(a)

his need-to-know has been determined;

(b)

he has been granted a PSC to the relevant level or is otherwise duly authorised by virtue of his functions in accordance with national laws and regulations; and

(c)

he has been briefed on the security rules and procedures for protecting EUCI and has acknowledged his responsibilities with regard to protecting such information.

(a)

has committed or attempted to commit, conspired with or aided and abetted another to commit any act of espionage, terrorism, sabotage, treason or sedition;

(b)

is, or has been, an associate of spies, terrorists, saboteurs, or of individuals reasonably suspected of being such or an associate of representatives of organisations or foreign states, including foreign intelligence services, which may threaten the security of the EU and/or Member States unless these associations were authorised in the course of official duty;

(c)

is, or has been, a member of any organisation which by violent, subversive or other unlawful means seeks, inter alia, to overthrow the government of a Member State, to change the constitutional order of a Member State or to change the form or the policies of its government;

(d)

is, or has been, a supporter of any organisation described in point (c), or who is, or who has been closely associated with members of such organisations;

(e)

has deliberately withheld, misrepresented or falsified information of significance, particularly of a security nature, or has deliberately lied in completing a personnel security questionnaire or during the course of a security interview;

(f)

has been convicted of a criminal offence or offences;

(g)

has a history of alcohol dependence, use of illegal drugs and/or misuse of legal drugs;

(h)

is or has been involved in conduct which may give rise to the risk of vulnerability to blackmail or pressure;

(i)

by act or through speech, has demonstrated dishonesty, disloyalty, unreliability or untrustworthiness;

(j)

has seriously or repeatedly infringed security regulations; or has attempted, or succeeded in, unauthorised activity in respect of communication and information systems;

(k)

may be liable to pressure (e.g. through holding one or more non-EU nationalities or through relatives or close associates who could be vulnerable to foreign intelligence services, terrorist groups or other subversive organisations, or individuals whose aims may threaten the security interests of the EU and/or Member States).

(a)

the completion of a national personnel security questionnaire for the level of EUCI to which the individual may require access; once completed, this questionnaire shall be forwarded to the competent security authority;

(b)

identity check/citizenship/nationality status — the individual’s date and place of birth shall be verified and his identity checked. Citizenship status and/or nationality, past and present, of the individual shall be established; this shall include an assessment of any vulnerability to pressure from foreign sources, for example, due to former residence or past associations; and

(c)

national and local records check — a check shall be made of national security and central criminal records, where the latter exist, and/or other comparable governmental and police records. The records of law enforcement agencies with legal jurisdiction where the individual has resided or been employed shall be checked.

(a)

financial status — information shall be sought on the individual’s finances in order to assess any vulnerability to foreign or domestic pressure due to serious financial difficulties, or to discover any unexplained affluence;

(b)

education — information shall be sought to verify the individual’s educational background at schools, universities and other education establishments attended since his 18th birthday, or during a period judged appropriate by the investigating authority;

(c)

employment — information covering present and former employment shall be sought, reference being made to sources such as employment records, performance or efficiency reports and to employers or supervisors;

(d)

military service — where applicable, the service of the individual in the armed forces and type of discharge shall be verified; and

(e)

interviews — where provided for and admissible under national law, an interview or interviews shall be conducted with the individual. Interviews shall also be conducted with other individuals who are in a position to give an unbiased assessment of the individual’s background, activities, loyalty, trustworthiness and reliability. When it is national practice to ask the subject of the investigation for referrals, referees shall be interviewed unless there are good reasons for not doing so.

(a)

Where the security investigation results in an assurance that nothing adverse is known which would call into question the loyalty, trustworthiness and reliability of the individual, the GSC Appointing Authority may grant an EU PSC to the individual concerned and authorise access to EUCI up to the relevant level until a specified date.

(b)

Where the security investigation does not result in such an assurance, the GSC Appointing Authority shall notify the individual concerned, who may ask to be heard by the Appointing Authority. The Appointing Authority may ask the competent NSA for any further clarification it can provide according to its national laws and regulations. If the outcome is confirmed, an EU PSC shall not be granted.

(a)

the compelling need for access to EUCI at a higher level shall be justified, in writing, by the individual’s superior;

(b)

access shall be limited to specific items of EUCI in support of the assignment;

(c)

the individual holds a valid national PSC or EU PSC;

(d)

action has been initiated to obtain authorisation for the level of access required for the position;

(e)

satisfactory checks have been made by the competent authority that the individual has not seriously or repeatedly infringed security regulations;

(f)

the assignment of the individual is approved by the competent authority; and

(g)

a record of the exception, including a description of the information to which access was approved, shall be kept by the registry or subordinate registry responsible.

(a)

ensuring that EUCI is handled and stored in an appropriate manner;

(b)

allowing for segregation of personnel in terms of access to EUCI on the basis of their need-to-know and, where appropriate, their security clearance;

(c)

deterring, impeding and detecting unauthorised actions; and

(d)

denying or delaying surreptitious or forced entry by intruders.

(a)

the classification level of EUCI;

(b)

the form and volume of EUCI, bearing in mind that large quantities or a compilation of EUCI may require more stringent protective measures to be applied;

(c)

the surrounding environment and structure of the buildings or areas housing EUCI; and

(d)

the assessed threat from intelligence services which target the EU or Member States and from sabotage, terrorist, subversive or other criminal activities.

(a)

a perimeter barrier: a physical barrier which defends the boundary of an area requiring protection;

(b)

intrusion detection systems (IDS): an IDS may be used to enhance the level of security offered by a perimeter barrier, or in rooms and buildings in place of, or to assist, security staff;

(c)

access control: access control may be exercised over a site, a building or buildings on a site or to areas or rooms within a building. Control may be exercised by electronic or electro-mechanical means, by security personnel and/or a receptionist, or by any other physical means;

(d)

security personnel: trained, supervised and, where necessary, appropriately security-cleared security personnel may be employed, inter alia, in order to deter individuals planning covert intrusion;

(e)

closed circuit television (CCTV): CCTV may be used by security personnel in order to verify incidents and IDS alarms on large sites or at perimeters;

(f)

security lighting: security lighting may be used to deter a potential intruder, as well as to provide the illumination necessary for effective surveillance directly by security personnel or indirectly through a CCTV system; and

(g)

any other appropriate physical measures designed to deter or detect unauthorised access or prevent loss of or damage to EUCI.

(a)

Administrative Areas; and

(b)

Secured Areas (including technically Secured Areas).

(a)

a visibly defined perimeter shall be established which allows individuals and, where possible, vehicles to be checked;

(b)

unescorted access shall be granted only to individuals who are duly authorised by the competent authority; and

(c)

all other individuals shall be escorted at all times or be subject to equivalent controls.

(a)

a visibly defined and protected perimeter shall be established through which all entry and exit are controlled by means of a pass or personal recognition system;

(b)

unescorted access shall be granted only to individuals who are security-cleared and specifically authorised to enter the area on the basis of their need-to-know;

(c)

all other individuals shall be escorted at all times or be subject to equivalent controls.

(a)

the level of highest security classification of the information normally held in the area shall be clearly indicated;

(b)

all visitors shall require specific authorisation to enter the area, shall be escorted at all times and shall be appropriately security cleared unless steps are taken to ensure that no access to EUCI is possible.

(a)

such areas shall be IDS equipped, be locked when not occupied and be guarded when occupied. Any keys shall be controlled in accordance with Section VI;

(b)

all persons and material entering such areas shall be controlled;

(c)

such areas shall be regularly physically and/or technically inspected as required by the competent security authority. Such inspections shall also be conducted following any unauthorised entry or suspicion of such entry; and

(d)

such areas shall be free of unauthorised communication lines, unauthorised telephones or other unauthorised communication devices and electrical or electronic equipment.

(a)

the level of EUCI which may be handled and stored in the area;

(b)

the surveillance and protective measures to be maintained;

(c)

the individuals authorised to have unescorted access to the area by virtue of their need-to-know and security clearance;

(d)

where appropriate, the procedures for escorts or for protecting EUCI when authorising any other individuals to access the area;

(e)

any other relevant measures and procedures.

(a)

in a Secured Area;

(b)

in an Administrative Area provided the EUCI is protected from access by unauthorised individuals; or

(c)

outside a Secured Area or an Administrative Area provided the holder carries the EUCI in accordance with paragraphs 28 to 40 of Annex III and has undertaken to comply with compensatory measures laid down in security instructions issued by the competent security authority to ensure that EUCI is protected from access by unauthorised persons.

(a)

in a Secured Area;

(b)

in an Administrative Area provided the EUCI is protected from access by unauthorised individuals; or

(c)

outside a Secured Area or an Administrative Area provided the holder:

(a)

in a security container in line with paragraph 8 with one or more of the following supplementary controls:

or

(b)

in an IDS-equipped strong room in combination with response security personnel.

(a)

whenever there is a change in personnel knowing the combination;

(b)

whenever a compromise has occurred or is suspected;

(c)

when a lock has undergone maintenance or repair; and

(d)

at least every 12 months.

(a)

an identifier to designate the originator;

(b)

any caveats, code-words or acronyms specifying the field of activity to which the document relates, a particular distribution on a need-to-know basis or restrictions on use;

(c)

releasability markings;

(d)

where applicable, the date or specific event after which it may be downgraded or declassified.

TRÈS SECRET UE/EU TOP SECRET

TS-UE/EU-TS

SECRET UE/EU SECRET

S-UE/EU-S

CONFIDENTIEL UE/EU CONFIDENTIAL

C-UE/EU-C

RESTREINT UE/EU RESTRICTED

R-UE/EU-R

(a)

each page shall be marked clearly with the classification level;

(b)

each page shall be numbered;

(c)

the document shall bear a reference number and a subject, which is not itself classified information, unless it is marked as such;

(d)

the document shall be dated;

(e)

documents classified SECRET UE/EU SECRET or above shall bear a copy number on every page, if they are to be distributed in several copies.

(a)

military, government or diplomatic courier, as appropriate;

(b)

hand carriage, provided that:

(c)

postal services or commercial courier services, provided that:

(a)

military or diplomatic courier;

(b)

hand carriage, provided that:

(a)

inspection in accordance with Article 9(3) and Article 15(2)(e), (f) and (g); or

(b)

assessment visit in accordance with Article 12(5),

(a)

ensure that the required minimum standards for protecting EUCI laid down in this Decision are respected;

(b)

emphasise the importance of security and effective risk management within the entities inspected;

(c)

recommend countermeasures to mitigate the specific impact of loss of confidentiality, integrity or availability of classified information; and

(d)

reinforce security authorities’ ongoing security education and awareness programmes.

(a)

the draft inspection report will be forwarded to the NSA concerned to verify that it is factually correct and that it contains no information classified higher than RESTREINT UE/EU RESTRICTED;

(b)

unless the Member State NSA in question requests general distribution to be withheld, inspection reports shall be circulated to members of the Security Committee and to the ECSD; the report shall be classified RESTREINT UE/EU RESTRICTED.

Authenticity

:

the guarantee that information is genuine and from bona fide sources;

Availability

:

the property of being accessible and usable upon request by an authorised entity;

Confidentiality

:

the property that information is not disclosed to unauthorised individuals, entities or processes;

Integrity

:

the property of safeguarding the accuracy and completeness of information and assets;

Non-repudiation

:

the ability to prove an action or event has taken place, so that this event or action cannot subsequently be denied.

(a)

that security failures may significantly harm the CIS;

(b)

the potential harm to others which may arise from interconnectivity and interdependency; and

(c)

their individual responsibility and accountability for the security of CIS according to their roles within the systems and processes.

(a)

business or operational requirements for such interconnections shall be stated and approved by the competent authorities;

(b)

the interconnection shall undergo a risk management and accreditation process and shall require the approval of the competent SAAs; and

(c)

Boundary Protection Services (BPS) shall be implemented at the perimeter of all CIS.

(a)

the sender and recipient do not have the required encryption facility or have no encryption facility; and

(b)

the classified material cannot be conveyed in time by other means.

(a)

developing IA security policies and security guidelines and monitoring their effectiveness and pertinence;

(b)

safeguarding and administering technical information related to cryptographic products;

(c)

ensuring that IA measures selected for protecting EUCI comply with the relevant policies governing their eligibility and selection;

(d)

ensuring that cryptographic products are selected in compliance with policies governing their eligibility and selection;

(e)

coordinating training and awareness on IA;

(f)

consulting with the system provider, the security actors and representatives of users in respect to IA security policies and security guidelines; and

(g)

ensuring appropriate expertise is available in the expert sub-area of the Security Committee for IA issues.

(a)

managing and accounting for EU crypto material;

(b)

ensuring that appropriate procedures are enforced and channels established for accounting, secure handling, storage and distribution of all EU crypto material; and

(c)

ensuring the transfer of EU crypto material to or from individuals or services using it.

(a)

ensuring that CIS comply with the relevant security policies and security guidelines, providing a statement of approval for CIS to handle EUCI to a defined level of classification in its operational environment, stating the terms and conditions of the accreditation, and criteria under which re-approval is required;

(b)

establishing a security accreditation process, in accordance with the relevant policies, clearly stating the approval conditions for CIS under its authority;

(c)

defining a security accreditation strategy setting out the degree of detail for the accreditation process commensurate with the required level of assurance;

(d)

examining and approving security-related documentation, including risk management and residual risk statements, system-specific security requirement statements (hereinafter referred to as ‘SSRSs’), security implementation verification documentation and security operating procedures (hereinafter referred to as ‘SecOPs’), and ensuring that it complies with the Council’s security rules and policies;

(e)

checking implementation of security measures in relation to the CIS by undertaking or sponsoring security assessments, inspections or reviews;

(f)

defining security requirements (e.g. personnel clearance levels) for sensitive positions in relation to the CIS;

(g)

endorsing the selection of approved cryptographic and TEMPEST products used to provide security for a CIS;

(h)

approving, or where relevant, participating in the joint approval of the interconnection of a CIS to other CIS; and

(i)

consulting the system provider, the security actors and representatives of the users with respect to security risk management, in particular the residual risk, and the terms and conditions of the approval statement.

(a)

developing security documentation in line with security policies and security guidelines, in particular the SSRS including the residual risk statement, the SecOPs and the crypto plan within the CIS accreditation process;

(b)

participating in selecting and testing the system-specific technical security measures, devices and software, to supervise their implementation and to ensure that they are securely installed, configured and maintained in accordance with the relevant security documentation;

(c)

participating in selecting TEMPEST security measures and devices if required in the SSRS and ensuring that they are securely installed and maintained in cooperation with the TA;

(d)

monitoring implementation and application of the SecOps and, where appropriate, delegating operational security responsibilities to the system owner;

(e)

managing and handling cryptographic products, ensuring the custody of crypto and controlled items and, if so required, ensuring the generation of cryptographic variables;

(f)

conducting security analysis reviews and tests, in particular to produce the relevant risk reports, as required by the SAA;

(g)

providing CIS-specific IA training;

(h)

implementing and operating CIS-specific security measures.

(a)

in preparing an SCG, the GSC shall take into account all relevant security aspects, including the security classification assigned to information provided and approved to be used for the contract by the originator of the information;

(b)

the overall level of classification of the contract may not be lower than the highest classification of any of its elements; and

(c)

where relevant, the GSC shall liaise with the Member States’ NSAs/DSAs or any other competent security authority concerned in the event of any changes regarding the classification of information created by or provided to contractors in the performance of a contract and when making any subsequent changes to the SCG.

(a)

evaluate the integrity of the industrial or other entity;

(b)

evaluate ownership, control, or the potential for undue influence that may be considered a security risk;

(c)

verify that the industrial or any other entity has established a security system at the facility which covers all appropriate security measures necessary for the protection of information or material classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET in accordance with the requirements laid down in this Decision;

(d)

verify that the personnel security status of management, owners and employees who are required to have access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET has been established in accordance with the requirements laid down in this Decision;

(e)

verify that the industrial or any other entity has appointed a Facility Security Officer who is responsible to its management for enforcing the security obligations within such an entity.

(a)

security shall be assured at all stages during transportation from the point of origin to the final destination;

(b)

the degree of protection afforded to a consignment shall be determined by the highest classification level of material contained within it;

(c)

an FSC at the appropriate level shall be obtained for companies providing transportation. In such cases, personnel handling the consignment shall be security cleared in accordance with Annex I;

(d)

prior to any cross-border movement of material classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET, a transportation plan shall be drawn up by the consignor and approved by the NSA/DSAs or any other competent security authority concerned;

(e)

journeys shall be point to point to the extent possible, and shall be completed as quickly as circumstances permit;

(f)

whenever possible, routes should be only through Member States. Routes through States other than Member States should only be undertaken when authorised by the NSA/DSA or any other competent security authority of the States of both the consignor and the consignee.

—

a security of information agreement shall be concluded, or

—

an administrative arrangement shall be entered into,

—

a framework participation agreement,

—

an ad hoc participation agreement, or

—

in the absence of either of the above, an ad hoc administrative arrangement.

(a)

the regulatory framework applicable for protecting classified information;

(b)

any specific features of the security policy and the way in which security is organised in the third State or international organisation which may have an impact on the level of classified information that may be exchanged;

(c)

the security measures and procedures actually in place; and

(d)

security clearance procedures for the level of EUCI to be released.

(a)

to the extent possible, verify with the security authorities of the third State or international organisation concerned that its security regulations, structures and procedures are such that EUCI released to it will be protected to standards no less stringent than those laid down in this Decision;

(b)

invite the Security Committee, on the basis of available information, to issue a recommendation regarding the confidence that can be placed in the security regulations, structures and procedures in the third State or international organisation to which the EUCI is to be released.

(a)

for matters relating to CFSP/CSDP, the Political and Security Committee shall discuss the matter and formulate a recommendation for a decision by COREPER;

(b)

for all other matters, COREPER shall discuss the matter and take a decision.

—

‘EU Personnel Security Clearance’ (EU PSC) for access to EUCI means an authorisation by the GSC Appointing Authority which is taken in accordance with this Decision following completion of a security investigation conducted by the competent authorities of a Member State and which certifies that an individual may, provided his ‘need-to-know’ has been determined, be granted access to EUCI up to a specified level (CONFIDENTIEL UE/EU CONFIDENTIAL or above) until a specified date; the individual thus described is said to be ‘security cleared’,

—

‘National Personnel Security Clearance’ (national PSC) for access to EUCI means a statement by a competent authority of a Member State which is made following completion of a security investigation conducted by the competent authorities of a Member State and which certifies that an individual may, provided his ‘need-to-know’ has been determined, be granted access to EUCI up to a specified level (CONFIDENTIEL UE/EU CONFIDENTIAL or above) until a specified date; the individual thus described is said to be ‘security cleared’;

—

‘Risk acceptance’ is the decision to agree to the further existence of a residual risk after risk treatment.

—

‘Risk assessment’ consists of identifying threats and vulnerabilities and conducting the related risk analysis, i.e. the analysis of probability and impact.

—

‘Risk communication’ consists of developing awareness of risks among CIS user communities, informing approval authorities such risks and reporting them to operating authorities.

—

‘Risk treatment’ consists of mitigating, removing, reducing (through an appropriate combination of technical, physical, organisational or procedural measures), transferring or monitoring the risk.

—

‘Dedicated mode’ means a mode of operation in which all individuals with access to the CIS are cleared to the highest classification level of information handled within the CIS, and with a common need-to-know for all of the information handled within the CIS,

—

‘System-high mode’ means a mode of operation in which all individuals with access to the CIS are cleared to the highest classification level of information handled within the CIS, but not all individuals with access to the CIS have a common need-to-know for the information handled within the CIS; approval to access information may be granted by an individual,

—

‘Compartmented mode’ means a mode of operation in which all individuals with access to the CIS are cleared to the highest classification level of information handled within the CIS, but not all individuals with access to the CIS have a formal authorisation to access all of the information handled within the CIS; formal authorisation implies a formal central management of access control as distinct from an individual’s discretion to grant access,

—

‘Multilevel mode’ means a mode of operation in which not all individuals with access to the CIS are cleared to the highest classification level of information handled within the CIS, and not all individuals with access to the CIS have a common need-to-know for the information handled within the CIS;