Decision of the High Representative of the Union for Foreign Affairs and Security Policy of 19 June 2023 on the security rules for the European External Action Service 2023/C 263/04

• 9.For EEAS Staff, the EEAS Security Authority shall forward the completed personnel security questionnaire to the NSA of the Member State of which the individual is a national requesting that a security investigation be undertaken for the level of EUCI to which the individual will require access.

• 10.Where an individual holds citizenship of more than one country, the vetting request will be addressed to the NSA of the country under whose nationality the person has been recruited.

• 11.Where information relevant for a security investigation becomes known to the EEAS concerning an individual who has applied for a PSC, the EEAS, acting in accordance with the relevant rules and regulations, shall notify the relevant NSA thereof.

• 12.Following completion of the security investigation, the relevant NSA shall notify the EEAS Directorate responsible for HQ security and EEAS information security of the outcome of such an investigation.

• (a) Where the security investigation results in an assurance that nothing adverse is known which would call into question the loyalty, trustworthiness and reliability of the individual, the EEAS Security Authority may grant the individual concerned an Authorisation to access EUCI up to the relevant level until a specified date;

• (b) The EEAS shall take all appropriate measures to ensure that conditions or restrictions imposed by the NSA are duly implemented. The NSA will be informed about the outcome.

• (c) Where the security investigation does not result in such an assurance, the EEAS Security Authority shall notify the individual concerned, who may ask to be heard by the EEAS Security Authority. The EEAS Security Authority may ask the competent NSA for any further clarification it can provide according to its national laws and regulations. If the outcome is confirmed, an Authorisation to access EUCI shall not be granted. In that case EEAS shall take all appropriate measures to ensure that the applicant will be denied any access to EUCI.

• 13.The security investigation together with the results obtained, on which the EEAS Security Authority bases its decision on whether or not to grant an authorisation to access EUCI, shall be subject to the relevant laws and regulations in force in the Member State concerned, including those concerning appeals. The decisions of the EEAS Security Authority may be subject to appeals in the conditions foreseen in Article 90 and 91 of the Staff Regulations.

• 14.The assurance on which a PSC is based, provided it remains valid, shall cover any assignment by the individual concerned within the EEAS, the General Secretariat of the Council or the Commission.

• 15.The EEAS shall accept the authorisation for access to EUCI granted by any other European Union Institution, Body or Agency provided it remains valid. Authorisations shall cover any assignment by the individual concerned within the EEAS. The European Union Institution, Body or Agency in which the individual is taking up employment will notify the relevant NSA of the change of employer.

• 16.If an individual’s period of service does not commence within 12 months of the notification of the outcome of the security investigation to the EEAS Security Authority, or if there is a break of 12 months or more in an individual’s service, during which time he has not been employed in the EEAS, in other EU Institutions, agencies or bodies, or in a position with a national administration of a Member State, which requires access to classified information, this outcome shall be referred to the relevant NSA for confirmation that it remains valid and appropriate.

• 17.Where information becomes known to the EEAS concerning a security risk posed by an individual who holds a valid PSC, the EEAS, acting in accordance with the relevant rules and regulations, shall notify the relevant NSA thereof and may suspend access to EUCI or withdraw authorisation for access to EUCI. Where an NSA notifies the EEAS of withdrawal of an assurance given in accordance with paragraph 12(a) for an individual who holds a valid Authorisation to access EUCI, the EEAS Security Authority may ask for any clarification the NSA can provide according to its national laws and regulations. If the adverse information is confirmed, the aforementioned Authorisation shall be withdrawn and the individual shall be excluded from access to EUCI and from positions where such access is possible or where he might endanger security.

• 18.Any decision to withdraw an Authorisation to access EUCI from an EEAS staff member and, where appropriate, the reasons for doing so shall be notified to the individual concerned, who may ask to be heard by the EEAS Security Authority. Information provided by an NSA shall be subject to the relevant laws and regulations in force in the Member State concerned, including those concerning appeals. The decisions of the EEAS Security Authority may be subject to appeals in the conditions foreseen in Article 90 and 91 of the Staff Regulations.

• 19.National experts seconded to the EEAS for a position requiring access to classified information CONFIDENTIEL UE/EU CONFIDENTIAL or above shall present a valid PSC for access to EUCI to the relevant level to the EEAS Security Authority prior to taking up their assignment. The above process shall be managed by the sending Member State.

Records of PSCs

• 20.A database on the security clearance status of all staff placed under the responsibility of the EEAS and of EEAS contractors’ personnel shall be maintained by the EEAS Directorate responsible for HQ security and EEAS information security. These records shall include the level of EUCI to which the individual may be granted access (CONFIDENTIEL UE/EU CONFIDENTIAL or above), the date the PSC was granted and its period of validity.

• 21.Appropriate coordination procedures shall be put in place with Member States and other EU Institutions, agencies and bodies to ensure that the EEAS holds an accurate and comprehensive record of security clearance status of all Staff placed under the responsibility of the EEAS and of EEAS contractors’ personnel.

• 22.The EEAS Security Authority may issue a Personnel Security Clearance Certificate (PSCC) showing the level of EUCI to which the individual may be granted access (CONFIDENTIEL UE/EU CONFIDENTIAL or above), the date of validity of the relevant PSC or Authorisation and the date of expiry of the certificate itself.

Exemptions from the PSC requirement

• 23.Individuals duly authorised to access EUCI by virtue of their functions in accordance with national laws and regulations shall be briefed, as appropriate, by the Directorate responsible for HQ security and EEAS information security on their security obligations in respect of protecting EUCI.

III.   SECURITY EDUCATION AND AWARENESS

• 24.Prior to being authorised to access EUCI, all individuals shall acknowledge in writing that they have understood their obligations in respect of protecting EUCI and the consequences if EUCI is compromised. A record of such a written acknowledgement shall be kept by the Directorate responsible for HQ security and EEAS information security.

• 25.All individuals who are authorised to have access to, or required to handle EUCI, shall initially be made aware of, and periodically briefed on the threats to security and must report immediately to the appropriate Department/Delegation Security Coordinators and to the Directorate responsible for HQ security and EEAS information security any approach or activity that they consider suspicious or unusual.

• 26.All individuals granted access to EUCI must be subject to ongoing personnel security measures (i.e. aftercare) for the duration that they handle EUCI. Ongoing personnel security is the responsibility of:

• (a) Individuals granted access to EUCI: Individuals are personally responsible for their own security conduct and must report immediately to the appropriate security authorities any approach or activity that they consider suspicious or unusual, and any changes in their personal circumstances that may have an impact on their PSC or Authorisation to access EUCI.

• (b) Line managers: They are responsible for the determination of the individual’s need to know and for ensuring that their staff are aware of the security measures and responsibilities to protect EUCI, for monitoring the security conduct of their staff and for either addressing any security matters of concern themselves, or reporting to the appropriate security authorities any adverse information that may have an impact on their staff's PSC or Authorisation to access EUCI.

• (c) Security actors of the EEAS security organisation as referred to in Article 12 of this decision: They are responsible for providing security awareness briefings to ensure staff in their area are periodically briefed, for fostering a strong security culture in their area of responsibility, for putting in place measures to monitor the security conduct of staff, and for reporting to the appropriate security authorities any adverse information that may have an impact on any individual's PSC.

• (d) EEAS and Member States: shall put in place the necessary channels to communicate information that may have an impact on any individual's PSC or Authorisation to access EUCI.

• 27.All individuals who cease to be employed on duties requiring access to EUCI shall be made aware of, and where appropriate acknowledge in writing, their obligations in respect of the continued protection of EUCI.

IV.   EXCEPTIONAL CIRCUMSTANCES

• 28.For reasons of urgency, where duly justified in the interests of the EEAS and pending completion of a full security investigation, the EEAS Security Authority may, after consulting the NSA of the Member State of which the individual is a national and subject to the outcome of preliminary checks to verify that no adverse information is known, grant a temporary authorisation for EEAS officials and other servants to access EUCI for a specific function. A full security investigation should be completed as soon as possible. Such temporary authorisations will be valid for a period not exceeding six months and shall not permit access to information classified TRES SECRET UE/EU TOP SECRET. All individuals who have been granted a temporary authorisation shall acknowledge in writing that they have understood their obligations in respect of protecting EUCI and the consequences if EUCI is compromised. A record of such a written acknowledgement shall be kept by the Directorate responsible for HQ security and EEAS information security.

• 29.When an individual is to be assigned to a position that requires a PSC at one level higher than that currently possessed by the individual, the assignment may be made on a provisional basis, provided that:

• (a) the compelling need for access to EUCI at a higher level shall be justified, in writing, by the individual's respective Line Manager at the level of Director/Managing Director/Head of Delegation, as appropriate;

• (b) access shall be limited to specific items of EUCI in support of the assignment;

• (c) the individual holds a valid PSC;

• (d) action has been initiated to obtain authorisation for the level of access required for the position;

• (e) satisfactory checks have been made by the competent authority that the individual has not seriously or repeatedly infringed security regulations;

• (f) the assignment of the individual is approved by the competent EEAS authority;

• (g) the relevant NSA/DSA which issued the individual's PSC has been consulted and no objection has been received; and

• (h) a record of the exception, including a description of the information to which access was approved, is kept by the registry or subordinate registry responsible.

• 30.The above procedure shall be used for one-time access to EUCI at one level higher than that to which the individual has been security cleared. Recourse to this procedure shall not be made on a recurring basis.

• 31.In very exceptional circumstances, such as missions in hostile environments or during periods of mounting international tension when emergency measures require it, in particular for the purposes of saving lives, the HR, the EEAS Security Authority or the Director General for Resources Management, may grant, where possible in writing, access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET to individuals who do not possess the requisite PSC, provided that such permission is absolutely necessary. A record shall be kept by the Directorate responsible for HQ Security and EEAS Information Security of this permission describing the information to which access was approved.

• 32.In the case of information classified TRES SECRET UE/EU TOP SECRET, this emergency access shall be confined to EU nationals who have been authorised access to either the national equivalent of TRES SECRET UE/EU TOP SECRET or information classified SECRET UE/EU SECRET.

• 33.The EEAS Security Committee shall be informed of cases when recourse is made to the procedure set out in paragraphs 31 and 32.

• 34.The EEAS Security Committee shall receive an annual report on recourse to the procedures set out in this section.

V. ATTENDANCE AT MEETINGS IN THE EEAS HEADQUARTERS AND UNION DELEGATIONS.

• 35.Individuals assigned to participate in meetings in the EEAS Headquarters and Union Delegations at which information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above is discussed may only do so upon confirmation of the individual’s PSC status. For Member States’ representatives, officials from the General Secretariat of the Council and the Commission, a PSCC or other proof of PSC shall be forwarded by the appropriate authorities to the Directorate responsible for HQ security and EEAS information security, the Union Delegation Security Coordinator, or exceptionally be presented by the person concerned. Where applicable, a consolidated list of names may be used, giving the relevant proof of PSC.

• 36.Where a PSC for access to EUCI is withdrawn from an individual whose duties require attendance at meetings in the EEAS Headquarters or Union Delegation at which information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above is discussed, the Directorate responsible for HQ security and EEAS information security shall be informed by the competent authority thereof.

VI.   POTENTIAL ACCESS TO EUCI

• 37.When individuals are to be employed in circumstances in which they may potentially have access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above, they shall be appropriately security cleared or escorted at all times.

• 38.Couriers, guards and escorts shall be security cleared to the relevant level or otherwise appropriately investigated in accordance with national laws and regulations, be briefed at regular intervals on security procedures for protecting EUCI and on their duties for protecting such information entrusted to them or to which they may inadvertently have access.

ANNEX A II

PHYSICAL SECURITY OF EU CLASSIFIED INFORMATION

I. INTRODUCTION

• 1.This Annex sets out provisions for implementing Article 6 of Annex A. It lays down minimum requirements for the physical protection of premises, buildings, offices, rooms and other areas where EUCI is handled and stored, including areas housing CIS.

• 2.Physical security measures shall be designed to prevent unauthorised access to EUCI by:

• (a) ensuring that EUCI is handled and stored in an appropriate manner;

• (b) allowing for segregation of personnel in terms of access to EUCI on the basis of their need-to-know and, where appropriate, their security clearance;

• (c) deterring, impeding and detecting unauthorised actions; and

• (d) denying or delaying surreptitious or forced entry by intruders.

II   PHYSICAL SECURITY REQUIREMENTS AND MEASURES

• 3.The EEAS shall apply a risk management process for protecting EUCI on their premises to ensure that a commensurate level of physical protection is afforded against the assessed risk. The risk management process shall take account of all relevant factors, in particular:

• (a) the classification level of EUCI;

• (b) the form and volume of EUCI, bearing in mind that large quantities or a compilation of EUCI may require more stringent protective measures to be applied;

• (c) the surrounding environment and structure of the buildings or areas housing EUCI;

• (d) the third country threat assessment as developed by INTCEN, the counter-intelligence cell of the Directorate responsible for HQ security and EEAS information security and on the basis in particular of Union Delegation reports, and

• (e) the assessed threat from intelligence services which target the EU or Member States and from sabotage, terrorist, subversive or other criminal activities.

• 4.The EEAS Security Authority, applying the concept of defence in depth, shall determine the appropriate combination of physical security measures to be implemented. These can include one or more of the following:

• (a) a perimeter barrier: a physical barrier which defends the boundary of an area requiring protection;

• (b) Intrusion Detection Systems (IDS): an IDS may be used to enhance the level of security offered by a perimeter barrier, or in rooms and buildings in place of, or to assist, security staff;

• (c) access control: access control may be exercised over a site, a building or buildings on a site or to areas or rooms within a building. Control may be exercised by electronic or electro-mechanical means, by security personnel and/or a receptionist, or by any other physical means;

• (d) security personnel: trained, supervised and, where necessary, appropriately security cleared security personnel may be employed, inter alia, in order to deter individuals planning covert intrusion;

• (e) Closed Circuit Television (CCTV): CCTV may be used by security personnel in order to verify incidents and IDS alarms on large sites or at perimeters;

• (f) security lighting: security lighting may be used to deter a potential intruder, as well as to provide the illumination necessary for effective surveillance directly by security personnel or indirectly through a CCTV system; and

• (g) any other appropriate physical measures designed to deter or detect unauthorised access or prevent loss of or damage to EUCI.

• 5.The Directorate responsible for HQ security and EEAS information security may conduct entry and exit searches to act as a deterrent to the unauthorised introduction of material or the unauthorised removal of EUCI from premises or buildings.

• 6.When EUCI is at risk from overlooking, even accidentally, appropriate measures shall be taken to counter this risk.

• 7.For new facilities, physical security requirements and their functional specifications shall be defined as part of the planning and design of the facilities. For existing facilities, physical security requirements shall be implemented to the maximum extent possible.

III.   EQUIPMENT FOR THE PHYSICAL PROTECTION OF EUCI

• 8.When acquiring equipment (such as security containers, shredding machines, door locks, CCTV, electronic access control systems, IDS, alarm systems) for the physical protection of EUCI, the EEAS Security Authority shall ensure that the equipment meets approved technical standards and minimum requirements.

• 9.The technical specifications of equipment to be used for the physical protection of EUCI shall be set out in security guidelines to be approved by the EEAS Security Committee.

• 10.Security systems shall be inspected at regular intervals and equipment shall be maintained regularly. Maintenance work shall take account of the outcome of inspections to ensure that equipment continues to operate at optimum performance.

• 11.The effectiveness of individual security measures and of the overall security system shall be re-evaluated during each inspection.

IV.   PHYSICALLY PROTECTED AREAS

• 12.Two types of physically protected areas, or the national equivalents thereof, shall be established for the physical protection of EUCI:

• (a) Administrative Areas and

• (b) Secured Areas (including technically Secured Areas).

• 13.The EEAS Security Authority shall establish that an area meets the requirements to be designated as an Administrative Area, a Secured Area or a technically Secured Area.

• 14.For Administrative Areas:

• (a) a visibly defined perimeter shall be established which allows individuals and, where possible, vehicles to be checked;

• (b) unescorted access shall be granted only to individuals who are duly authorised, in HQ by the Directorate responsible for HQ security and EEAS information security, and, in Union Delegations by the Head of Delegation; and

• (c) all other individuals shall be escorted at all times or be subject to equivalent controls.

• 15.For Secured Areas:

• (a) a visibly defined and protected perimeter shall be established through which all entry and exit are controlled by means of a pass or personal recognition system;

• (b) unescorted access shall be granted only to individuals who are security-cleared to the appropriate level and specifically authorised to enter the area on the basis of their need-to-know;

• (c) all other individuals shall be escorted at all times or be subject to equivalent controls.

• 16.Where entry into a Secured Area constitutes, for all practical purposes, direct access to the classified information contained in it, the following additional requirements shall apply:

• (a) the level of highest security classification of the information normally held in the area shall be clearly indicated;

• (b) all visitors shall require specific authorisation to enter the area, shall be escorted at all times and shall be appropriately security cleared unless steps are taken to ensure that no access to EUCI is possible;

• (c) all electronic devices shall be left outside the area.

• 17.Secured Areas protected against eavesdropping shall be designated technically Secured Areas. The following additional requirements shall apply:

• (a) such areas shall be IDS equipped, be locked when not occupied and be guarded when occupied. Any keys shall be controlled in accordance with Section VI of this Annex;

• (b) all persons and material entering such areas shall be controlled;

• (c) such areas shall be regularly physically and/or technically inspected as required by the Directorate responsible for HQ Security and EEAS information security. Such inspections shall also be conducted following any unauthorised entry or suspicion of such an entry; and

• (d) such areas shall be free of unauthorised communication lines, unauthorised telephones or other unauthorised communication devices and electrical or electronic equipment;

• 18.Notwithstanding point (d) of paragraph 17, before being used in areas where meetings are held or work is being performed involving information classified SECRET UE/EU SECRET and above, and where the threat to EUCI is assessed as high, any communications devices and electrical or electronic equipment shall first be examined by the Technical Security Counter Measures (TSCM) team within the Directorate responsible for HQ security and EEAS information security to ensure that no intelligible information can be inadvertently or illicitly transmitted by such equipment beyond the perimeter of the Secured Area.

• 19.Secured Areas which are not occupied by duty personnel on a 24-hour basis shall, where appropriate, be inspected at the end of normal working hours and at random intervals outside normal working hours, unless an IDS is in place.

• 20.Secured Areas and technically Secured Areas may be set up temporarily within an Administrative Area for a classified meeting or any other similar purpose.

• 21.Security Operating Procedures (SecOPs) shall be drawn up for each Secured Area stipulating:

• (a) the level of EUCI which may be handled and stored in the area;

• (b) the surveillance and protective measures to be maintained;

• (c) the individuals authorised to have unescorted access to the area by virtue of their need-to-know and security clearance;

• (d) where appropriate, the procedures for escorts or for protecting EUCI when authorising any other individuals to access the area;

• (e) any other relevant measures and procedures.

• 22.Strong rooms, where needed, shall be constructed within Secured Areas. The walls, floors, ceilings, windows and lockable doors shall be approved by the EEAS Security Authority and afford protection equivalent to a security container approved for the storage of EUCI of the same classification level.

V. PHYSICAL PROTECTIVE MEASURES FOR HANDLING AND STORING EUCI

• 23.EUCI which is classified RESTREINT UE/EU RESTRICTED may be handled:

• (a) in a Secured Area,

• (b) in an Administrative Area provided the EUCI is protected from access by unauthorised individuals, or

• (c) outside a Secured Area or an Administrative Area provided the holder carries the EUCI in accordance with paragraphs 30 to 42 of Annex A III and has undertaken to comply with compensatory measures laid down in security instructions issued by the EEAS Security Authority, to ensure that EUCI is protected from access by unauthorised persons.

• 24.EUCI which is classified RESTREINT UE/EU RESTRICTED shall be stored in suitable locked office furniture in an Administrative Area or a Secured Area. It may temporarily be stored outside a Secured Area or an Administrative Area provided the holder has undertaken to comply with compensatory measures laid down in security instructions issued by the EEAS Security Authority.

• 25.EUCI which is classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET may be handled:

• (a) in a Secured Area;

• (b) in an Administrative Area provided the EUCI is protected from access by unauthorised individuals; or

• (c) outside a Secured Area or an Administrative Area provided the holder:
• (i) carries the EUCI in accordance with paragraphs 30 to 42 of Annex A III;
• (ii) has undertaken to comply with compensatory measures laid down in security instructions issued by the EEAS Security Authority, to ensure that EUCI is protected from access by unauthorised persons;
• (iii) keeps the EUCI at all times under his personal control; and
• (iv) in the case of documents in paper form, has notified the relevant registry of the fact.

• 26.EUCI which is classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET shall be stored within a Secured Area, in a security container or strong room.

• 27.EUCI which is classified TRES SECRET UE/EU TOP SECRET shall be handled in a Secured Area.

• 28.EUCI which is classified TRES SECRET UE/EU TOP SECRET shall be stored in a Secured Area at the Headquarters under one of the following conditions:

• (a) in a security container that is in accordance with paragraph 8 with one or more of the following supplementary controls:
• (i) continuous protection or verification by cleared security staff or duty personnel;
• (ii) an approved IDS in combination with security response personnel; or

• (b) in an IDS-equipped strong room in combination with security response personnel.

• 29.Rules governing the carriage of EUCI outside physically protected areas are set out in Annex A III.

VI.   CONTROL OF KEYS AND COMBINATIONS USED FOR PROTECTING EUCI

• 30.The EEAS Security Authority shall define procedures for managing keys and combination settings for offices, rooms, strong rooms and security containers within all EEAS premises. Such procedures shall protect against unauthorised access.

• 31.Combination settings shall be committed to memory by the smallest possible number of individuals needing to know them. Combination settings for security containers and strong rooms storing EUCI shall be changed:

• (a) on receipt of a new container;

• (b) whenever there is a change in personnel knowing the combination;

• (c) whenever a compromise has occurred or is suspected;

• (d) when a lock has undergone maintenance or repair; and

• (e) at least every 12 months.

ANNEX A III

MANAGEMENT OF CLASSIFIED INFORMATION

I. INTRODUCTION

• 1.This Annex sets out provisions for implementing Article 7 of Annex A. It lays down the administrative measures for controlling EUCI throughout its life-cycle in order to help deter, detect and recover from deliberate or accidental compromise or loss of such information.

II.   CLASSIFICATION MANAGEMENT

Classifications and markings

• 2.Information shall be classified where it requires protection with regard to its confidentiality.

• 3.The originator of EUCI shall be responsible for determining the security classification level, applying the appropriate security classification marking, determining the dissemination of the information to the intended recipients, applying the appropriate releasability marking, in accordance with the relevant EEAS Guidelines on Creating and Handling EUCI.

• 4.The classification level of EUCI shall be determined in accordance with Article 2(2) of Annex A and by reference to the security Guidelines to be approved in accordance with Article 3(3) of Annex A.

• 5.Classified information of the Member States exchanged with the EEAS shall be afforded the same level of protection as EUCI bearing the equivalent classification. A table of equivalence can be found in Appendix B to this decision.

• 6.The security classification and, where applicable, the date or specific event after which it may be downgraded or declassified, shall be clearly and correctly indicated, regardless of whether the EUCI is in paper, oral, electronic or any other form.

• 7.Individual parts of a given document (i.e. pages, paragraphs, sections, annexes, appendices, attachments and enclosures) may require different classifications and shall be marked accordingly, including when stored in electronic form.

• 8.To the extent possible, documents containing parts with different classification levels shall be structured so that parts with a different classification level may be easily identified and detached if necessary.

• 9.The overall classification level of a document or file shall be at least as high as that of its most highly classified component. When information from various sources is collated, the final product shall be reviewed to determine its overall security classification level, since it may warrant a higher classification than its component parts.

• 10.The classification of a letter or note covering enclosures shall be as high as the highest classification of its enclosures. The originator shall indicate clearly at which level it is classified when detached from its enclosures by means of an appropriate marking, e.g.:

CONFIDENTIEL UE/EU CONFIDENTIAL Without attachment(s) RESTREINT UE/EU RESTRICTED

Markings

• 11.In addition to one of the security classification markings set out in Article 2(2) of Annex A, EUCI may bear additional markings, such as:

• (a) an identifier to designate the originator;

• (b) any caveats, code words or acronyms specifying the field of activity to which the document relates, a particular distribution on a need-to-know basis or restrictions on use;

• (c) releasability markings.

• 12.Following a decision to release EUCI to a third State or International Organisation, the Directorate responsible for HQ security and EEAS information security shall forward the classified information concerned, which shall bear a releasability marking indicating the third State or international organisation to which it is to be released.

• 13.A list of authorised markings will be adopted by the EEAS Security Authority.

Abbreviated classification markings

• 14.Standardised abbreviated classification markings may be used to indicate the classification level of individual paragraphs of a text. Abbreviations shall not replace the full classification markings.

• 15.The following standard abbreviations may be used within EU classified documents to indicate the classification level of sections or blocks of text of less than a single page:

TRES SECRET UE/EU TOP SECRET	TS-UE/EU-TS
SECRET UE/EU SECRET	S-UE/EU-S
CONFIDENTIEL UE/EU CONFIDENTIAL	C-UE/EU-C
RESTREINT UE/EU RESTRICTED	R-UE/EU-R

Creation of EUCI

• 16.When creating an EU classified document:

• (a) each page shall be marked clearly with the classification level;

• (b) each page shall be numbered;

• (c) the document shall bear a reference number and a subject, which is not itself classified information, unless it is marked as such;

• (d) the document shall be dated;

• (e) documents classified CONFIDENTIEL UE/EU CONFIDENTIAL or above shall bear a copy number on every page, if they are to be distributed in several copies.

• 17.Where it is not possible to apply paragraph 16 to EUCI, other appropriate measures shall be taken in accordance with security guidelines to be established pursuant to this Decision.

Downgrading and declassification of EUCI

• 18.At the time of its creation, the originator shall indicate, where possible, and in particular for information classified RESTREINT UE/EU RESTRICTED, whether EUCI can be downgraded or declassified on a given date or following a specific event.

• 19.The EEAS shall regularly review EUCI held by it to ascertain whether the classification level still applies. The EEAS shall establish a system to review the classification level of registered EUCI that it has originated no less frequently than every five years. Such a review shall not be necessary where the originator has indicated from the outset a specific time when the information will automatically be downgraded or declassified and the information has been marked accordingly.

III.   REGISTRATION OF EUCI FOR SECURITY PURPOSES

• 20.A central registry shall be established in Headquarters. For every organisational entity within the EEAS in which EUCI is handled, a responsible registry shall be established, subordinated to the central registry, to ensure that EUCI is handled in accordance with this Decision. Registries shall be established as Secured Areas as defined in Annex A.

• Each Union Delegation establishes its own EUCI registry.

• The EEAS Security Authority shall designate a Chief Registry Officer for these registries.

• 21.For the purposes of this Decision, registration for security purposes (hereinafter referred to as ‘registration’) means the application of procedures that record the life-cycle of information, including its dissemination and destruction. In the case of a CIS, registration procedures may be performed by processes within the CIS itself.

• 22.All material classified CONFIDENTIEL UE/EU CONFIDENTIAL and above shall be registered when it arrives at or leaves an organisational entity including Union Delegations. Information classified TRES SECRET UE/EU TOP SECRET shall be registered in designated registries.

• 23.The Central Registry shall be, in EEAS Headquarters, the main point of entry and exit for classified information exchanges with third States and international organisations. It shall keep a record of all these exchanges.

• 24.The EEAS Security Authority shall approve security Guidelines on the registration of EUCI for security purposes, in accordance with article 14 of this Decision.

TRES SECRET UE/EU TOP SECRET registries

• 25.The Central Registry shall be designated in the EEAS Headquarters to act as the central receiving and dispatching authority for information classified TRES SECRET UE/EU TOP SECRET. Where necessary, subordinate registries may be designated to handle such information for registration purposes.

• 26.Such subordinate registries may not transmit TRES SECRET UE/EU TOP SECRET documents directly to other subordinate registries of the same central TRES SECRET UE/EU TOP SECRET registry or externally without the express written approval of the latter.

IV.   COPYING AND TRANSLATING EU CLASSIFIED DOCUMENTS

• 27.TRES SECRET UE/EU TOP SECRET documents shall not be copied or translated without the prior written consent of the originator.

• 28.Where the originator of documents classified SECRET UE/EU SECRET and below has not imposed caveats on their copying or translation, such documents may be copied or translated on instruction from the holder.

• 29.The security measures applicable to the original document shall apply to copies and translations thereof. The copies of CONFIDENTIEL UE/EU CONFIDENTIAL or above shall be created only by a relevant (sub) registry with a secured copy-machine. The copies must be registered.

V. CARRIAGE OF EUCI

• 30.Carriage of EUCI shall be subject to the protective measures set out in paragraphs 32 to 42. When EUCI is carried on electronic media, and notwithstanding Article 7(4) of Annex A, the protective measures set out below may be supplemented by appropriate technical countermeasures prescribed by the EEAS Security Authority, so as to minimise the risk of loss or compromise.

• 31.The EEAS Security Authority shall issue instructions on the carriage of EUCI in accordance with this Decision.

Within a building or self-contained group of buildings

• 32.EUCI carried within a building or self-contained group of buildings shall be covered in order to prevent observation of its contents.

• 33.Within a building or self-contained group of buildings, information classified TRES SECRET UE/EU TOP SECRET shall be carried by appropriately security cleared individuals, in a secured envelope bearing only the addressee’s name.

Within the EU

• 34.EUCI carried between buildings or premises within the EU shall be packaged so that it is protected from unauthorised disclosure.

• 35.The carriage of information classified up to SECRET UE/EU SECRET within the EU shall be by one of the following means:

• (a) military, government or diplomatic courier, as appropriate;

• (b) hand carriage, provided that:
• (i) EUCI does not leave the possession of the bearer, unless it is stored in accordance with the requirements set out in Annex A II;
• (ii) EUCI is not opened en route or read in public places;
• (iii) individuals are security cleared to the appropriate level and briefed on their security responsibilities;
• (iv) individuals are provided with a courier certificate where necessary;

• (c) postal services or commercial courier services, provided that:
• (i) they are approved by the relevant NSA in accordance with national laws and regulations;
• (ii) they apply appropriate protective measures in accordance with minimum requirements to be laid down in security guidelines pursuant to Article 21(1) of this Decision.

• In the case of carriage from one Member State to another, the provisions of point (c) shall be limited to information classified up to CONFIDENTIEL UE/EU CONFIDENTIAL.

• 36.Material classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET (e.g. equipment or machinery) which cannot be carried by the means referred to in paragraph 34 shall be transported as freight by commercial carrier companies in accordance with Annex A V.

• 37.The carriage of information classified TRES SECRET UE/EU TOP SECRET between buildings or premises within the EU shall be by military, government or diplomatic courier, as appropriate.

From within the EU to the territory of a third State, or between EU entities in third States

• 38.EUCI carried from within the EU to the territory of a third State, or between EU entities in third States, shall be packaged in such a way that it is protected from unauthorised disclosure.

• 39.The carriage of information classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET from within the EU to the territory of a third State, and the carriage of any EUCI classified up to SECRET UE/EU SECRET between EU entities in third States, shall be by one of the following means:

• (a) military or diplomatic courier;

• (b) hand carriage, provided that:
• (i) the package bears an official seal, or is packaged so as to indicate that it is an official consignment and should not undergo customs or security scrutiny;
• (ii) individuals carry a courier certificate identifying the package and authorising them to carry the package;
• (iii) EUCI does not leave the possession of the bearer, unless it is stored in accordance with the requirements set out in Annex A II;
• (iv) EUCI is not opened en route or read in public places; and
• (v) individuals are security cleared to the appropriate level and briefed on their security responsibilities.

• 40.The carriage of information classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET released by the EU to a third State or international organisation shall comply with the relevant provisions under a security of information Agreement or an administrative arrangement in accordance with Article 10(2) of Annex A.

• 41.Information classified RESTREINT UE/EU RESTRICTED may also be carried from within the EU to the territory of a third State by postal services or commercial courier services.

• 42.The carriage of information classified TRES SECRET UE/EU TOP SECRET from within the EU to the territory of a third State, or between EU entities in third States, shall be by military or diplomatic courier.

VI.   DESTRUCTION OF EUCI

• 43.EU classified documents that are no longer required may be destroyed, without prejudice to the relevant rules and regulations on archiving.

• 44.Documents subject to registration in accordance with Article 7(2) of Annex A shall be destroyed by the responsible registry on instruction from the holder or from a competent authority. The logbooks and other registration information shall be updated accordingly.

• 45.For documents classified SECRET UE/EU SECRET or TRES SECRET UE/EU TOP SECRET, destruction shall be performed in the presence of a witness who shall be cleared to at least the classification level of the document being destroyed.

• 46.The registrar and the witness, where the presence of the latter is required shall sign a destruction certificate, which shall be filed in the registry. The registry shall keep destruction certificates of TRES SECRET UE/EU TOP SECRET documents for a period of at least ten years and of documents CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET for a period of at least five years.

• 47.Classified documents, including those classified RESTREINT UE/EU RESTRICTED, shall be destroyed by methods which meet relevant EU or equivalent standards or which have been approved by Member States in accordance with national technical standards so as to prevent reconstruction in whole or in part.

• 48.The destruction of computer storage media used for EUCI shall be in accordance with procedures approved by the EEAS Security Authority.

VII.   SECURITY INSPECTIONS

EEAS security inspections

• 49.In accordance with Article 16 of this Decision, the EEAS security inspections encompass:

• (a) general security inspections, whose aim shall be to assess the general security level of the EEAS Headquarters, Union Delegations and all dependent or related premises, especially in order to evaluate effectiveness of security measures implemented for protecting the EEAS security interests;

• (b) EUCI security inspections, whose aim shall be to evaluate, generally in view of an accreditation, the effectiveness of measures implemented for protecting EUCI in EEAS Headquarters and Union Delegations. In particular, such inspections shall be carried out, inter alia to:
• (i) ensure that the required minimum standards for protecting EUCI laid down in this Decision are respected;
• (ii) emphasise the importance of security and effective risk management within the entities inspected;
• (iii) recommend countermeasures to mitigate the specific impact of loss of confidentiality, integrity or availability of classified information; and
• (iv) reinforce security authorities' ongoing security education and awareness programmes.

Conduct of and reporting on EEAS security inspections

• 50.EEAS Security inspections shall be conducted by an inspection team of the Directorate responsible for HQ security and EEAS information security and, when necessary, with the support of security experts of other EU Institutions or Member States.

• The inspection team shall have access to any location where EUCI is handled, in particular registries and CIS points of presence.

• 51.EEAS Security inspections in Union Delegations shall be conducted in coordination with the Directorate responsible for Crisis Response Centre and whenever necessary, with the support of the Security Officers of the Member States’ embassies located in the third countries.

• 52.Before the end of each calendar year, the EEAS Security Authority shall adopt a security inspection programme for the EEAS for the following year.

• 53.Whenever necessary, security inspections that are not foreseen in the programme above can be arranged by the EEAS Security Authority.

• 54.At the end of the security inspection, the main conclusions and recommendations shall be presented to the inspected entity. Thereafter, a report on the inspection shall be drawn up by the inspection team. Where corrective actions and recommendations have been proposed, sufficient details shall be included in the report to support the conclusions reached. The report shall be forwarded to the EEAS Security Authority, the Director for the Crisis Response Centre, with regard to security inspections in Union Delegations, and to the Head of the inspected entity.

• A regular report shall be prepared under the responsibility of the Directorate responsible for HQ security and EEAS information security to highlight the lessons learned from the inspections conducted over a specified period and examined by the EEAS Security Committee.

Conduct of and reporting on security inspections in EU agencies and bodies established under Title V, Chapter 2 of the TEU

• 55.The Directorate responsible for HQ security and EEAS information security may, where appropriate, designate contributing experts to participate in joint EU inspection teams carrying out inspections in EU agencies and bodies established under Title V, Chapter 2 of the TEU.

EEAS security inspections checklist

• 56.The Directorate responsible for HQ security and EEAS information security shall draw up and update a security inspection checklist of items to be verified in the course of a EEAS security inspection. This checklist shall be forwarded to the EEAS Security Committee.

• 57.The information to complete the checklist shall be obtained in particular during the inspection from the security management of the entity being inspected. Once completed with the detailed responses, the checklist shall be classified by agreement with the inspected entity. It shall not form part of the inspection report.

ANNEX A IV

PROTECTION OF EUCI HANDLED IN CIS

I. INTRODUCTION

• 1.This Annex sets out provisions for implementing Article 8 of Annex A.

• 2.The following Information Assurance (IA) properties and concepts are essential for the security and correct functioning of operations on Communication and Information Systems (CIS):

Authenticity:	the guarantee that information is genuine and from bona fide sources;
Availability:	the property of being accessible and usable upon request by an authorised entity;
Confidentiality:	the property that information is not disclosed to unauthorised individuals, entities or processes;
Integrity:	the property of safeguarding the accuracy and completeness of information and assets;
Non-repudiation:	the ability to prove an action or event has taken place, so that this event or action cannot subsequently be denied.

II.   INFORMATION ASSURANCE PRINCIPLES

• 3.The provisions set out below shall form the baseline for the security of any CIS handling EUCI. Detailed requirements for implementing these provisions shall be defined in IA security Guidelines.

Security risk management

• 4.Security risk management shall be an integral part of defining, developing, operating and maintaining CIS. Risk management (assessment, treatment, acceptance and communication) shall be conducted as an iterative process jointly by representatives of the system owners, project authorities, operating authorities and security approval authorities, using a proven, transparent and fully understandable risk assessment process. The scope of the CIS and its assets shall be clearly defined at the outset of the risk management process.

• 5.The EEAS competent authorities shall review the potential threats to CIS and shall maintain up-to-date and accurate threat assessments which reflect the current operational environment. They shall constantly update their knowledge of vulnerability issues and periodically review the vulnerability assessment to keep up with the changing information technology (IT) environment.

• 6.The aim of security risk management shall be to apply a set of security measures which results in a satisfactory balance between user requirements and residual security risk.

• 7.The specific requirements, scale and the degree of detail determined by the relevant Security Accreditation Authority (SAA) for accrediting a CIS shall be commensurate with the assessed risk, taking account of all relevant factors, including the classification level of the EUCI handled in the CIS. Accreditation shall include a formal residual risk statement and acceptance of the residual risk by a responsible authority.

Security throughout the CIS-life cycle

• 8.Ensuring security shall be a requirement throughout the entire CIS life-cycle from initiation to withdrawal from service.

• 9.The role and interaction of each actor involved in a CIS with regard to its security shall be identified for each phase of the life-cycle.

• 10.Any CIS, including its technical and non-technical security measures, shall be subject to security testing during the accreditation process to ensure that the appropriate level of assurance of the implemented security measures is obtained and to verify that they are correctly implemented, integrated and configured.

• 11.Security assessments, inspections and reviews shall be performed periodically during the operation and maintenance of a CIS and when exceptional circumstances arise.

• 12.Security documentation for a CIS shall evolve over its life-cycle as an integral part of the process of change and configuration management.

Best practice

• 13.The EEAS shall cooperate with GSC, Commission and Member States to develop best practice for protecting EUCI handled on CIS. Best practice guidelines shall set out technical, physical, organisational and procedural security measures for CIS with proven effectiveness in countering given threats and vulnerabilities.

• 14.The protection of EUCI handled on CIS shall draw on lessons learned by entities involved in IA within and outside the EU.

• 15.The dissemination and subsequent implementation of best practice shall help achieve an equivalent level of assurance for the various CIS operated by the EEAS which handle EUCI.

Defence in depth

• 16.To mitigate risk to CIS, a range of technical and non-technical security measures, organised as multiple layers of defence, shall be implemented. These layers shall include:

• (a) Deterrence: security measures aimed at dissuading any adversary planning to attack the CIS;

• (b) Prevention: security measures aimed at impeding or blocking an attack on the CIS;

• (c) Detection: security measures aimed at discovering the occurrence of an attack on the CIS;

• (d) Resilience: security measures aimed at limiting impact of an attack to a minimum set of information or CIS assets and preventing further damage; and

• (e) Recovery: security measures aimed at regaining a secure situation for the CIS.

• The degree of stringency and applicability of such security measures shall be determined following a risk assessment.

• 17.The EEAS competent authorities shall ensure that they can respond to incidents which may transcend organisational and national boundaries to coordinate responses and share information about these incidents and the related risk (computer emergency response capabilities).

Principle of minimality and least privilege

• 18.Only the functionalities, devices and services to meet operational requirements shall be implemented in order to avoid unnecessary risk.

• 19.CIS users and automated processes shall be given only the access, privileges or authorisations they require to perform their tasks in order to limit any damage resulting from accidents, errors, or unauthorised use of CIS resources.

• 20.Registration procedures performed by a CIS, where required, shall be verified as part of the accreditation process.

Information Assurance awareness

• 21.Awareness of the risks and available security measures is the first line of defence for the security of CIS. In particular all personnel involved in the life-cycle of CIS, including users, shall understand:

• (a) that security failures may significantly harm the CIS and the whole organisation;

• (b) the potential harm to others which may arise from interconnectivity and interdependency; and

• (c) their individual responsibility and accountability for the security of CIS according to their roles within the systems and processes.

• 22.To ensure that security responsibilities are understood, IA education and awareness training shall be mandatory for all personnel involved, including senior management and CIS users.

Evaluation and approval of IT-security products

• 23.The required degree of confidence in the security measures, defined as a level of assurance, shall be determined following the outcome of the risk management process and in line with the relevant security policies and security guidelines.

• 24.The level of assurance shall be verified by using internationally recognised or nationally approved processes and methodologies. This includes primarily evaluation, controls and auditing.

• 25.Cryptographic products for protecting EUCI shall be evaluated and approved by a national Crypto Approval Authority (CAA) of a Member State.

• 26.Prior to being recommended for approval by the EEAS CAA in accordance with Article 8(5) of this Decision, such cryptographic products shall have undergone a successful second party evaluation by an Appropriately Qualified Authority (AQUA) of a Member State not involved in the design or manufacture of the equipment. The degree of detail required in a second party evaluation shall depend on the envisaged maximum classification level of EUCI to be protected by these products.

• 27.Where warranted on specific operational grounds, the EEAS CAA may, upon recommendation by the Council Security Committee, waive the requirements under paragraphs 25 or 26 and grant an interim approval for a specific period in accordance with Article 8(5) of this Decision.

• 28.An AQUA shall be a CAA of a Member State that has been accredited on the basis of criteria laid down by the Council to undertake the second evaluation of cryptographic products for protecting EUCI.

• 29.The High Representative shall approve a security policy on the qualifications and approval of non-cryptographic IT security products.

Transmission within Secured Areas

• 30.Notwithstanding the provisions of this Decision, when transmission of EUCI is confined within Secured Areas or Administrative Areas, unencrypted distribution or encryption at a lower level may be used based on the outcome of a risk management process and subject to the approval of the SAA.

Secure interconnection of CIS

• 31.For the purposes of this Decision, an interconnection shall mean the direct connection of two or more IT systems for the purpose of sharing data and other information resources (e.g. communication) in a unidirectional or multidirectional way.

• 32.A CIS shall treat any interconnected IT system as untrusted and shall implement protective measures to control the exchange of classified information.

• 33.For all interconnections of CIS with another IT system the following basic requirements shall be met:

• (a) business or operational requirements for such interconnections shall be stated and approved by the competent authorities;

• (b) the interconnection shall undergo a risk management and accreditation process and shall require the approval of the competent SAAs; and

• (c) Boundary Protection Services (BPS) shall be implemented at the perimeter of all CIS.

• 34.There shall be no interconnection between an accredited CIS and an unprotected or public network, except where the CIS has approved BPS installed for such a purpose between the CIS and the unprotected or public network. The security measures for such interconnections shall be reviewed by the competent Information Assurance Authority (IAA) and approved by the competent SAA.

• When the unprotected or public network is used solely as a carrier and the data is encrypted by a cryptographic product approved in accordance with Article 8(5) of this Decision, such a connection shall not be deemed to be an interconnection.

• 35.The direct or cascaded interconnection of a CIS accredited to handle TRES SECRET UE/EU TOP SECRET to an unprotected or public network shall be prohibited.

Computer storage media

• 36.Computer storage media shall be destroyed in accordance with procedures approved by the EEAS Security Authority.

• 37.Computer storage media shall be reused, downgraded or declassified in accordance with EEAS Guidelines on downgrading and declassifying EUCI established pursuant to Article 8(2) of this Decision.

Emergency circumstances

• 38.Notwithstanding the provisions of this Decision, the specific procedures described below may be applied for a limited period of time in an emergency, such as during impending or actual crisis, conflict, war situations or in exceptional operational circumstances.

• 39.EUCI may be transmitted using cryptographic products which have been approved for a lower classification level or without encryption with the consent of the competent authority if any delay would cause harm clearly outweighing the harm entailed by any disclosure of the classified material and if:

• (a) the sender and recipient do not have the required encryption facility or have no encryption facility; and

• (b) the classified material cannot be conveyed in time by other means.

• 40.Classified information transmitted under the circumstances set out in paragraph 39 shall not bear any markings or indications distinguishing it from information which is unclassified or which can be protected by an available cryptographic product. Recipients shall be notified of the classification level, without delay, by other means.

• 41.Should recourse be made to paragraph 39, a subsequent report shall be made to the Directorate responsible for HQ security and EEAS information security and, by it, to the EEAS Security Committee. This report will at least state the sender, the recipient and the originator of each piece of EUCI.

III.   INFORMATION ASSURANCE FUNCTIONS AND AUTHORITIES

• 42.The following IA functions shall be established in the EEAS. These functions do not require single organisational entities. They shall have separate mandates. However, these functions, and their accompanying responsibilities, may be combined or integrated in the same organisational entity or split into different organisational entities, provided that internal conflicts of interests or tasks are avoided.

Information Assurance Authority (IAA)

• 43.The IAA shall be responsible for:

• (a) developing IA security Guidelines and monitoring their effectiveness and relevance;

• (b) safeguarding and administering technical information related to cryptographic products;

• (c) ensuring that IA measures selected for protecting EUCI comply with the relevant Guidelines governing their eligibility and selection;

• (d) ensuring that cryptographic products are selected in compliance with Guidelines governing their eligibility and selection;

• (e) coordinating training and awareness on IA;

• (f) consulting with the system provider, the security actors and representatives of users in respect of IA security guidelines; and

• (g) ensuring appropriate expertise is available in the expert sub-area of the EEAS Security Committee for IA issues.

TEMPEST Authority

• 44.The TEMPEST Authority (TA) shall be responsible for ensuring compliance of CIS with TEMPEST policies and guidelines. It shall approve TEMPEST countermeasures for installations and products to protect EUCI to a defined level of classification in its operational environment.

Crypto Approval Authority (CAA)

• 45.The CAA shall be responsible for ensuring that cryptographic products comply with respective cryptographic Guidelines. It shall approve a cryptographic product to protect EUCI to a defined level of classification in its operational environment.

Crypto Distribution Authority (CDA)

• 46.The CDA shall be responsible for:

• (a) managing and accounting for EU crypto material;

• (b) ensuring that appropriate procedures are enforced and channels established for accounting, secure handling, storage and distribution of all EU crypto material; and

• (c) ensuring the transfer of EU crypto material to or from individuals or services using it.

Security Accreditation Authority (SAA)

• 47.The SAA for each system shall be responsible for:

• (a) ensuring that CIS comply with the relevant security Guidelines, providing a statement of approval for CIS to handle EUCI to a defined level of classification in its operational environment, stating the terms and conditions of the accreditation, and criteria under which re-approval is required;

• (b) establishing a security accreditation process, in accordance with the relevant Guidelines, clearly stating the approval conditions for CIS under its authority;

• (c) defining a security accreditation strategy setting out the degree of detail for the accreditation process commensurate with the required level of assurance;

• (d) examining and approving security-related documentation, including risk management and residual risk statements, System-specific Security Requirement Statements (hereinafter referred to as ‘SSRSs’), security implementation verification documentation and Security Operating Procedures (hereinafter referred to as ‘SecOPs’), and ensuring that it complies with the EEAS's security rules and Guidelines;

• (e) checking implementation of security measures in relation to the CIS by undertaking or sponsoring security assessments, inspections or reviews;

• (f) defining security requirements (e.g. personnel security clearance levels) for sensitive positions in relation to the CIS;

• (g) endorsing the selection of approved cryptographic and TEMPEST products used to provide security for a CIS;

• (h) approving, or where relevant, participating in the joint approval of the interconnection of a CIS to other CIS; and

• (i) consulting the system provider, the security actors and representatives of the users with respect to security risk management, in particular the residual risk, and the terms and conditions of the approval statement.

• 48.The EEAS SAA shall be responsible for accrediting all CIS operating within the remit of the EEAS.

Security Accreditation Board (SAB)

• 49.A joint SAB shall be responsible for accrediting CIS within the remit of both the EEAS SAA and Member States’ SAAs. It shall be composed of an SAA representative from each Member State and be attended by an SAA representative of the GSC and Commission. Other entities with nodes on a CIS shall be invited to attend when that system is under discussion.

• The SAB shall be chaired by a representative of the EEAS SAA. It shall act by consensus of SAA representatives of institutions, Member States and other entities with nodes on the CIS. It shall make periodic reports on its activities to the EEAS Security Committee and shall notify it of all accreditation statements.

Information Assurance Operational Authority

• 50.The IA Operational Authority for each system shall be responsible for:

• (a) developing security documentation in line with security Guidelines, in particular the System-specific Security Requirement Statement (SSRS) including the residual risk statement, the Security Operating Procedures (SecOPs) and the crypto plan within the CIS accreditation process;

• (b) participating in selecting and testing the system-specific technical security measures, devices and software, to supervise their implementation and to ensure that they are securely installed, configured and maintained in accordance with the relevant security documentation;

• (c) participating in selecting TEMPEST security measures and devices if required in the SSRS and ensuring that they are securely installed and maintained in cooperation with the TA;

• (d) monitoring implementation and application of the SecOPs and, where appropriate, delegating operational security responsibilities to the system owner;

• (e) managing and handling cryptographic products, ensuring the custody of crypto and controlled items and, if so required, ensuring the generation of cryptographic variables;

• (f) conducting security analysis reviews and tests, in particular to produce the relevant risk reports, as required by the SAA;

• (g) providing CIS-specific IA training;

• (h) implementing and operating CIS-specific security measures.

ANNEX A V

INDUSTRIAL SECURITY

I. INTRODUCTION

• 1.This Annex sets out provisions for implementing Article 9 of Annex A. It lays down general security provisions applicable to industrial or other entities in pre-contract negotiations and throughout the life-cycle of classified contracts let by the EEAS.

• 2.The EEAS Security Authority shall approve Guidelines on industrial security outlining in particular detailed requirements regarding Facility Security Clearances (FSCs), Security Aspects Letters (SALs), visits, transmission and carriage of EUCI.

II.   SECURITY ELEMENTS IN A CLASSIFIED CONTRACT

Security classification guide (SCG)

• 3.Prior to launching an invitation to tender or letting a classified contract, the EEAS, as the contracting authority, shall determine the security classification of any information to be provided to bidders and contractors, as well as the security classification of any information to be created by the contractor. For that purpose, the EEAS shall prepare a SCG to be used for the performance of the contract.

• 4.In order to determine the security classification of the various elements of a classified contract, the following principles shall apply:

• (a) in preparing an SCG, the EEAS shall take into account all relevant security aspects, including the security classification assigned to information provided and approved to be used for the contract by the originator of the information;

• (b) the overall level of classification of the contract may not be lower than the highest classification of any of its elements; and

• (c) where relevant, the EEAS shall liaise with the Member States' NSAs/DSAs or any other competent security authority concerned in the event of any changes regarding the classification of information created by or provided to contractors in the performance of a contract and when making any subsequent changes to the SCG.

Security aspects letter (SAL)

• 5.The contract-specific security requirements shall be described in an SAL. The SAL shall, where appropriate, contain the SCG and shall be an integral part of a classified contract or sub-contract.

• 6.The SAL shall contain provisions requiring the contractor and/or subcontractor to comply with the minimum standards laid down in this Decision. Non-compliance with these minimum standards may constitute sufficient grounds for the contract to be terminated.

Programme/project security instructions (PSI)

• 7.Depending on the scope of programmes or projects involving access to or handling or storage of EUCI, specific Programme/Project Security Instructions (PSI) may be prepared by the contracting authority designated to manage the programme or project. The PSI shall require the approval of the Member States’ NSAs/DSAs or any other competent security authority participating in the programme/project and may contain additional security requirements.

III.   FACILITY SECURITY CLEARANCE (FSC)

• 8.The Directorate responsible for HQ security and EEAS information security shall request the NSA or DSA or other competent security authority of the Member State concerned to grant an FSC to indicate, in accordance with national laws and regulations, that an industrial or other entity can protect EUCI at the appropriate classification level (CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET) within its facilities. A contractor, subcontractor, or potential contractor or subcontractor shall not be provided with or granted access to EUCI, until proof of FSC has been transmitted to the EEAS.

• 9.Where relevant, the EEAS, as the contracting authority, shall notify the appropriate NSA/DSA or any other competent security authority that an FSC is required in the pre-contractual stage or for performing the contract. An FSC or PSC shall be required in the pre-contractual stage where EUCI classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET has to be provided in the course of the bidding process.

• 10.The EEAS as contracting authority shall not award a classified contract with a preferred bidder before having received confirmation from the NSA/DSA or any other competent security authority of the Member State in which the contractor or subcontractor concerned is registered that, where required, an appropriate FSC has been issued.