ANNEX I

PART 1

BASIC PRINCIPLES AND MINIMUM STANDARDS OF SECURITY FOR THE PROTECTION OF CONFIDENTIAL INFORMATION

1.   Introduction

These provisions lay down the basic principles and minimum standards of security to be complied with by the European Parliament in all its places of employment, as well as by all recipients of EUCI and other confidential information, so that security is safeguarded and all persons concerned may be assured that a common standard of protection is established. They are supplemented by rules governing the treatment of confidential information by parliamentary committees and other parliamentary bodies/office-holders.

2.   General principles

The European Parliament's security policy forms an integral part of its general internal management policy and is thus based on the principles governing that general policy. Those principles include legality, transparency, accountability, and subsidiarity and proportionality.

The principle of legality entails the need to remain strictly within the legal framework in the execution of security functions, and to conform to the applicable legal requirements. It also means that responsibilities in the security domain must be based on proper legal provisions. The provisions of the Staff Regulations, in particular Article 17 thereof on the obligation of staff to refrain from any unauthorised disclosure of information received in the line of duty and Title VI thereof on disciplinary measures, are fully applicable. Finally, it means that breaches of security within the responsibility of the European Parliament must be dealt with in a manner consistent with the European Parliament's policy on disciplinary measures.

The principle of transparency entails the need for clarity regarding all security rules and provisions, for a balance to be struck between the different services and the different domains (physical security as compared to the protection of information, etc.), and for a consistent and structured security awareness policy. It also means that clear written guidelines are necessary for the implementation of security measures.

The principle of accountability means that responsibilities in the field of security will be clearly defined. Moreover, it entails the need regularly to monitor whether those responsibilities have been properly fulfilled.

The principle of subsidiarity means that security shall be organised at the lowest possible level and as closely as possible to the European Parliament's Directorates-General and services. The principle of proportionality means that security activities shall be strictly limited to what is absolutely necessary and that security measures shall be proportional to the interests to be protected and to the actual or potential threat to those interests, so as to enable them to be defended in a way which causes the least possible disruption.

3.   Foundations of information security

The foundations of sound information security are:

(a)	within the European Parliament, an INFOSEC (information security) assurance service responsible for working with the security authority concerned to provide information and advice on technical threats to security and the means of protecting against them;

(b)	close cooperation between the European Parliament's responsible services and the security services of the other EU institutions.

4.   Principles of information security

4.1.   Objectives

The principle objectives of information security are as follows:

(a)	to safeguard EUCI and other confidential information against espionage, compromise or unauthorised disclosure;

(b)	to safeguard EUCI handled in communications and information systems and networks against threats to its confidentiality, integrity and availability;

(c)	to safeguard European Parliament premises housing EUCI against sabotage and malicious wilful damage;

(d)	in the event of a security failure, to assess the damage caused, limit its consequences, conduct security investigations and adopt the necessary remedial measures.

4.2.   Classification

4.2.1.   Where confidentiality is concerned, care and experience are needed in the selection of the information and material to be protected and the assessment of the degree of protection required. It is fundamental that the degree of protection should correspond to the sensitivity, in terms of security, of the individual item of information or material to be safeguarded. In order to ensure the smooth flow of information, both over-classification and under-classification shall be avoided.

4.2.2.   The classification system is the instrument by which effect is given to the principles set out in this section; a similar system of classification shall be followed in planning and organising ways to counter espionage, sabotage, terrorism and other threats, so that the maximum protection is afforded to the most important premises housing EUCI and to the most sensitive points within them.

4.2.3.   Responsibility for classifying information lies solely with the originator of the information concerned.

4.2.4.   The level of classification may solely be based on the content of that information.

4.2.5.   Where a number of items of information are grouped together, the classification level to be applied to the whole must at least be as high as the highest classification applied individually to those items. A collection of information may however be given a higher classification than its constituent parts.

4.2.6.   Classifications shall be assigned only when necessary and for as long as necessary.

4.3.   Aims of security measures

The security measures shall:

(a)	extend to all persons having access to EUCI, EUCI-carrying media, and other confidential information, as well as all premises containing such information and important installations;

(b)	be designed to detect persons whose position might jeopardise the security of such information and of important installations housing such information, and provide for their exclusion or removal;

(c)	prevent any unauthorised person from having access to such information or to installations containing it;

(d)	ensure that such information is disseminated solely on the basis of the need-to-know principle that is fundamental to all aspects of security;

(e)

ensure the integrity (i.e. prevent corruption, unauthorised alteration or unauthorised deletion) and the availability (to those needing and authorised to have access thereto) of all confidential information, whether classified or not classified, and especially where it is stored, processed or transmitted in electromagnetic form.

5.   Common minimum standards

The European Parliament shall ensure that common minimum standards of security are observed by all recipients of EUCI, both inside the institution and under its competence, namely all its services and contractors, so that such information can be passed on in the confidence that it will be handled with equal care. Such minimum standards shall include criteria for the security clearance of officials of the European Parliament and other Parliament employees working for political groups, and procedures for the protection of confidential information.

The European Parliament shall allow outside bodies access to such information only on condition that they ensure that it is handled in accordance with provisions that are at least strictly equivalent to these common minimum standards.

Such common minimum standards shall also be applied when, pursuant to a contract or grant, the European Parliament entrusts to industrial or other entities tasks involving confidential information.

6.   Security for officials of the European Parliament and other Parliament employees working for political groups

6.1.   Security instructions for officials of the European Parliament and other Parliament employees working for political groups

Officials of the European Parliament and other Parliament employees working for political groups in positions where they could have access to EUCI shall be given thorough instructions, both on taking up their assignment and at regular intervals thereafter, in the need for security and the procedures for achieving it. Such persons shall be required to certify in writing that they have read and fully understand the applicable security provisions.

6.2.   Management responsibilities

Managers shall have the duty of knowing those of their staff who are engaged in work on classified information or who have access to secure communication or information systems, and to record and report any incidents or apparent vulnerabilities which are likely to affect security.

6.3.   Security status of officials of the European Parliament and other Parliament employees working for political groups

Procedures shall be established to ensure that, when adverse information becomes known concerning an official of the European Parliament or other Parliament employee working for a political group, steps are taken to determine whether that individual’s work brings him or her into contact with classified information or whether he or she has access to secure communication or information systems, and that the European Parliament’s responsible service is informed. If it is established that such an individual constitutes a security risk, he or she shall be barred or removed from assignments where he or she might endanger security.

7.   Physical security

‘Physical security’ means the application of physical and technical protective measures to prevent unauthorised access to EUCI.

7.1.   Need for protection

The degree of physical security measures to be applied to ensure the protection of EUCI shall be proportional to the classification and volume of, and the threat to, the information and material held. All holders of EUCI shall follow uniform practices regarding classification of such information and must meet common standards of protection regarding the custody, transmission and disposal of information and material requiring protection.

7.2.   Checking

Before leaving areas containing EUCI unattended, persons having custody thereof shall ensure that it is securely stored and that all security devices have been activated (locks, alarms, etc.). Further independent checks shall be carried out after working hours.

7.3.   Security of buildings

Buildings housing EUCI or secure communication and information systems shall be protected against unauthorised access.

The nature of the protection afforded to EUCI, e.g. barring of windows, locks for doors, guards at entrances, automated access control systems, security checks and patrols, alarm systems, intrusion detection systems and guard dogs, shall depend on:

(a)	the classification, volume and location within the building of the information and material to be protected;

(b)	the quality of the security containers for the information and material concerned; and

(c)	the physical nature and location of the building.

The nature of the protection afforded to communication and information systems shall depend on an assessment of the value of the assets at stake and of the potential damage if security were to be compromised, on the physical nature and location of the building in which the system is housed, and on the location of that system within the building.

7.4.   Contingency plans

Detailed plans shall be prepared in advance for the protection of classified information during an emergency.

8.   Security designators, markings, affixing and classification management

8.1.   Security designators

No classifications other than those defined in Article 2(c) of this Decision are permitted.

An agreed security designator may be used to set limits to the validity of a classification (for classified information signifying automatic downgrading or declassification). That designator shall either be ‘UNTIL … (time/date)’ or ‘UNTIL … (event)’.

Additional security designators such as CRYPTO or any other EU-recognised security designator shall apply where there is a need for limited distribution and special handling in addition to that designated by the security classification.

Security designators shall only be used in combination with a classification.

8.2.   Markings

A marking may be used to specify the field covered by a given document or a particular distribution on a need-to-know basis, or (for non-classified information) to signify the end of an embargo.

A marking is not a classification and must not be used in lieu of one.

8.3.   Affixing of classifications and of security designators

Classifications shall be affixed as follows:

(a)	on documents classified as ‘RESTREINT UE/EU RESTRICTED’, by mechanical or electronic means;

(b)	on documents classified as ‘CONFIDENTIEL UE/EU CONFIDENTIAL’, by mechanical means or by hand or by printing on pre-stamped, registered paper;

(c)	on documents classified as ‘SECRET UE/EU SECRET’ and ‘TRÈS SECRET UE/EU TOP SECRET’, by mechanical means or by hand.

Security designators shall be affixed directly under the classification, by the same means as those used for affixing classifications.

8.4.   Classification management

8.4.1.   General

Information shall be classified only when necessary. The classification shall be clearly and correctly indicated, and shall be maintained only as long as the information requires protection.

The responsibility for classifying information and for any subsequent downgrading or declassification rests solely with the originator.

Officials of the European Parliament shall classify, downgrade or declassify information on instructions from or pursuant to a delegation from the Secretary-General.

The detailed procedures for the treatment of classified documents shall be so framed as to ensure that they are afforded protection appropriate to the information which they contain.

The number of persons authorised to originate ‘TRÈS SECRET UE/EU TOP SECRET’ documents shall be kept to a minimum, and their names shall be kept on a list drawn up by the CIS.

8.4.2.   Application of classification

The classification of a document shall be determined by the level of sensitivity of its contents in accordance with the definitions contained in Article 2(c). It is important that classification be correctly and sparingly used, especially as regards the ‘TRÈS SECRET UE/EU TOP SECRET’ classification.

The classification of a letter or note containing enclosures shall be as high as the highest classification granted to one of its enclosures. The originator shall indicate clearly the level at which the letter or note should be classified when detached from its enclosures.

The originator of a document that is to be given a classification shall bear in mind the rules set out above and shall curb any tendency to over- or under-classify.

Individual pages, paragraphs, sections, annexes, appendices, attachments and enclosures of a given document may require different classifications and shall be classified accordingly. The classification of the document as a whole shall be that of its most highly classified part.

9.   Inspections

Periodic inspections of the security arrangements for the protection of EUCI shall be carried out by the European Parliament's directorate responsible for security, which may be assisted in this task by the CIS.

The European Parliament's directorate responsible for security and the security services of other institutions, bodies, offices and agencies established by virtue or on the basis of the Treaties holding EUCI may also agree to carry out peer evaluations of the security arrangements for the protection of EUCI.

10.   Declassification procedure

10.1.   The CIS will examine EUCI and will make proposals on a declassification to the originator of a document by no later than the 25th year following the date of its creation. Documents not declassified at the first examination shall be re-examined periodically and at least every five years.

10.2.   In addition to being applied to documents actually located in the secure archives and duly classified, the declassification process may also cover other confidential information existing in either the secure archives or the European Parliament Archive and Documentation Centre (CARDOC).

10.3.   On behalf of the originator, the CIS will be responsible for informing the addressees of the document of the change to the classification, and they in turn shall be responsible for informing any subsequent addressees to whom they have sent or copied the document.

10.4.   Declassification does not affect any markings which may appear on the document.

10.5.   The original classification at the top and bottom of every page shall be crossed out. The first (cover) page of the document shall be stamped and completed with the reference of the CIS.

10.6.   The text of the declassified document shall be attached to the electronic fiche or equivalent system where it has been registered.

10.7.   In the case of documents covered by the exception relating to privacy and the integrity of the individual or commercial interests of a natural or legal person and in the case of sensitive documents, Article 2 of Regulation (EEC, Euratom) No 354/83 shall apply.

10.8.   In addition to the provisions of points 10.1 to 10.7, the following rules shall apply:

(a)	as regards third-party documents, the CIS will consult the third party concerned before proceeding to carry out the declassification. The third party will have eight weeks in which to submit remarks;

(b)	as regards the exception relating to privacy and the integrity of the individual, the declassification procedure will take into account, in particular, the agreement of the person concerned, the impossibility of identifying the person concerned and/or the fact that that person is no longer alive;

(c)	as regards the exception relating to commercial interests of a natural or legal person, the person concerned can be notified via publication in the Official Journal of the European Union and given four weeks from the day of that publication in which to submit remarks.

PART 2

SECURITY CLEARANCE PROCEDURE

11.   Security clearance procedure for Members of the European Parliament

11.1.   In light of the European Parliament's prerogatives and competences, its Members may be granted access to EUCI up to and including the level of ‘CONFIDENTIEL UE/EU CONFIDENTIEL’ without security clearance. For information classified as ‘CONFIDENTIEL UE/EU CONFIDENTIAL’, they shall sign of a solemn declaration that they will not disclose the contents of that information to any third person.

11.2.   In order to have access to information classified as ‘TRÈS SECRET UE/EU TOP SECRET’, or ‘SECRET UE/EU SECRET’, Members of the European Parliament must have been authorised in accordance with the procedure referred to in points 11.3 and 11.4.

11.3.   Authorisation shall be granted only to Members of the European Parliament who have undergone security screening by the competent national authorities of the Member States in accordance with the procedure referred to in points 11.9 to 11.14. The President shall be responsible for granting the authorisation for Members.

11.4.   The President may grant authorisation after obtaining the opinion of the competent national authorities of the Member States on the basis of security screening carried out in accordance with points 11.8 to 11.13.

11.5.   The European Parliament's directorate responsible for security shall maintain an up-to-date list of all Members of the European Parliament who have been granted authorisation, including provisional authorisation within the meaning of point 11.15.

11.6.   Authorisation shall be valid for a period of five years or for the duration of the tasks in respect of which it was granted, whichever is the shorter. It may be renewed in accordance with the procedure laid down in point 11.4.

11.7.   Authorisation shall be withdrawn by the President where he/she considers that there are justified grounds for doing so. Any decision to withdraw authorisation shall be notified to the Member of the European Parliament concerned, who may ask to be heard by the President before the withdrawal takes effect, and to the competent national authority.

11.8.   Security screening shall be carried out with the assistance of the Member of the European Parliament concerned and at the request of the President. The competent national authority for screening is that of the Member State of which the Member concerned is a national.

11.9.   As part of the screening procedure, the Member of the European Parliament concerned shall be required to complete a personal information form.

11.10.   The President shall specify in his/her request to the competent national authorities the level of classified information to be made available to the Member of the European Parliament concerned, so that they may carry out the screening process.

11.11.   The entire security-screening process carried out by the competent national authorities, together with the results obtained, shall be in accordance with the relevant rules and regulations in force in the Member State concerned, including those concerning appeals.

11.12.   Where the competent national authorities of the Member State give a positive opinion, the President may grant the Member of the European Parliament concerned authorisation.

11.13.   A negative opinion by the competent national authorities shall be notified to the Member of the European Parliament concerned, who may ask to be heard by the President. Should he/she consider it necessary, the President may ask the competent national authorities for further clarification. If the negative opinion is confirmed, authorisation shall not be granted.

11.14.   All Members of the European Parliament granted authorisation within the meaning of point 11.3 shall, at the time when the authorisation is granted and at regular intervals thereafter, receive any necessary guidelines concerning the protection of classified information and the means of ensuring such protection. Such Members shall sign a declaration acknowledging receipt of those guidelines.

11.15.   In exceptional circumstances, the President may, after notifying the competent national authorities and provided there is no reaction from them within one month, grant provisional authorisation to a Member of the European Parliament for a period not exceeding six months, pending the outcome of the screening referred to in point 11.11. The provisional authorisations thus granted shall not give access to information classified as ‘TRÈS SECRET UE/EU TOP SECRET’.

12.   Security clearance procedure for officials of the European Parliament and other Parliament employees working for political groups

12.1.   Only officials of the European Parliament and other Parliament employees working for political groups who, by reason of their duties and in the requirements of the service, need to have knowledge of, or to use, classified information, may have access to such information.

12.2.   In order to have access to information classified as ‘TRÈS SECRET UE/EU TOP SECRET’, ‘SECRET UE/EU SECRET’ and ‘CONFIDENTIEL UE/EU CONFIDENTIAL’, the persons referred to in point 12.1 must have been authorised in accordance with the procedure laid down in points 12.3 and 12.4.

12.3.   Authorisation shall be granted only to the persons referred to in point 12.1 who have undergone security screening by the competent national authorities of the Member States in accordance with the procedure referred to in points 12.9 to 12.14. The Secretary-General shall be responsible for granting the authorisation for officials of the European Parliament and other Parliament employees working for political groups.

12.4.   The Secretary General may grant authorisation after obtaining the opinion of the competent national authorities of the Member States on the basis of security screening carried out in accordance with points 12.8 to 12.13.

12.5.   The European Parliament's directorate responsible for security shall maintain an up-to-date list of all posts requiring a security clearance, as provided by the relevant European Parliament services and of all persons who have been granted authorisation, including provisional authorisation within the meaning of point 12.15.

12.6.   Authorisation shall be valid for a period of five years or for the duration of the tasks in respect of which it was granted, whichever is the shorter. It may be renewed in accordance with the procedure referred to in point 12.4.

12.7.   Authorisation shall be withdrawn by the Secretary-General where he/she considers that there are justifiable grounds for doing so. Any decision to withdraw authorisation shall be notified to the official of the European Parliament or other Parliament employee working for a political group concerned, who may ask to be heard by the Secretary-General before the withdrawal takes effect, and to the competent national authority.

12.8.   Security screening shall be carried out with the assistance of the person concerned and at the request of the Secretary-General. The competent national authority for screening is that of the Member State of which the person concerned is a national. Where permissible under national laws and regulations, the competent national authorities may conduct investigations in respect of non-nationals who require access to information classified as ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ or above.

12.9.   As part of the screening procedure, the official of the European Parliament or other Parliament employee working for a political group concerned shall be required to complete a personal information form.

12.10.   The Secretary-General shall specify in his/her request to the competent national authorities the level of classified information to be made available to the person concerned, so that they may carry out the screening process and give their opinion as to the level of authorisation it would be appropriate to grant to that person.

12.11.   The entire security-screening process carried out by the competent national authorities, together with the results obtained, shall be subject to the relevant rules and regulations in force in the Member State concerned, including those concerning appeals.

12.12.   Where the competent national authorities of the Member State give a positive opinion, the Secretary-General may grant the person concerned authorisation.

12.13.   A negative opinion by the competent national authorities shall be notified to the official of the European Parliament or other Parliament employee working for a political group concerned, who may ask to be heard by the Secretary-General. Should he/she consider it necessary, the Secretary-General may ask the competent national authorities for further clarification. If the negative opinion is confirmed, authorisation shall not be granted.

12.14.   All officials of the European Parliament and other Parliament employees working for political groups who are granted authorisation within the meaning of points 12.4 and 12.5 shall, at the time when the authorisation is granted and at regular intervals thereafter, receive any necessary instructions concerning the protection of classified information and the means of ensuring such protection. Such officials and employees shall sign a declaration acknowledging receipt of those instructions and give an undertaking to obey them.

12.15.   In exceptional circumstances, the Secretary-General may, after notifying the competent national authorities and provided there is no reaction from them within one month, grant provisional authorisation to an official of the European Parliament or other Parliament employee working for a political group for a period not exceeding six months, pending the outcome of the screening referred to in point 12.11 of this section. Provisional authorisations thus granted shall not give access to information classified as ‘TRÈS SECRET UE/EU TOP SECRET’.