Decision of the Bureau of the European Parliament of 15 April 2013 concerning the rules governing the treatment of confidential information by the European Parliament

• 1. The decision to classify a document shall be made before its creation. To that end, classifying information as EUCI involves a prior assessment of its level of confidentiality and a decision by the originator that unauthorised disclosure of such information would cause some degree of prejudice to the interests of the European Union or of one or more of its Member States or individuals.

• 1. Once the decision to classify the information is taken, a second prior assessment shall follow in order to determine the appropriate classification level. The classification of a document shall be determined by the level of sensitivity of its contents.

• 1. Responsibility for classifying information shall lie solely with the originator. Parliament officials shall classify information on instructions from, or pursuant to a delegation by, the Secretary-General.

• 1. Classification shall be correctly and sparingly used. The originator of a document that is to be given a classification shall curb any tendency to over-classify or under-classify.

• 1. The classification level assigned to the information shall determine the level of protection afforded to it in the areas of personnel security, physical security, procedural security and information assurance.

• 1. Information which warrants classification shall be marked and handled as such, regardless of its physical form. Its classification shall be clearly communicated to its recipients, either by a security classification marking (if it is delivered in written form, be it on paper or within a CIS) or by an announcement (if it is delivered in oral form, such as in the course of a conversation or a meeting held in camera). Classified material shall be physically marked so as to enable its security classification to be easily identified.

• 1. EUCI in electronic form may only be created within an accredited CIS. The classified information itself, as well as the file name and storage device (if external, such as a CD-ROM or USB stick), shall bear the relevant security classification marking.

• 1. Information shall be classified as soon as it takes form. For example, personal notes, drafts or e-mail messages containing information which warrants classification are to be marked as EUCI from the outset and shall be produced and handled in accordance with this Decision and its handling instructions in physical and technical terms. Such information may then evolve into an official document which will in turn be appropriately marked and handled. During the drafting process, an official document may need to be re-evaluated and assigned a higher or lower classification level as it evolves.

• 1. The originator may decide to assign a standard classification level to categories of information which he/she creates on a regular basis. However, the originator shall ensure that, in so doing, he/she does not systematically over-classify or under-classify individual pieces of information.

• 1. EUCI shall always bear a security classification marking corresponding to its security classification level.

• B.1. Levels of classification

• 13.EUCI shall be classified at one of the following levels:

• — ‘TRÈS SECRET UE/EU TOP SECRET’, as defined in point (d) of Article 2 of this Decision, where its compromise would be likely to: (a) threaten directly the internal stability of the Union or of one or more of its Member States or third States or international organisations; (b) cause exceptionally grave damage to relations with third States or international organisations; (c) lead directly to widespread loss of life; (d) cause exceptionally grave damage to the operational effectiveness or security of Member States' or other contributors' deployed personnel, or to the continuing effectiveness of extremely valuable security or intelligence operations; or (e) cause severe long-term damage to the Union's or Member States' economy;

• — ‘SECRET UE/EU SECRET’, as defined in point (d) of Article 2 of this Decision, where its compromise would be likely to: (a) raise international tensions to a significant degree; (b) seriously damage relations with third States and international organisations; (c) threaten life directly or seriously prejudice public order or individual security or liberty; (d) damage major commercial or policy negotiations, causing significant operational problems for the Union or Member States; (e) cause serious damage to the operational security of Member States, or to the effectiveness of highly valuable security or intelligence operations; (f) cause substantial material damage to Union or Member State financial, monetary, economic and commercial interests; (g) substantially undermine the financial viability of major organisations or operators; or (h) seriously impede the development or operation of Union policies with major economic, trade or financial consequences;

• — ‘CONFIDENTIEL UE/EU CONFIDENTIAL’, as defined in point (d) of Article 2 of this Decision, where its compromise would be likely to: (a) significantly damage diplomatic relations, e.g. where it would lead to a formal protest or other sanctions; (b) put individual security or liberty at risk; (c) put the outcome of commercial or policy negotiations at serious risk; cause operational problems for the Union or Member States; (d) cause damage to the operational security of Member States, or to the effectiveness of security or intelligence operations; (e) substantially undermine the financial viability of major organisations or operators; (f) impede the investigation or facilitate the commission of crime or terrorist activities; (g) work substantially against Union or Member State financial, monetary, economic and commercial interests; or (h) seriously impede the development or operation of Union policies with major economic, trade or financial consequences;

• — ‘RESTREINT UE/EU RESTRICTED’, as defined in point (d) of Article 2 of this Decision, where its compromise would be likely to: (a) be disadvantageous to the general interests of the Union; (b) adversely affect diplomatic relations; (c) cause substantial distress to individuals or companies; (d) be disadvantageous to the Union or Member States in commercial or policy negotiations; (e) make it more difficult to maintain effective security within the Union or Member States; (f) impede the effective development or operation of Union policies; (g) undermine the proper management of the Union and its operations; (h) breach undertakings given by Parliament to maintain the classified status of information provided by third parties; (i) breach statutory restrictions on disclosure of information; (j) cause financial loss or facilitate improper gain or advantage for individuals or companies; or (k) prejudice the investigation or facilitate the commission of crime.

• B.2. Classification of compilations, cover pages and excerpts

• 1. The classification of a letter or note containing enclosures shall be as high as the highest classification level assigned to one of its enclosures. The originator shall indicate clearly the level at which the letter or note should be classified when detached from its enclosures. Where the cover note/letter does not need to be classified, it shall include the following final wording: ‘When detached from its enclosures, this note/letter is unclassified.’.

• 1. Documents or files containing components with different classification levels are whenever possible to be structured in such a way that components with a different classification level may be easily identified and detached if necessary. The overall classification level of a document or file shall be at least as high as that of its most highly classified component.

• 1. Individual pages, paragraphs, sections, annexes, appendices, attachments and enclosures of a given document may require different classification levels and shall be classified accordingly. Standard abbreviations may be used within documents containing EUCI to indicate the classification level of sections or blocks of text of less than a single page.

• 1. When information from various sources is collated, the final product shall be reviewed to determine its overall security classification level, since it may warrant a higher classification level than its component parts.

C. OTHER CONFIDENTIAL INFORMATION

• 1. ‘Other confidential information’ shall be marked in accordance with point E of this security notice and the handling instructions.

D. CREATION OF CONFIDENTIAL INFORMATION

• 1. Only persons duly empowered by this Decision or authorised by the SA may create confidential information.

• 1. Confidential information shall not be added to internet or intranet document management systems.

• D.1. Creation of EUCI

• 1. In order to create EUCI classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET, the individual concerned shall be empowered by this Decision or shall first be in possession of an authorisation granted pursuant to Article 4(1) of this Decision.

• 1. EUCI classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET shall be created only within the Secure Area.

• 1. The following rules shall apply to the creation of EUCI:

• (a) each page shall be marked clearly with the applicable classification level;

• (b) each page shall be numbered and shall state the total number of pages;

• (c) the document shall bear a reference number on the first page and an indication of its subject-matter, which shall not itself constitute classified information, unless it is affixed as such;

• (d) the document shall bear a date on the first page;

• (e) the first page of any document classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET shall contain a list of all annexes and enclosures;

• (f) documents classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET shall bear a copy number on every page, if they are to be distributed in several copies. Each copy shall also bear on the first page the total number of copies and of pages, and

• (g) if the document makes reference to other documents containing classified information received from other Union Institutions, or if it contains classified information emanating from those documents, it shall bear the same classification level as those documents and may not, without the prior written consent of its originator, be distributed to any persons other than those named in the distribution list in respect of the original document or documents containing classified information.

• 1. The originator shall retain control of EUCI which he/she has created. His/her prior written consent shall be sought before that EUCI is:

• (a) downgraded or declassified;

• (b) used for purposes other than those established by the originator;

• (c) disclosed to any third State or international organisation;

• (d) disclosed to any person, institution, country or international organisation other than the addressees originally authorised by the originator to consult the information in question;

• (e) disclosed to a contractor or prospective contractor located in a third State;

• (f) copied or translated, if the information is classified at the level TRES SECRET UE/EU TOP SECRET;

• (g) destroyed.

• D.2. Creation of other confidential information

• 1. The Secretary-General, acting as SA, may decide whether or not to authorise the creation of ‘other confidential information’ by a given function, service and/or individual.

• 1. ‘other confidential information’ shall bear one of the markings defined in the handling instructions.

• 1. The following rules shall apply to the creation of ‘other confidential information’:

• (a) its marking shall be indicated at the top of the first page of the document;

• (b) each page shall be numbered within the total number of pages;

• (c) the document shall bear a reference number on the first page and an indication of its subject-matter;

• (d) the document shall bear a date on the first page and;

• (e) the last page of the document shall contain a list of all annexes and enclosures.

• 1. Creation of ‘other confidential information’ is subject to specific rules and procedures laid down in the handling instructions.

E. SECURITY DESIGNATORS AND MARKINGS

• 1. Security designators and markings on documents are intended to control the flow of information and to restrict access to confidential information on the basis of the ‘need to know’ principle.

• 1. When security designators and/or markings are being used or affixed, care shall be taken to avoid confusion with security classifications for EUCI: RESTREINT UE/EU RESTRICTED, CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET, TRES SECRET UE/EU TOP SECRET.

• 1. Specific rules concerning the use of security designators and markings, along with the list of approved European Parliament security markings, shall be laid down in the handling instructions.

• E.1. Security designators

• 1. Security designators may only be used in conjunction with a security classification and shall not be applied separately to documents. A security designator may be applied to EUCI in order to:

• (a) set limits to the validity of a classification (for classified information signifying automatic downgrading or declassification);

• (b) limit the distribution of the EUCI in question;

• (c) establish special handling arrangements in addition to those corresponding to the security classification level.

• 1. The extra controls applicable to the handling and storage of documents containing EUCI impose additional burdens on all involved. In order to minimise the work required in this connection, it is good practice, when creating such a document, to establish a time limit or event after which the classification is to automatically expire and the information contained in the document is to be downgraded or declassified.

• 1. Where a document deals with a specific area of work and its distribution needs to be limited and/or it is to be subject to special handling arrangements, a statement to that effect may be added to its classification to help to identify its target audience.

• E.2. Markings

• 1. Markings do not constitute a security classification. They are intended to serve only to provide concrete instructions about the handling of a document, and shall not be used to describe the contents of such document.

• 1. Markings may be applied separately to documents or used in conjunction with a security classification.

• 1. As a general rule, markings shall be applied to information which is covered by the professional secrecy referred to in Article 339 TFEU and Article 17 of the Staff Regulations, or which has to be protected for legal reasons by Parliament but does not need to be, or cannot be, classified.

• E.3. Use of markings in the CIS

• 1. The rules on the use of the markings are also applicable within the accredited CIS.

• 1. The SAA shall establish specific rules on the use of markings in the accredited CIS.

F. RECEPTION OF INFORMATION

• 1. Only the CIU shall be entitled within Parliament to receive information classified as CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET, or its equivalent from third parties.

• 1. As to information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’, both the CIU or the competent parliamentary body/office-holder may be responsible for receiving it from third parties, and for applying the principles set out in this security notice.

G. REGISTRATION

• 1. Registration means the application of procedures for recording the life-cycle of confidential information, including its dissemination, consultation and destruction.

• 1. For the purposes of this security notice, ‘logbook’ means a register which records in particular the dates and times when confidential information:

• (a) enters or exits the respective secretariat of the parliamentary body/office-holder or, as the case may be, the CIU;

• (b) is accessed by or transmitted to a security-cleared person; and

• (c) is destroyed.

• 1. The originator of classified information shall be responsible for marking the initial declaration upon the creation of a document containing such information. That declaration shall be communicated to the CIU when the document is created.

• 1. Information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET, or its equivalent may only be registered by the CIU for security purposes. Information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’ received from third parties shall be registered by the service responsible for the official reception of the document, being either the CIU or the secretariat of the parliamentary body/office-holder, for administrative purposes. ‘Other confidential information’ produced within Parliament shall be registered by the originator, for administrative purposes.

• 1. Information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET, or its equivalent shall be registered especially when:

• (a) it is produced;

• (b) it arrives at or leaves the CIU; and

• (c) it arrives at or leaves the CIS.

• 1. Information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent shall be registered especially when:

• (a) it is produced;

• (b) it arrives at or leaves the respective secretariat of the parliamentary body/office-holder or the CIU; and

• (c) it arrives at or leaves the CIS.

• 1. Registration of confidential information may be carried out on paper or in electronic logbooks/CIS.

• 1. For information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’, at least the following shall be recorded:

• (a) the date and time when it enters or leaves the respective secretariat of the parliamentary body/office-holder or the CIU, as the case may be;

• (b) the document title, the classification level or marking, the expiry date of the classification/marking and any reference number assigned to the document.

• 1. For information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET, or its equivalent, at least the following shall be recorded:

• (a) the date and time when it enters or leaves the CIU;

• (b) the document title, classification level or marking, any reference number assigned to the document and the expiry date of the classification/marking;

• (c) details of the originator;

• (d) a record of the identity of any person who is given access to the document, and of the date when it was accessed by that person;

• (e) a record of any copies or translations made of the document;

• (f) the date and time when any copies or translations of the document leave or return to the CIU, and details of where they have been sent and who has returned them;

• (g) the date and time when the document is destroyed, and by whom, in accordance with Parliament's security rules on destruction; and

• (h) the declassification or downgrading of the document.

• 1. Logbooks shall be classified or marked as appropriate. Logbooks for information classified at the level TRES SECRET UE/EU TOP SECRET or its equivalent shall be registered at the same level.

• 1. Classified information may be registered:

• (a) in a single logbook; or

• (b) in separate logbooks according to its classification level, its status as incoming or outgoing information and its origin or destination.

• 1. In the case of electronic handling within the CIS, registration procedures may be carried out by those means within the CIS itself which meet requirements equivalent to those specified above. Whenever EUCI leaves the perimeter of the CIS, the registration procedure described above shall apply.

• 1. The CIU shall keep a record of all classified information released by Parliament to third parties and of classified information received by Parliament from third parties.

• 1. Once registration of information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET or its equivalent is complete, the CIU shall check whether the addressee has a valid security authorisation. Where this is the case, the addressee shall be notified by the CIU. The consultation of classified information may only take place once the document containing it has been registered.

H. DISTRIBUTION

• 1. The originator shall establish the initial distribution list for the EUCI which he/she has created.

• 1. Information classified at the level RESTREINT UE/EU RESTRICTED and ‘other confidential information’ produced by Parliament shall be distributed within Parliament by the originator, in accordance with the relevant handling instructions and on the basis of the ‘need-to-know’ principle. For information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET created by Parliament within the Secure Area, the distribution list (and any further instructions concerning distribution) shall be provided to the CIU, which shall be responsible for its management.

• 1. EUCI produced by Parliament may be distributed to third parties only by the CIU, on the basis of the ‘need to know’ principle.

• 1. Confidential information received either by the CIU or by any parliamentary body/office-holder who submitted the request therefor shall be distributed in accordance with the instructions received from the originator.

I. HANDLING, STORAGE AND CONSULTATION

• 1. Handling, storage and consultation of confidential information shall be carried out in accordance with security notice 4 and the handling instructions.

J. COPYING/TRANSLATING/INTERPRETING CLASSIFIED INFORMATION

• 1. Documents containing information classified at the level TRES SECRET UE/EU TOP SECRET or its equivalent shall not be copied or translated without the prior written consent of the originator. Documents containing information classified at the level SECRET UE/EU SECRET or its equivalent or at the level CONFIDENTIEL UE/EU CONFIDENTIAL or its equivalent may be copied or translated on instruction from the holder, provided the originator has not prohibited this.

• 1. Each copy of a document containing information classified at the level TRES SECRET UE/EU TOP SECRET, SECRET UE/EU SECRET or CONFIDENTIEL UE/EU CONFIDENTIAL or its equivalent shall be registered for security purposes.

• 1. The security measures applicable to the original document containing classified information shall apply to copies and translations thereof.

• 1. Documents received from the Council should be received in all official languages.

• 1. Copies and/or translations of documents containing classified information may be requested by the originator or copy holder. Copies of documents containing information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET, or its equivalent may only be produced in the Secure Area and on copiers which are part of an accredited CIS. Copies of documents containing information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’ shall be made using an accredited reproduction device within Parliament's premises.

• 1. All copies and translations of any document or parts of copies of documents containing confidential information shall be appropriately marked, numbered and registered.

• 1. No more copies shall be made than are strictly necessary. All copies shall be destroyed in accordance with the handling instructions at the end of the consultation period.

• 1. Only interpreters and translators who are Parliament officials shall ge given access to classified information.

• 1. Interpreters and translators with access to documents containing information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET, or its equivalent shall have the appropriate security clearance.

• 1. When working on documents containing information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET,or its equivalent, interpreters and translators shall work in the Secure Area.

K. DOWNGRADING, DECLASSIFYING AND UNMARKING OF CONFIDENTIAL INFORMATION

K.1.   General principles

• 1. Confidential information shall be declassified, downgraded or unmarked when protection is no longer necessary or is no longer needed at the original level.

• 1. Decisions to downgrade, declassify or unmark information contained in documents produced within Parliament may also have to be made on an ad hoc basis, for example in response to a request for access from the public or from another Union Institution, or at the initiative of the CIU or parliamentary body/office-holder.

• 1. At the time of its creation, the originator of EUCI shall indicate, where possible, whether the EUCI in question can be downgraded or declassified on a given date or following a specific event. When it is not practicable to give such an indication, the originator, the CIU or the parliamentary body/office-holder holding the information shall review the classification level of EUCI at least once every five years. In all instances, EUCI may be downgraded or declassified only with the prior written consent of the originator.

• 1. In the event that the originator of EUCI cannot be established or traced in respect of documents produced within Parliament, the SA shall review the classification level of the EUCI in question on the basis of a proposal from the parliamentary body/office-holder holding the information, which may consult the CIU in that regard.

• 1. The CIU or the parliamentary body/office-holder holding the information shall be responsible for notifying the addressee(s) that the information has been declassified or downgraded, and the addressee(s) shall in turn be responsible for notifying any subsequent addressee(s) to whom they have sent or copied the document.

• 1. The declassification, downgrading or unmarking of information contained in a document shall be recorded.

K.2.   Declassification

• 1. EUCI may be declassified in full or in part. It may be declassified in part when protection is no longer deemed necessary for a specific part of the document containing it but continues to be justified for the rest of the document.

• 1. When the review of EUCI contained in a document created within Parliament results in a decision to declassify it, consideration shall be given to the question whether the document may be made public or whether it is to bear a distribution marking (i.e. not be made public).

• 1. When EUCI is declassified, its declassification shall be recorded in the logbook with the following data: date of the declassification, names of the persons who requested and who authorised the declassification, reference number of the declassified document and its final destination.

• 1. The old classification markings in the declassified document and in all copies thereof shall be struck through. The documents and all copies thereof shall be stored accordingly.

• 1. Upon partial declassification of classified information, the part that has been declassified shall be produced in the form of an extract and stored appropriately. The competent service shall register:

• (a) the date of the partial declassification;

• (b) the names of the persons who requested and who authorised the declassification; and

• (c) the reference number of the declassified extract.

K.3.   Downgrading

• 1. Following the downgrading of classified information, the document containing it shall be registered in the logbooks corresponding to both the old and the new classification level. The date of downgrading shall be recorded, as well as the name of the person who authorised it.

• 1. The document containing the downgraded information and all copies thereof shall be classified with the new classification level and stored appropriately.

L. DESTRUCTION OF CONFIDENTIAL INFORMATION

• 1. Confidential information (in either hard copy or electronic form) which is no longer required shall be destroyed or deleted, in accordance with the handling instructions and relevant rules on archiving.

• 1. Information classified at the level TRES SECRET UE/EU TOP SECRET or SECRET UE/EU SECRET or its equivalent, shall be destroyed by the CIU. Its destruction shall be witnessed by a person holding security clearance corresponding to at least the classification level of the information being destroyed.

• 1. Information classified at the level TRES SECRET UE/EU TOP SECRET or its equivalent shall be destroyed only with the prior written consent of the originator.

• 1. Information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET, or its equivalent shall be destroyed and disposed of by the CIU on instruction from the originator or from a competent authority. The logbooks and other registers shall be updated accordingly. Information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent shall be destroyed and disposed of either by the CIU or by the relevant parliamentary body/office-holder.

• 1. The official responsible for the destruction and the person witnessing the destruction shall sign a destruction certificate, to be filed and archived in the CIU. The CIU shall keep, together with the distribution forms, destruction certificates relating to information classified at the level TRES SECRET UE/EU TOP SECRET or its equivalent for a period of at least ten years, and, in the case of information classified at the level SECRET UE/EU SECRET or its equivalent and CONFIDENTIEL UE/EU CONFIDENTIAL or its equivalent, for a period of at least five years.

• 1. Documents containing classified information shall be destroyed by methods which meet the relevant Union standards or equivalent standards so as to prevent them from being reconstructed in whole or in part.

• 1. The destruction of computer storage media used for classified information shall be carried out in accordance with the relevant handling instructions.

• 1. Destruction of classified information shall be recorded in the relevant logbook with the following data:

• (a) date and time of destruction;

• (b) name of the official responsible for destruction;

• (c) identification of the document or copies destroyed;

• (d) original physical form of the destroyed EUCI;

• (e) means of destruction; and

• (f) place of destruction.

M. ARCHIVING

• 1. Classified information, including any cover note/letter, annexes, deposit slip and/or other parts of the dossier, shall be transferred to the secure archive in the Secure Area six months after it was last consulted and, at the latest, one year after it was deposited. Detailed rules on the archiving of classified information shall be laid down in the handling instructions.

• 1. For ‘other confidential information’, the general rules on document management shall apply without prejudice to any other specific provisions on its handling.

SECURITY NOTICE 3

THE PROCESSING OF CONFIDENTIAL INFORMATION BY MEANS OF AUTOMATED COMMUNICATION INFORMATION SYSTEMS (CIS)

A. INFORMATION ASSURANCE OF CLASSIFIED INFORMATION HANDLED IN INFORMATION SYSTEMS

• 1. ‘Information assurance’ (IA) in the field of information systems is the confidence that such systems will protect the classified information they handle and will function as they need to and when they need to, under the control of legitimate users. Effective IA shall ensure appropriate levels of confidentiality, integrity, availability, non-repudiation and authenticity. IA shall be based on a risk management process.

• 1. ‘Communication Information System’ (CIS) for the handling of classified information means a system enabling information to be handled in electronic form. Such an information system shall comprise the entire assets required for it to operate, including the infrastructure, organisation, personnel and information resources.

• 1. CIS shall handle classified information in accordance with the concept of IA.

• 1. CIS shall undergo an accreditation process. Accreditation shall aim at obtaining assurance that all appropriate security measures have been implemented and that a sufficient level of protection of the classified information and of the CIS has been achieved in accordance with this security notice. The accreditation statement shall determine the maximum classification level of the information that may be handled in the CIS as well as the corresponding terms and conditions.

• 1. The following IA properties and concepts are essential for the security and correct functioning of CIS operations:

• (a) authenticity: the guarantee that information is genuine and that it emanates from bona fide sources;

• b) availability: the property of being accessible and usable upon request by an authorised entity;

• (c) confidentiality: the property that information is not to be disclosed to unauthorised individuals, entities or processes;

• (d) integrity: the property of safeguarding the accuracy and completeness of information and assets;

• (e) non-repudiation: the ability to prove that an action or event has taken place, so as to preclude the possibility of any subsequent denial of that event or action.

B. INFORMATION ASSURANCE PRINCIPLES

• 1. The provisions set out below shall form the baseline for the security of any CIS handling classified information. Detailed requirements for implementing these provisions shall be defined in IA security policies and security guidelines.

• B.1. Security risk management

• 1. Security risk management shall be an integral part of defining, developing, operating and maintaining CIS. Risk management (assessment, treatment, acceptance and communication) shall be conducted as an iterative process jointly by representatives of the system owners, project authorities, operating authorities and security approval authorities, as laid down in security notice 1, using a proven, transparent and understandable risk assessment process. The scope of the CIS and its assets shall be clearly defined at the outset of the risk management process.

• 1. The competent authorities, as laid down in security notice 1, shall review the potential threats to CIS and shall maintain up-to-date and accurate threat assessments which reflect the current operational environment. They shall constantly update their knowledge of vulnerability issues and periodically review the vulnerability assessment to keep up with the changing information technology (IT) environment.

• 1. The aim of security risk treatment shall be to apply a set of security measures which results in a satisfactory balance between user requirements, cost and residual security risk.

• 1. Accreditation of a CIS shall include a formal residual risk statement and acceptance of the residual risk by a responsible authority. The specific requirements, scale and degree of detail determined by the relevant SAA for accrediting a CIS shall be commensurate with the risk assessed, taking account of all relevant factors, including the classification level of the classified information handled in the CIS.

• B.2. Security throughout the CIS life cycle

• 1. Ensuring security shall be a requirement throughout the entire CIS life cycle, from initiation to withdrawal from service.

• 1. The role and interaction of each actor involved in CIS with regard to its security shall be identified for each phase of the life cycle.

• 1. CIS, including its technical and non-technical security measures, shall be subject to security testing during the accreditation process to ensure that the appropriate level of assurance is obtained and to verify that the CIS, including its technical and non-technical security measures, are correctly implemented, integrated and configured.

• 1. Security assessments, inspections and reviews shall be performed periodically during the operation and maintenance of CIS and when exceptional circumstances arise.

• 1. Security documentation for CIS shall evolve over its life cycle as an integral part of the process of change management.

• 1. Registration procedures performed by a CIS, where required, shall be verified as part of the accreditation process.

• B.3. Best practice

• 1. The IAA shall develop best practice for protecting classified information handled by the CIS. Best practice guidelines shall set out technical, physical, organisational and procedural security measures for CIS with proven effectiveness in countering given threats and vulnerabilities.

• 1. The protection of classified information handled by the CIS shall draw on lessons learned by entities involved in IA.

• 1. The dissemination and subsequent implementation of best practice shall help to achieve an equivalent level of assurance for the CIS operated by the Parliament secretariat which handles classified information.

• B.4. Defence in depth

• 1. In order to mitigate risk to CIS, a range of technical and non-technical security measures, organised as multiple layers of defence, shall be implemented. Those layers shall include:

• (a) deterrence: security measures aimed at dissuading any adversary planning to attack the CIS;

• (b) prevention: security measures aimed at impeding or blocking an attack on the CIS;

• (c) detection: security measures aimed at discovering the occurrence of an attack on the CIS;

• (d) resilience: security measures aimed at limiting the impact of an attack to a minimum set of information or CIS assets and preventing further damage; and

• (e) recovery: security measures aimed at regaining a secure situation for the CIS.

The degree of stringency of such security measures shall be determined following a risk assessment.

• 1. The competent authorities, as specified in security notice 1, shall ensure that they can respond to incidents which may transcend organisational boundaries in such a way as to coordinate responses and share information about those incidents and the related risks (computer emergency response capabilities).

• B.5. Principle of minimalist and least privilege

• 1. In order to avoid unnecessary risk, only the essential functionalities, devices and services needed to meet operational requirements shall be implemented.

• 1. CIS users and automated processes shall be given only the access, privileges or authorisations they require in order to perform their tasks, so as to limit any damage resulting from accidents, errors, or unauthorised use of CIS resources.

• B.6. Information Assurance awareness

• 1. Awareness of the risks and available security measures is the first line of defence for the security of CIS. In particular, all personnel involved in the life cycle of CIS, including users, shall understand:

• (a) that security failures may significantly harm the CIS handling classified information;

• (b) the potential harm to others which may arise from interconnectivity and interdependency; and

• (c) their individual responsibility and accountability for the security of CIS according to their roles within the systems and processes.

• 1. In order to ensure that security responsibilities are understood, IA education and awareness training shall be mandatory for all personal involved, including senior management, Members of the European Parliament and CIS users.

• B.7. Evaluation and approval of IT-security products

• 1. CIS handling information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET, or its equivalent shall be protected in such a way that the information cannot be compromised by unintentional electromagnetic emanations (‘TEMPEST security measures’).

• 1. Where the protection of classified information is provided by cryptographic products, such products shall be certified by the SAA as EU-approved cryptographic products.

• 1. During transmission of classified information by electronic means, EU-approved cryptographic products shall be used. Notwithstanding this requirement, specific procedures or specific technical configurations may be applied in emergency circumstances as specified in points 41 to 44.

• 1. The requisite degree of confidence in the security measures, defined as a level of assurance, shall be determined following the outcome of the risk management process and in line with the relevant security policies and guidelines.

• 1. The level of assurance shall be verified by using internationally recognised or nationally approved processes and methodologies. This includes primarily evaluation, controls and auditing.

• 1. The SAA shall approve security guidelines on the qualification and approval of non-cryptographic IT security products.

• B.8. Transmission within the Secure Area

• 1. When transmission of classified information is confined within the Secure Area, unencrypted distribution or encryption at a lower level may be used, based on the outcome of a risk management process and subject to the approval of the SAA.

• B.9. Secure interconnection of CIS

• 1. Interconnection shall mean the direct connection of two or more IT systems for the purpose of sharing data and other information resources in a unidirectional or multidirectional way.

• 1. CIS shall treat any interconnected IT system as untrustworthy and shall implement protective measures to control the exchange of classified information with any other CIS.

• 1. For all interconnections of CIS with another IT system the following basic requirements shall be met:

• (a) business or operational requirements for such interconnections shall be stated and approved by the competent authorities;

• (b) the interconnection in question shall undergo a risk management and accreditation process and shall require the approval of the competent SAA;

• (c) protection services (PS) shall be implemented at the perimeter of CIS.

• 1. There shall be no interconnection between an accredited CIS and an unprotected or public network, except where the CIS has approved PSs installed for such a purpose between the CIS and the unprotected or public network. The security measures for such interconnections shall be reviewed by the competent IAA and approved by the competent SAA.

• 1. When the unprotected or public network is used solely as a carrier and the data is encrypted by an EU cryptographic product certified in accordance with paragraph 27, such a connection shall not be deemed to be an interconnection.

• 1. The direct or cascaded interconnection to an unprotected or public network of a CIS accredited to handle information classified at the level TRES SECRET UE/EU TOP SECRET or its equivalent or SECRET UE/EU SECRET or its equivalent shall be prohibited.

• B.10. Computer storage media

• 1. Computer storage media shall be destroyed in accordance with procedures approved by the competent security authority.

• 1. Computer storage media shall be reused, downgraded or declassified in accordance with the handling instructions.

• B.11. Emergency circumstances

• 1. The specific procedures described below may be applied in an emergency, such as during situations of impending or actual crisis, conflict or war, or in exceptional operational circumstances.

• 1. Classified information may, with the consent of the competent authority, be transmitted using cryptographic products which have been approved for a lower classification level or without encryption if any delay would cause harm clearly outweighing the harm entailed by any disclosure of the classified material and if:

• (a) the sender and the recipient do not have the required encryption facility or have no encryption facility; and

• (b) the classified material cannot be conveyed in sufficient time by other means.

• 1. Classified information transmitted under the circumstances set out in paragraph 41 shall not bear any markings or indications distinguishing it from information which is unclassified or which can be protected by an available cryptographic product. Recipients shall be notified of the classification level, without delay, by other means.

• 1. Should recourse be had to paragraph 41 or 42 a subsequent report shall be made to the competent authority.

SECURITY NOTICE 4

PHYSICAL SECURITY

A. INTRODUCTION

This security notice sets out the security principles for creating a secure environment for ensuring the correct treatment of confidential information in the European Parliament. These principles, including those relating to technical security, will be supplemented by the handling instructions.

B. SECURITY RISK MANAGEMENT

• 1. Risk to classified information shall be managed as a process. That process shall be aimed at determining known security risks, at defining security measures to reduce such risks to an acceptable level in accordance with the basic principles and minimum standards set out in this security notice, and at applying those measures in line with the concept of defence in depth as defined in security notice 3. The effectiveness of such measures shall be continuously evaluated.

• 1. Security measures for protecting classified information throughout its life cycle shall be commensurate with, in particular, its security classification, the form and volume of the information or material concerned, the location and construction of facilities housing classified information and the locally assessed threat of malicious and/or criminal activities, including espionage, sabotage and terrorism.

• 1. Contingency plans shall take account of the need to protect classified information during emergency situations in order to prevent unauthorised access, disclosure or loss of integrity or availability.

• 1. Preventive and recovery measures to minimise the impact of major failures or incidents on the handling and storage of classified information shall be included in business continuity plans.

C. GENERAL PRINCIPLES

• 1. The classification or marking level assigned to the information shall determine the level of protection afforded to it in the areas of physical security.

• 1. Information which warrants classification shall be marked and handled as such regardless of its physical form. Its classification shall be clearly communicated to its recipients, either by a classification marking (if it is delivered in written form, be it on paper or in CIS) or by an announcement (if it is delivered in oral form, such as in a conversation or a presentation). Classified material shall be physically marked so as to enable its security classification to be easily identified.

• 1. Confidential information shall not, under any circumstances, be read in public places where it might be seen by an individual without a need to know, e.g. on trains or in planes, cafes, bars etc. It shall not be left in hotel safes or rooms, or left unattended in public places.

D. RESPONSIBILITIES

• 1. The CIU is responsible for ensuring physical security in the management of confidential information deposited in its secure facilities. The CIU is also responsible for the management of its secure facilities.

• 1. Physical security in the management of information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and of ‘other confidential information’ is the responsibility of the respective parliamentary body/office-holder.

• 1. The Directorate for Security and Risk Assessment shall ensure the personal security and security clearance needed to ensure the secure handling of confidential information in the European Parliament.

• 1. The DIT shall advise and ensure that any created or used CIS is fully in compliance with security notice 3 and the respective handling instructions.

E. SECURE FACILITIES

• 1. Secure facilities may be installed under the technical security standards and in accordance with the level assigned to the confidential information as defined in Article 7.

• 1. The secure facilities shall be certified by the SAA and validated by the SA.

F. CONSULTATION OF CONFIDENTIAL INFORMATION

• 1. When information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’ is deposited with the CIU and has to be consulted outside the Secure Area, the CIU shall transmit a copy to the appropriate authorised service which shall ensure that consultation and handling of the information in question complies with Article 8(2) and Article 10 of this Decision and the appropriate handling instructions.

• 1. When information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’ is deposited with a parliamentary body/office-holder other than the CIU, the secretariat of that parliamentary body/office-holder shall ensure that consultation and handling of the information in question complies with Article 7(3), Article 8(1), (2) and (4), Article 9(3), (4) and (5), Article 10(2) to (6), and Article 11 of this Decision and the appropriate handling instructions.

• 1. When information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET, or its equivalent has to be consulted in the Secure Area, the CIU shall ensure that consultation and handling of the information in question complies with Articles 9 and 10 of this Decision and the appropriate handling instructions.

G. TECHNICAL SECURITY

• 1. Technical security measures are the responsibility of the SAA, who shall determine in the appropriate handling instructions the specific technical security measures which are to apply.

• 1. Secure Reading Rooms for consultation of information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and of ‘other confidential information’ shall comply with specific technical security measures, as provided for in the handling instructions.

• 1. The Secure Area shall comprise the following facilities:

• (a) a Security Access Screening Room (SAS), to be installed in accordance with the technical security measures laid down in the handling instructions. Access to this facility shall be registered. The SAS shall meet high standards in terms of identification of persons with access, video registering, and secure space in which to deposit personal elements that are not allowed in the secured rooms (telephones, pens, etc.);

• (b) a communication room for transmission and receipt of classified information, including encrypted classified information, in accordance with security notice 3 and the respective handling instructions;

• (c) a secure archive, in which approved and certified containers shall be used separately for information classified at the level RESTREINT UE/EU RESTRICTED, CONFIDENTIEL UE/EU CONFIDENTIAL and/or SECRET EU/EU SECRET or its equivalent. Information classified at the level TRES SECRET UE/EU TOP SECRET or its equivalent shall be placed in a separate room in a specific certified container. The only additional material available in that separate room shall be the support desk for handling the archive by the CIU;

• (d) a registry room, which shall provide the tools needed to ensure that registration can be done on paper or electronically and shall thus be equipped with the secure facilities needed for the installation of the appropriate CIS. Only the registry room may contain approved and accredited reproduction devices (for making copies in paper or electronic form). The handling instructions shall specify which reproduction devices are approved and accredited. The registry room shall also provide the space needed in order for accredited material to be stored and handled so as to allow for the marking, copying and dispatching of classified information in physical form, by level of classification. All accredited material shall be defined by the CIU and accredited by the SAA, in accordance with the advice received from the IAOA. The registry room shall also be equipped with the accredited destruction device approved for the highest level of classification, as described in the handling instructions. Translation of information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL EU, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET or its equivalent shall be done in the registry room, in the appropriate and accredited system. The registry room shall provide work stations for up to two translators at a time and for the same document. One staff member of the CIU shall be present;

• (e) a reading room, for individual consultation of classified information by duly authorised persons. The reading room shall have enough space for two persons, including a staff member of the CIU who shall be present throughout each consultation. The security level of this room shall be adequate for the consultation of information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET or its equivalent. The reading room may be equipped with TEMPEST equipment so as to allow for electronic consultation, when needed, in accordance with the level of classification of the information concerned;

• (f) a meeting room, which shall be able to accommodate up to 25 persons for the purposes of discussing information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET EU/EU SECRET or its equivalent. The meeting room shall provide the necessary technical secure and certified facilities for interpretation into and out of up to two languages. When not used for meetings, the meeting room may also be used as an additional reading room for individual consultation. In exceptional cases, the CIU may allow more than one authorised person to consult classified information, as long as the level of clearance and the need to know is the same for all persons in the room. No more than four persons shall be allowed to consult classified information at the same time. The presence of CIU officials shall be reinforced;

• (g) technical secured rooms for lodging all technical equipment, linked to the security of the entire Secure Area, and the secured IT servers.

• 1. The Secure Area shall comply with the applicable international security standards and shall be certified by the Directorate for Security and Risk Assessment. The Secure Area shall contain the following minimum security technical equipment:

• (a) alarm and monitoring security systems;

• (b) safety equipment and emergency systems (two-way warning system);

• (c) a CCTV system;

• (d) an intrusion detection system;

• (e) access control (including a biometric security system);

• (f) containers;

• (g) lockers;

• (h) anti-electromagnetic protection.

• 1. Where additional technical security measures are needed, these may be added by the SAA, acting in close cooperation with the CIU and with the approval of the SA.

• 1. The infrastructure equipment may be connected to the general management systems of the building in which the Secure Area is located. However, the security equipment dedicated to access control and to the CIS shall be independent from any other such systems existing within the European Parliament.

H. INSPECTIONS OF THE SECURE AREA

• 1. Inspections of the Secure Area shall be carried out regularly by the SAA and at the request of the CIU.

• 1. The SAA shall draw up and keep updated the security inspection checklist of items to be verified in the course of an inspection, in line with handling instructions.

I. TRANSPORTATION OF CONFIDENTIAL INFORMATION

• 1. When carried, confidential information shall be concealed from view and shall give no indication of the confidential nature of its content, in accordance with the handling instructions.

• 1. Only messengers or staff with the appropriate level of security authorisation may carry information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET or its equivalent.

• 1. Confidential information may only be despatched by external mail or carried by hand outside a building in accordance with the conditions laid down in the handling instructions.

• 1. Information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET or its equivalent shall never be sent by e-mail or fax, even via a ‘secure’ e-mail system or a crypto-fax machine. Information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and other confidential information may be send by e-mail using an accredited encryption system.

J. STORAGE OF CONFIDENTIAL INFORMATION

• 1. The classification or marking level assigned to confidential information shall determine the level of protection afforded to it with a view to its storage. It shall be stored in the equipment certified for that purpose, in accordance with the handling instructions.

• 1. Information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’ shall:

• (a) be stored in a standard-issue, steel, locked, cupboard, either within an office or in a working area, when it is not actually being used;

• (b) not be left unattended, unless properly locked and stored;

• (c) not be left on a desk, table, etc. in such a way that it may be read or removed by any non-authorised individuals, e.g. visitors, cleaners, maintenance personnel, etc.;

• (d) not be shown to, or discussed with, any non-authorised individual.

• 1. Information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’ shall be stored only within the secretariats of the parliamentary bodies/office-holders, or in the CIU, in accordance with the handling instructions.

• 1. Information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET or its equivalent shall:

• (a) be stored in the Secure Area, in a security container or in a strongroom. Exceptionally, for example if the CIU is closed, it may be stored in an approved and certified safe deposit within the security services;

• (b) not be left unattended within the Secure Area at any time, without first having been locked in an approved safe (even for the briefest of absences);

• (c) not be left on a desk, table etc in such a way that it may be read or removed by a non-authorised person, even if the responsible staff member of the CIU remains in the room.

Where a document containing classified information is being produced in electronic form within the Secure Area, the computer shall be locked, and the screen rendered inaccessible if the originator or the responsible staff member of the CIU leaves the room (even for the briefest of absences). An automatic security lock cutting in after a few minutes shall not be considered a sufficient measure.

SECURITY NOTICE 5

INDUSTRIAL SECURITY

A. INTRODUCTION

• 1. This security notice concerns classified information only.

• 1. It sets out provisions for implementing the common minimum standards of Part 1 of Annex I to this Decision.

• 1. ‘Industrial security’ is the application of measures to ensure the protection of classified information by contractors or subcontractors in pre-contract negotiations and throughout the life cycle of classified contracts. Such contracts shall not involve access to information classified at the level TRÈS SECRET UE/EU TOP SECRET.

• 1. The European Parliament, as contracting authority, shall ensure that the minimum standards on industrial security set out in this Decision, and referred to in the contract, are complied with when awarding classified contracts to industrial or other entities.

B. SECURITY ELEMENTS IN A CLASSIFIED CONTRACT

B.1.   Security Classification Guide (SCG)

• 1. Prior to launching a call for tenders or awarding a classified contract, the European Parliament, as the contracting authority, shall determine the security classification of any information to be provided to bidders and contractors, as well as the security classification of any information to be created by the contractor. For that purpose, it shall prepare a Security Classification Guide (SCG) to be used for the performance of the contract.

• 1. In order to determine the level of security classification of the various elements of a classified contract, the following principles shall apply:

• (a) in preparing an SCG, the European Parliament shall take into account all relevant security aspects, including the security classification assigned to information which is provided and approved by the originator of the information for use in respect of the contract;

• (b) the overall level of classification of the contract may not be lower than the highest level of classification of any of its elements.

• B.2. Security Aspects Letter (SAL)

• 1. The contract-specific security requirements shall be described in a Security Aspects Letter (SAL). The SAL shall, where appropriate, contain the SCG and shall be an integral part of a classified contract or sub-contract.

• 1. The SAL shall contain the provisions requiring the contractor and/or subcontractor to comply with the minimum standards laid down in this Decision. Non-compliance with those minimum standards may constitute grounds for termination of the contract.

• B.3. Programme/Project Security Instructions (PSI)

• 1. Depending on the scope of programmes or projects involving access to or the handling or storage of EUCI, specific Programme/Project Security Instructions (PSI) may be prepared by the contracting authority designated to manage the programme or project concerned.

C. FACILITY SECURITY CLEARANCE (FSC)

• 1. An FSC shall be granted by the NSA or any other competent security authority of a Member State to indicate, in accordance with national laws and regulations, that an industrial or other entity is capable of protecting EUCI at the level CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET or its equivalent within its facilities. Evidence of the grant of the FSC shall be presented to the European Parliament, as the contracting authority, before a contractor or subcontractor or potential contractor or subcontractor is provided with, or granted access to, EUCI.

• 1. An FSC shall:

• (a) evaluate the integrity of the industrial or other entity;

• (b) evaluate ownership, control, and/or any potential for undue influence that may be considered a security risk;

• (c) verify that the industrial or any other entity has established a security system at its facility which covers all appropriate security measures necessary for the protection of information or material classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET in accordance with the requirements laid down in this Decision;

• (d) verify that the personnel security status of management, owners and employees who are required to have access to information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET has been established in accordance with the requirements laid down in this Decision; and

• (e) verify that the industrial or any other entity has appointed a Facility Security Officer who is responsible to its management for enforcing the security obligations within such an entity.

• 1. Where relevant, the European Parliament, as the contracting authority, shall notify the appropriate NSA or other competent security authority that an FSC is required at the pre-contractual stage or for the performance of the contract. An FSC or Personal Security Clearance (PSC) shall be required at the pre-contractual stage where information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET has to be provided in the course of the bidding process.

• 1. The contracting authority shall not award a classified contract to a preferred bidder until it has received confirmation from an NSA or other competent security authority of the Member State in which the contractor or subcontractor concerned is registered that, where required, an appropriate FSC has been issued.

• 1. Any competent security authority which has issued an FSC shall notify the European Parliament, as contracting authority, about any changes affecting that FSC. In the case of a sub-contract, the competent security authority shall be informed accordingly.

• 1. Withdrawal of an FSC by the relevant NSA or other competent security authority shall constitute sufficient grounds for the European Parliament, as the contracting authority, to terminate a classified contract or exclude a bidder from the competition.

D. CLASSIFIED CONTRACTS AND SUBCONTRACTS

• 1. Where classified information is provided to potential bidders at the pre-contractual stage, the invitation to bid shall contain a provision obliging any of them that fail to submit a bid or that are not selected to return all classified documents within a specified period.

• 1. Once a classified contract or subcontract has been awarded, the European Parliament, as the contracting authority, shall notify the NSA of the contractor or subcontractor and/or any other competent security authority about the security provisions of the classified contract.

• 1. Upon the termination of such a contract, the European Parliament, as the contracting authority (and/or the competent security authority, as appropriate, in the case of a subcontract) shall promptly notify the NSA or any other competent security authority of the Member State in which the contractor or subcontractor is registered.

• 1. As a general rule, the contractor or subcontractor shall be required, upon termination of the classified contract or subcontract, to return to the contracting authority any classified information held by it.

• 1. Specific provisions for the disposal of classified information during the performance of the contract or upon its termination shall be laid down in the SAL.

• 1. Where the contractor or subcontractor is authorised to retain classified information after termination of a contract, the minimum standards contained in this Decision shall continue to apply and the confidentiality of EUCI shall be protected by the contractor or subcontractor.

• 1. The conditions under which the contractor may subcontract shall be defined in the call for tenders and in the contract.

• 1. A contractor shall obtain permission from the European Parliament, as the contracting authority, before subcontracting any parts of a classified contract. No subcontract may be awarded to industrial or other entities registered in a third State which has not concluded a security of information agreement with the Union.

• 1. The contractor shall be responsible for ensuring that all subcontracting activities are undertaken in accordance with the minimum standards laid down in this Decision and shall not provide EUCI to a subcontractor without the prior written consent of the contracting authority.

• 1. With regard to classified information created or handled by the contractor or subcontractor, the rights vested in the originator shall be exercised by the contracting authority.

E. VISITS IN CONNECTION WITH CLASSIFIED CONTRACTS

• 1. Where the European Parliament, contractors or subcontractors require access to information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET in each other's premises for the performance of a classified contract, visits shall be arranged in liaison with the NSAs or any other competent security authority concerned. However, in the context of specific projects, the NSAs may also agree on a procedure whereby such visits can be arranged directly.

• 1. All visitors shall hold an appropriate PSC and have a ‘need to know’ for access to the classified information related to the European Parliament contract.

• 1. Visitors shall be given access only to classified information which relates to the purpose of the visit.

F. TRANSMISSION AND CARRIAGE OF CLASSIFIED INFORMATION

• 1. With regard to the transmission of classified information by electronic means, the relevant provisions of security notice 3 shall apply.

• 1. With regard to the transport of classified information, the relevant provisions of security notice 4 and the relevant handling instructions shall apply.

• 1. For the transport of classified material as freight, the following principles shall be applied when determining security arrangements:

• (a) security shall be assured at all stages during transportation from the point of origin to the final destination;

• (b) the degree of protection afforded to a consignment shall be determined by the highest classification level of material contained within it;

• (c) an FSC at the appropriate level shall be obtained for companies providing transportation. In such cases, personnel handling the consignment shall be security cleared in accordance with Annex I;

• (d) prior to any cross-border movement of material classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL or as SECRET UE/EU SECRET or its equivalent, a transportation plan shall be drawn up by the consignor and approved by the Secretary-General;

• (e) journeys shall as far as possible be undertaken from a given point of departure to a given destination point, and shall be completed as quickly as circumstances permit;

• (f) the route taken shall wherever possible pass through the territory of Member States.

G. TRANSFER OF CLASSIFIED INFORMATION TO CONTRACTORS LOCATED IN THIRD STATES