2013/488/EU: Council Decision of 23 September 2013 on the security rules for protecting EU classified information

— ‘System-high mode’ means a mode of operation in which all individuals with access to the CIS are cleared to the highest classification level of information handled within the CIS, but not all individuals with access to the CIS have a common need-to-know for the information handled within the CIS; approval to access information may be granted by an individual,

— ‘Compartmented mode’ means a mode of operation in which all individuals with access to the CIS are cleared to the highest classification level of information handled within the CIS, but not all individuals with access to the CIS have a formal authorisation to access all of the information handled within the CIS; formal authorisation implies a formal central management of access control as distinct from an individual’s discretion to grant access,

— ‘Multilevel mode’ means a mode of operation in which not all individuals with access to the CIS are cleared to the highest classification level of information handled within the CIS, and not all individuals with access to the CIS have a common need-to-know for the information handled within the CIS;

‘Security risk management process’ means the entire process of identifying, controlling and minimising uncertain events that may affect the security of an organisation or of any of the systems it uses. It covers the entirety of risk-related activities, including assessment, treatment, acceptance and communication;

‘TEMPEST’ means the investigation, study and control of compromising electromagnetic emanations and the measures to suppress them;

‘Threat’ means a potential cause of an unwanted incident which may result in harm to an organisation or any of the systems it uses; such threats may be accidental or deliberate (malicious) and are characterised by threatening elements, potential targets and attack methods;

‘Vulnerability’ means a weakness of any nature that can be exploited by one or more threats. A vulnerability may be an omission or it may relate to a weakness in controls in terms of their strength, completeness or consistency and may be of a technical, procedural, physical, organisational or operational nature.

Appendix B

EQUIVALENCE OF SECURITY CLASSIFICATIONS

Germany: VS = Verschlusssache.

Information generated by France before 1 July 2021 and classified ‘TRÈS SECRET DÉFENSE’, ‘SECRET DÉFENSE’ and ‘CONFIDENTIEL DÉFENSE’ continue to be handled and protected at the equivalent level of ‘TRÈS SECRET UE/EU TOP SECRET’, ‘SECRET UE/EU SECRET’ and ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ respectively.

France handles and protects ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ information in accordance with the French security measures for protecting ‘SECRET’ information.

France does not use the classification ‘RESTREINT’ in its national system. France handles and protects ‘RESTREINT UE/EU RESTRICTED’ information in a manner no less stringent than the standards and procedures described in the security rules of the Council of the European Union.

The Maltese and English markings for Malta can be used interchangeably.

Appendix C

LIST OF NATIONAL SECURITY AUTHORITIES (NSAs)

Appendix D

LIST OF ABBREVIATIONS

[^E0001]: Council Decision 2011/292/EU of 31 March 2011 on the security rules for protecting EU classified information (OJ L 141, 27.5.2011, p. 17).

[^E0002]: Council Decision 2001/264/EC of 19 March 2001 adopting the Council’s security regulations (OJ L 101, 11.4.2001, p. 1).

[^E0003]: Council Regulation (EEC, Euratom, ECSC) No 259/68 of 29 February 1968 laying down the Staff Regulations and the Conditions of Employment of Other Servants of the European Communities and instituting special measures temporarily applicable to officials of the Commission (OJ L 56, 4.3.1968, p. 1.).