs’), and ensuring that it complies with the Council’s security rules and policies;

• (e) checking implementation of security measures in relation to the CIS by undertaking or sponsoring security assessments, inspections or reviews;

• (f) defining security requirements (e.g. personnel clearance levels) for sensitive positions in relation to the CIS;

• (g) endorsing the selection of approved cryptographic and TEMPEST products used to provide security for a CIS;

• (h) approving, or where relevant, participating in the joint approval of the interconnection of a CIS to other CIS; and

• (i) consulting the system provider, the security actors and representatives of the users with respect to security risk management, in particular the residual risk, and the terms and conditions of the approval statement.

• 49.The GSC SAA shall be responsible for accrediting all CIS operating within the remit of the GSC.

• 50.The relevant SAA of a Member State shall be responsible for accrediting CIS and components thereof operating within the remit of a Member State.

• 51.A joint Security Accreditation Board (SAB) shall be responsible for accrediting CIS within the remit of both the GSC SAA and Member States’ SAAs. It shall be composed of an SAA representative from each Member State and be attended by an SAA representative of the Commission. Other entities with nodes on a CIS shall be invited to attend when that system is under discussion.

• The SAB shall be chaired by a representative of the GSC SAA. It shall act by consensus of SAA representatives of institutions, Member States and other entities with nodes on the CIS. It shall make periodic reports on its activities to the Security Committee and shall notify all accreditation statements to it.

Information Assurance Operational Authority

• 52.The IA Operational Authority for each system shall be responsible for:

• (a) developing security documentation in line with security policies and security guidelines, in particular the SSRS including the residual risk statement, the SecOPs and the crypto plan within the CIS accreditation process;

• (b) participating in selecting and testing the system-specific technical security measures, devices and software, to supervise their implementation and to ensure that they are securely installed, configured and maintained in accordance with the relevant security documentation;

• (c) participating in selecting TEMPEST security measures and devices if required in the SSRS and ensuring that they are securely installed and maintained in cooperation with the TA;

• (d) monitoring implementation and application of the SecOps and, where appropriate, delegating operational security responsibilities to the system owner;

• (e) managing and handling cryptographic products, ensuring the custody of crypto and controlled items and, if so required, ensuring the generation of cryptographic variables;

• (f) conducting security analysis reviews and tests, in particular to produce the relevant risk reports, as required by the SAA;

• (g) providing CIS-specific IA training; and

• (h) implementing and operating CIS-specific security measures.

ANNEX V

INDUSTRIAL SECURITY

I. INTRODUCTION

• 1.This Annex sets out provisions for implementing Article 11. It lays down general security provisions applicable to industrial or other entities in pre-contract negotiations and throughout the life-cycle of classified contracts let by the GSC.

• 2.The Council shall approve guidelines on industrial security outlining in particular detailed requirements regarding FSCs, Security Aspects Letters (SALs), visits, transmission and carriage of EUCI.

II.   SECURITY ELEMENTS IN A CLASSIFIED CONTRACT

Security classification guide (SCG)

• 3.Prior to launching a call for tender or letting a classified contract, the GSC, as the contracting authority, shall determine the security classification of any information to be provided to bidders and contractors, as well as the security classification of any information to be created by the contractor. For that purpose, the GSC shall prepare an SCG to be used for the performance of the contract.

• 4.In order to determine the security classification of the various elements of a classified contract, the following principles shall apply:

• (a) in preparing an SCG, the GSC shall take into account all relevant security aspects, including the security classification assigned to information provided and approved to be used for the contract by the originator of the information;

• (b) the overall level of classification of the contract may not be lower than the highest classification of any of its elements; and

• (c) where relevant, the GSC shall liaise with the Member States’ NSAs/DSAs or any other competent security authority concerned in the event of any changes regarding the classification of information created by or provided to contractors in the performance of a contract and when making any subsequent changes to the SCG.

Security aspects letter (SAL)

• 5.The contract-specific security requirements shall be described in a SAL. The SAL shall, where appropriate, contain the SCG and shall be an integral part of a classified contract or sub-contract.

• 6.The SAL shall contain the provisions requiring the contractor and/or subcontractor to comply with the minimum standards laid down in this Decision. Non-compliance with these minimum standards may constitute sufficient grounds for the contract to be terminated.

Programme/Project Security Instructions (PSI)

• 7.Depending on the scope of programmes or projects involving access to or handling or storage of EUCI, specific PSI may be prepared by the contracting authority designated to manage the programme or project. The PSI shall require the approval of the Member States’ NSAs/DSAs or any other competent security authority participating in the PSI and may contain additional security requirements.

III.   FACILITY SECURITY CLEARANCE (FSC)

• 8.An FSC shall be granted by the NSA or DSA or any other competent security authority of a Member State to indicate, in accordance with national laws and regulations, that an industrial or other entity can protect EUCI at the appropriate classification level (CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET) within its facilities. It shall be presented to the GSC, as the contracting authority, before a contractor or subcontractor or potential contractor or subcontractor may be provided with or granted access to EUCI.

• 9.When issuing an FSC, the relevant NSA or DSA shall, as a minimum:

• (a) evaluate the integrity of the industrial or other entity;

• (b) evaluate ownership, control, or the potential for undue influence that may be considered a security risk;

• (c) verify that the industrial or any other entity has established a security system at the facility which covers all appropriate security measures necessary for the protection of information or material classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET in accordance with the requirements laid down in this Decision;

• (d) verify that the personnel security status of management, owners and employees who are required to have access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET has been established in accordance with the requirements laid down in this Decision; and

• (e) verify that the industrial or any other entity has appointed a Facility Security Officer who is responsible to its management for enforcing the security obligations within such an entity.

• 10.Where relevant, the GSC, as the contracting authority, shall notify the appropriate NSA/DSA or any other competent security authority that an FSC is required in the pre-contractual stage or for performing the contract. An FSC or PSC shall be required in the pre-contractual stage where EUCI classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET has to be provided in the course of the bidding process.

• 11.The contracting authority shall not award a classified contract with a preferred bidder before having received confirmation from the NSA/DSA or any other competent security authority of the Member State in which the contractor or subcontractor concerned is registered that, where required, an appropriate FSC has been issued.

• 12.The NSA/DSA or any other competent security authority which has issued an FSC shall notify the GSC as contracting authority about changes affecting the FSC. In the case of a sub-contract, the NSA/DSA or any other competent security authority shall be informed accordingly.

• 13.Withdrawal of an FSC by the relevant NSA/DSA or any other competent security authority shall constitute sufficient grounds for the GSC, as the contracting authority, to terminate a classified contract or exclude a bidder from the competition.

IV.   CLASSIFIED CONTRACTS AND SUB-CONTRACTS

• 14.Where EUCI is provided to a bidder at the pre-contractual stage, the invitation to bid shall contain a provision obliging the bidder which fails to submit a bid or which is not selected to return all classified documents within a specified period of time.

• 15.Once a classified contract or sub-contract has been awarded, the GSC, as the contracting authority, shall notify the contractor’s or subcontractor’s NSA/DSA or any other competent security authority about the security provisions of the classified contract.

• 16.When such contracts are terminated, the GSC, as the contracting authority (and/or the NSA/DSA or any other competent security authority, as appropriate, in the case of a sub-contract) shall promptly notify the NSA/DSA or any other competent security authority of the Member State in which the contractor or subcontractor is registered.

• 17.As a general rule, the contractor or subcontractor shall be required to return to the contracting authority, upon termination of the classified contract or sub-contract, any EUCI held by it.

• 18.Specific provisions for the disposal of EUCI during the performance of the contract or upon its termination shall be laid down in the SAL.

• 19.Where the contractor or subcontractor is authorised to retain EUCI after termination of a contract, the minimum standards contained in this Decision shall continue to be complied with and the confidentiality of EUCI shall be protected by the contractor or subcontractor.

• 20.The conditions under which the contractor may subcontract shall be defined in the call for tender and in the contract.

• 21.A contractor shall obtain permission from the GSC, as the contracting authority, before sub-contracting any parts of a classified contract. No subcontract may be awarded to industrial or other entities registered in a non-EU Member State which has not concluded a security of information Agreement with the Union.

• 22.The contractor shall be responsible for ensuring that all sub-contracting activities are undertaken in accordance with the minimum standards laid down in this Decision and shall not provide EUCI to a subcontractor without the prior written consent of the contracting authority.

• 23.With regard to EUCI created or handled by the contractor or subcontractor, the rights incumbent on the originator shall be exercised by the contracting authority.

V. VISITS IN CONNECTION WITH CLASSIFIED CONTRACTS

• 24.Where the GSC, contractors’ or subcontractors’ personnel require access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET in each other’s premises for the performance of a classified contract, visits shall be arranged in liaison with the NSAs/DSAs or any other competent security authority concerned. However, in the context of specific projects, the NSAs/DSAs may also agree on a procedure whereby such visits can be arranged directly.

• 25.All visitors shall hold an appropriate PSC and have a ‘need-to-know’ for access to the EUCI related to the GSC contract.

• 26.Visitors shall be given access only to EUCI related to the purpose of the visit.

VI.   TRANSMISSION AND CARRIAGE OF EUCI

• 27.With regard to the transmission of EUCI by electronic means, the relevant provisions of Article 10 and Annex IV shall apply.

• 28.With regard to the carriage of EUCI, the relevant provisions of Annex III shall apply, in accordance with national laws and regulations.

• 29.For the transport of classified material as freight, the following principles shall be applied when determining security arrangements:

• (a) security shall be assured at all stages during transportation from the point of origin to the final destination;

• (b) the degree of protection afforded to a consignment shall be determined by the highest classification level of material contained within it;

• (c) an FSC at the appropriate level shall be obtained for companies providing transportation. In such cases, personnel handling the consignment shall be security cleared in accordance with Annex I;

• (d) prior to any cross-border movement of material classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET, a transportation plan shall be drawn up by the consignor and approved by the NSA/DSAs or any other competent security authority concerned;

• (e) journeys shall be point to point to the extent possible, and shall be completed as quickly as circumstances permit; and

• (f) whenever possible, routes should be only through Member States. Routes through States other than Member States should only be undertaken when authorised by the NSA/DSA or any other competent security authority of the States of both the consignor and the consignee.

VII.   TRANSFER OF EUCI TO CONTRACTORS LOCATED IN THIRD STATES

• 30.EUCI shall be transferred to contractors and subcontractors located in third States in accordance with security measures agreed between the GSC, as the contracting authority, and the NSA/DSA of the concerned third State where the contractor is registered.

VIII   INFORMATION CLASSIFIED RESTREINT UE/EU RESTRICTED

• 31.In liaison, as appropriate, with the NSA/DSA of the Member State the GSC, as the contracting authority, shall be entitled to conduct inspections of contractors’/subcontractors’ facilities on the basis of contractual provisions in order to verify that the relevant security measures for the protection of EUCI at the level RESTREINT UE/EU RESTRICTED as required under the contract have been put in place.

• 32.To the extent necessary under national laws and regulations, NSAs/DSAs or any other competent security authority shall be notified by the GSC as the contracting authority of contracts or subcontracts containing information classified RESTREINT UE/EU RESTRICTED.

• 33.An FSC or a PSC for contractors or subcontractors and their personnel shall not be required for contracts let by the GSC containing information classified RESTREINT UE/EU RESTRICTED.

• 34.The GSC, as the contracting authority, shall examine the responses to invitations to tender for contracts which require access to information classified RESTREINT UE/EU RESTRICTED, notwithstanding any requirement relating to FSC or PSC which may exist under national laws and regulations.

• 35.The conditions under which the contractor may subcontract shall be in accordance with paragraph 21.

• 36.Where a contract involves handling information classified RESTREINT UE/EU RESTRICTED in a CIS operated by a contractor, the GSC as contracting authority shall ensure that the contract or any subcontract specifies the necessary technical and administrative requirements regarding accreditation of the CIS commensurate with the assessed risk, taking account of all relevant factors. The scope of accreditation of such CIS shall be agreed between the contracting authority and the relevant NSA/DSA.

ANNEX VI

EXCHANGE OF CLASSIFIED INFORMATION WITH THIRD STATES AND INTERNATIONAL ORGANISATIONS

I. INTRODUCTION

• 1.This Annex sets out provisions for implementing Article 13.

II.   FRAMEWORKS GOVERNING THE EXCHANGE OF CLASSIFIED INFORMATION

• 2.Where the Council determines that a long-term need exists to exchange classified information,

• — a security of information agreement shall be concluded, or

• — an administrative arrangement shall be entered into,

• in accordance with Article 13(2) and Sections III and IV and based on a recommendation from the Security Committee.

• 3.Where EUCI generated for the purposes of a CSDP operation is to be provided to third States or international organisations participating in such an operation, and where neither of the frameworks referred to in paragraph 2 exists, the exchange of EUCI with the contributing third State or international organisation shall be regulated, in accordance with Section V, under:

• — a framework participation agreement,

• — an ad hoc participation agreement, or

• — in the absence of either of the above, an ad hoc administrative arrangement.

• 4.In the absence of a framework referred to in paragraphs 2 and 3, and where a decision is taken to release EUCI to a third State or international organisation on an exceptional ad hoc basis in accordance with Section VI, written assurances shall be sought from the third State or international organisation concerned to ensure that it protects any EUCI released to it in accordance with the basic principles and minimum standards set out in this Decision.

III.   SECURITY OF INFORMATION AGREEMENTS

• 5.Security of information agreements shall establish the basic principles and minimum standards governing the exchange of classified information between the Union and a third State or international organisation.

• 6.Security of information agreements shall provide for technical implementing arrangements to be agreed between the competent security authorities of the relevant Union institutions and bodies and the competent security authority of the third State or international organisation in question. Such arrangements shall take account of the level of protection provided by the security regulations, structures and procedures in place in the third State or international organisation concerned. They shall be approved by the Security Committee.

• 7.No EUCI shall be exchanged under a security of information agreement by electronic means unless explicitly provided for in the agreement or in corresponding technical implementing arrangements.

• 8.When the Council concludes a security of information agreement, a registry shall be designated in each party as the main point of entry and exit for classified information exchanges.

• 9.In order to assess the effectiveness of the security regulations, structures and procedures in the third State or international organisation concerned, assessment visits shall be conducted in mutual agreement with the third State or international organisation concerned. Such assessment visits shall be conducted in accordance with the relevant provisions of Annex III and shall evaluate:

• (a) the regulatory framework applicable for protecting classified information;

• (b) any specific features of the security policy and the way in which security is organised in the third State or international organisation which may have an impact on the level of classified information that may be exchanged;

• (c) the security measures and procedures actually in place; and

• (d) security clearance procedures for the level of EUCI to be released.

• 10.The team conducting an assessment visit on behalf of the Union shall assess whether the security regulations and procedures in the third State or international organisation in question are adequate for the protection of EUCI at a given level.

• 11.The findings of such visits shall be set out in a report on the basis of which the Security Committee shall determine the maximum level of EUCI which may be exchanged in hard copy, and where appropriate electronically, with the third party concerned as well as any specific conditions governing exchange with that party.

• 12.Every endeavour shall be made to conduct a full security assessment visit to the third State or international organisation in question before the Security Committee approves the implementing arrangements in order to establish the nature and the effectiveness of the security system in place. However, where this is not possible the Security Committee shall receive as full a report as possible from the GSC Security Office, based on the information available to it, informing the Security Committee about the security regulations applicable and the way in which security is organised in the third State or international organisation concerned.

• 13.The report on the assessment visit, or in the absence of such a report the report referred to in paragraph 12, shall be forwarded to, and deemed satisfactory by, the Security Committee before EUCI is actually released to the third State or international organisation in question.

• 14.The competent security authorities of the Union institutions and bodies shall communicate to the third State or international organisation the date as from when the Union is in a position to release EUCI under the agreement, as well as the maximum level of EUCI which may be exchanged in paper form or by electronic means.

• 15.Follow-up assessment visits shall be conducted as necessary, in particular if:

• (a) there is a need for the releasable level of EUCI to be raised;

• (b) the Union has been notified of fundamental changes in the third State or international organisation’s security arrangements that might have an impact on how it protects EUCI; or

• (c) there has been a serious incident involving unauthorised disclosure of EUCI.

• 16.Once the security of information agreement is in force and classified information is exchanged with the third State or international organisation concerned, the Security Committee may decide to modify the maximum level of EUCI which may be exchanged in paper form or by electronic means, in particular in the light of any follow-up assessment visit.

IV.   ADMINISTRATIVE ARRANGEMENTS

• 17.Where a long-term need exists to exchange information classified as a general rule no higher than RESTREINT UE/EU RESTRICTED with a third State or international organisation, and where the Security Committee has established that the party in question does not have a sufficiently developed security system for it to be possible to enter into a security of information agreement, the Secretary-General may, subject to approval by the Council, enter into an administrative arrangement on behalf of the GSC with the relevant authorities of the third State or international organisation in question.

• 18.Where, for urgent operational reasons, a framework for exchanging classified information needs to be put in place rapidly, exceptionally the Council may decide that an administrative arrangement be entered into for exchanging information of a higher classification level.

• 19.Administrative arrangements shall as a general rule take the form of an Exchange of Letters.

• 20.An assessment visit referred to in paragraph 9 shall be conducted and the report, or in the absence of such a report the report referred to in paragraph 12, forwarded to, and deemed satisfactory by, the Security Committee before EUCI is actually released to the third State or international organisation in question.

• 21.No EUCI shall be exchanged under an administrative arrangement by electronic means unless explicitly provided for in the arrangement.

V. EXCHANGE OF CLASSIFIED INFORMATION IN THE CONTEXT OF CSDP OPERATIONS

• 22.Framework participation agreements govern the participation of third States or international organisations in CSDP operations. Such agreements shall include provisions on the release of EUCI generated for the purposes of CSDP operations to the contributing third States or international organisations. The maximum classification level of EUCI which may be exchanged shall be RESTREINT UE/EU RESTRICTED for civilian CSDP operations and CONFIDENTIEL UE/EU CONFIDENTIAL for military CSDP operations, unless otherwise laid down in the Decision establishing each CSDP operation.

• 23.Ad hoc participation agreements concluded for a specific CSDP operation shall include provisions on the release of EUCI generated for the purposes of that operation to the contributing third State or international organisation. The maximum classification level of EUCI which may be exchanged shall be RESTREINT UE/EU RESTRICTED for civilian CSDP operations and CONFIDENTIEL UE/EU CONFIDENTIAL for military CSDP operations, unless otherwise laid down in the Decision establishing each CSDP operation.

• 24.In the absence of a security of information agreement and pending the conclusion of a participation agreement, the release of EUCI generated for the purposes of the operation to a third State or international organisation participating in the operation shall be governed by an administrative arrangement to be entered into by the High Representative or subject to a decision on ad hoc release in accordance with Section VI. EUCI shall only be exchanged under such an arrangement as long as the participation of the third State or international organisation is still envisaged. The maximum classification level of EUCI which may be exchanged shall be RESTREINT UE/EU RESTRICTED for civilian CSDP operations and CONFIDENTIEL UE/EU CONFIDENTIAL for military CSDP operations, unless otherwise laid down in the Decision establishing each CSDP operation.

• 25.The provisions on classified information to be included in framework participation agreements, ad hoc participation agreements and ad hoc administrative arrangements referred to in paragraphs 22 to 24 shall provide that the third State or international organisation in question shall ensure that its personnel seconded to any operation will protect EUCI in accordance with the Council’s security rules and with further guidance issued by the competent authorities, including the operation’s chain of command.

• 26.If a security of information agreement is subsequently concluded between the Union and a contributing third State or international organisation, the security of information agreement shall supersede the provisions on the exchange of classified information laid down in any framework participation agreement, ad hoc participation agreement or ad hoc administrative arrangement as far as the exchange and handling of EUCI is concerned.

• 27.No exchange of EUCI by electronic means shall be permitted under a framework participation agreement, ad hoc participation agreement or ad hoc administrative arrangement with a third State or international organisation, unless explicitly provided for in the agreement or arrangement in question.

• 28.EUCI generated for the purposes of a CSDP operation may be disclosed to personnel seconded to that operation by third States or international organisations in accordance with paragraphs 22 to 27. When authorising access to EUCI in premises or in CIS of a CSDP operation by such personnel, measures shall be applied (including recording of EUCI disclosed) to mitigate the risk of loss or compromise. Such measures shall be defined in relevant planning or mission documents.

• 29.In the absence of a security of information agreement, the release of EUCI, in the event of a specific and immediate operational need, to the host State on whose territory a CSDP operation is conducted, may be governed by an administrative arrangement to be entered into by the High Representative. This possibility shall be provided for in the Decision establishing the CSDP operation. EUCI released under such circumstances shall be restricted to that generated for the purposes of the CSDP operation and classified no higher than RESTREINT UE/EU RESTRICTED, unless a higher level of classification is laid down in the Decision establishing the CSDP operation. Under such an administrative arrangement, the host State shall be required to undertake to protect EUCI according to minimum standards which are no less stringent than those laid down in this Decision.

• 30.In the absence of a security of information agreement, the release of EUCI to relevant third States and international organisations, other than those participating in a CSDP operation, may be governed by an administrative arrangement to be entered into by the High Representative. Where appropriate, this possibility, as well as any conditions attached thereto, shall be provided for in the Decision establishing the CSDP operation. EUCI released under such circumstances shall be restricted to that generated for the purposes of the CSDP operation and classified no higher than RESTREINT UE/EU RESTRICTED, unless a higher level of classification is laid down in the Decision establishing the CSDP operation. Under such an administrative arrangement, the third State or international organisation in question shall be required to undertake to protect EUCI according to minimum standards which are no less stringent than those laid down in this Decision.

• 31.No implementing arrangements or assessment visits are required prior to implementing the provisions on release of EUCI in the context of paragraphs 22, 23 and 24.

VI.   EXCEPTIONAL AD HOC RELEASE OF EUCI

• 32.Where no framework is in place in accordance with Sections III to V, and where the Council or one of its preparatory bodies determines the exceptional need to release EUCI to a third State or international organisation, the GSC shall:

• (a) to the extent possible, verify with the security authorities of the third State or international organisation concerned that its security regulations, structures and procedures are such that EUCI released to it will be protected to standards no less stringent than those laid down in this Decision; and

• (b) invite the Security Committee, on the basis of available information, to issue a recommendation regarding the confidence that can be placed in the security regulations, structures and procedures in the third State or international organisation to which the EUCI is to be released.

• 33.If the Security Committee issues a recommendation in favour of releasing the EUCI, the matter shall be referred to the Committee of Permanent Representatives (Coreper), which shall take a decision on its release.

• 34.If the Security Committee’s recommendation is not in favour of releasing the EUCI:

• (a) for matters relating to CFSP/CSDP, the Political and Security Committee shall discuss the matter and formulate a recommendation for a decision by Coreper;

• (b) for all other matters, Coreper shall discuss the matter and take a decision.

• 35.Where deemed appropriate, and subject to the prior written consent of the originator, Coreper may decide that the classified information may be released only in part or only if downgraded or declassified beforehand, or that the information to be released shall be prepared without reference to the source or original EU classification level.

• 36.Following a decision to release EUCI, the GSC shall forward the document concerned, which shall bear a releasability marking indicating the third State or international organisation to which it has been released. Prior to or upon actual release, the third party in question shall undertake in writing to protect the EUCI it receives in accordance with the basic principles and minimum standards set out in this Decision.

VII.   AUTHORITY TO RELEASE EUCI TO THIRD STATES OR INTERNATIONAL ORGANISATIONS

• 37.Where a framework exists in accordance with paragraph 2 for exchanging classified information with a third State or international organisation, the Council shall take a decision to authorise the Secretary-General to release EUCI, in accordance with the principle of originator’s consent, to the third State or international organisation in question. The Secretary-General may delegate such authorisation to senior GSC officials.

• 38.Where a security of information agreement exists in accordance with paragraph 2, first indent, the Council may take a decision to authorise the High Representative to release EUCI originating in the Council in the area of the Common Foreign and Security Policy, after having obtained the consent of the originator of any source material contained therein, to the third State or international organisation in question. The High Representative may delegate such authorisation to senior EEAS officials or to EUSRs.

• 39.Where a framework exists in accordance with paragraph 2 or with paragraph 3 for exchanging classified information with a third State or international organisation, the High Representative shall be authorised to release EUCI, in accordance with the Decision establishing the CSDP operation and with the principle of originator’s consent. The High Representative may delegate such authorisation to senior EEAS officials, to EU Operation, Force or Mission Commanders, or to Heads of EU Mission.

Appendices

Appendix A	Definitions
Appendix B	Equivalence of security classifications
Appendix C	List of national security authorities (NSAs)
Appendix D	List of abbreviations

Appendix A

DEFINITIONS

For the purposes of this Decision, the following definitions shall apply:

‘Accreditation’ means the process leading to a formal statement by the Security Accreditation Authority (SAA) that a system is approved to operate with a defined level of classification, in a particular security mode in its operational environment and at an acceptable level of risk, based on the premise that an approved set of technical, physical, organisational and procedural security measures has been implemented;

‘Asset’ means anything that is of value to an organisation, its business operations and their continuity, including information resources that support the organisation’s mission;

‘Authorisation for access to EUCI’ means a decision by the GSC Appointing Authority taken on the basis of an assurance given by a competent authority of a Member State that a GSC official, other servant or seconded national expert may, provided his ‘need-to-know’ has been determined and he has been appropriately briefed on his responsibilities, be granted access to EUCI up to a specified level (CONFIDENTIEL UE/EU CONFIDENTIAL or above) until a specified date;

‘CIS life-cycle’ means the entire duration of existence of a CIS, which includes initiation, conception, planning, requirements analysis, design, development, testing, implementation, operation, maintenance and decommissioning;

‘Classified contract’ means a contract entered into by the GSC with a contractor for the supply of goods, execution of works or provision of services, the performance of which requires or involves access to or the creation of EUCI;

‘Classified subcontract’ means a contract entered into by a contractor of the GSC with another contractor (i.e. the subcontractor) for the supply of goods, execution of works or provision of services, the performance of which requires or involves access to or the creation of EUCI;

‘Communication and information system’ (CIS) — see Article 10(2);

‘Contractor’ means an individual or legal entity possessing the legal capacity to undertake contracts;

‘Cryptographic (Crypto) material’ means cryptographic algorithms, cryptographic hardware and software modules, and products including implementation details and associated documentation and keying material;

‘Cryptographic product’ means a product whose primary and main functionality is the provision of security services (confidentiality, integrity, availability, authenticity, non-repudiation) through one or more cryptographic mechanisms;

‘CSDP operation’ means a military or civilian crisis management operation under Title V, Chapter 2, of the TEU;

‘Declassification’ means the removal of any security classification;

‘Defence in depth’ means the application of a range of security measures organised as multiple layers of defence;

‘Designated Security Authority’ (DSA) means an authority responsible to the National Security Authority (NSA) of a Member State which is responsible for communicating to industrial or other entities national policy on all matters of industrial security and for providing direction and assistance in its implementation. The function of DSA may be carried out by the NSA or by any other competent authority;

‘Document’ means any recorded information regardless of its physical form or characteristics;

‘Downgrading’ means a reduction in the level of security classification;

‘EU classified information’ (EUCI) — see Article 2(1);

‘Facility Security Clearance’ (FSC) means an administrative determination by an NSA or DSA that, from the security viewpoint, a facility can afford an adequate level of protection to EUCI of a specified security classification level;

‘Handling’ of EUCI means all possible actions to which EUCI may be subject throughout its life-cycle. It comprises its creation, processing, carriage, downgrading, declassification and destruction. In relation to CIS it also comprises its collection, display, transmission and storage;

‘Holder’ means a duly authorised individual with an established need-to-know who is in possession of an item of EUCI and is accordingly responsible for protecting it;

‘Industrial or other entity’ means an entity involved in supplying goods, executing works or providing services; this may be an industrial, commercial, service, scientific, research, educational or development entity or a self-employed individual;

‘Industrial security’ — see Article 11(1);

‘Information Assurance’ — see Article 10(1);

‘Interconnection’ — see Annex IV, paragraph 32;

‘Management of classified information’ — see Article 9(1);

‘Material’ means any document, data carrier or item of machinery or equipment, either manufactured or in the process of manufacture;

‘Originator’ means the Union institution, body or agency, Member State, third state or international organisation under whose authority classified information has been created and/or introduced into the Union’s structures;

‘Personnel security’ — see Article 7(1);

‘Personnel Security Clearance’ (PSC) means a statement by a competent authority of a Member State which is made following completion of a security investigation conducted by the competent authorities of a Member State and which certifies that an individual may be granted access to EUCI up to a specified level (CONFIDENTIEL UE/EU CONFIDENTIAL or above) until a specified date;

‘Personnel Security Clearance Certificate’ (PSCC) means a certificate issued by a competent authority establishing that an individual is security cleared and holds a valid security clearance certificate or authorisation from the Appointing Authority for access to EUCI, and which shows the level of EUCI to which that individual may be granted access (CONFIDENTIEL UE/EU CONFIDENTIAL or above), the date of validity of the relevant PSC and the date of expiry of the certificate itself;

‘Physical security’ — see Article 8(1);

‘Programme/Project Security Instruction’ (PSI) means a list of security procedures which are applied to a specific programme/project in order to standardise security procedures. It may be revised throughout the programme/project;

‘Registration’ — see Annex III, paragraph 18;

‘Residual risk’ means the risk which remains after security measures have been implemented, given that not all threats are countered and not all vulnerabilities can be eliminated;

‘Risk’ means the potential that a given threat will exploit internal and external vulnerabilities of an organisation or of any of the systems it uses and thereby cause harm to the organisation and to its tangible or intangible assets. It is measured as a combination of the likelihood of threats occurring and their impact.

— ‘Risk acceptance’ is the decision to agree to the further existence of a residual risk after risk treatment.

— ‘Risk assessment’ consists of identifying threats and vulnerabilities and conducting the related risk analysis, i.e. the analysis of probability and impact.

— ‘Risk communication’ consists of developing awareness of risks among CIS user communities, informing approval authorities such risks and reporting them to operating authorities.

— ‘Risk treatment’ consists of mitigating, removing, reducing (through an appropriate combination of technical, physical, organisational or procedural measures), transferring or monitoring the risk;

‘Security Aspects Letter’ (SAL) means a set of special contractual conditions issued by the contracting authority which forms an integral part of any classified contract involving access to or the creation of EUCI, that identifies the security requirements or those elements of the contract requiring security protection;

‘Security Classification Guide’ (SCG) means a document which describes the elements of a programme or contract which are classified, specifying the applicable security classification levels. The SCG may be expanded throughout the life of the programme or contract and the elements of information may be re-classified or downgraded; where an SCG exists it shall be part of the SAL;

‘Security investigation’ means the investigative procedures conducted by the competent authority of a Member State in accordance with its national laws and regulations in order to obtain an assurance that nothing adverse is known which would prevent an individual from being granted a PSC or an authorisation for access to EUCI up to a specified level (CONFIDENTIEL UE/EU CONFIDENTIAL or above);

‘Security mode of operation’ means the definition of the conditions under which a CIS operates based on the classification of information handled and the clearance levels, formal access approvals, and need-to-know of its users. Four modes of operation exist for handling or transmitting classified information: dedicated mode, system-high mode, compartmented mode and multilevel mode:

— ‘Dedicated mode’ means a mode of operation in which all individuals with access to the CIS are cleared to the highest classification level of information handled within the CIS, and with a common need-to-know for all of the information handled within the CIS,