2001D0844 — EN — 05.08.2006 — 003.001

---

This document is meant purely as a documentation tool and the institutions do not assume any liability for its contents

►B	COMMISSION DECISION of 29 November 2001 amending its internal Rules of Procedure (notified under document number C(2001) 3031) (2001/844/EC, ECSC, Euratom) (OJ L 317, 3.12.2001, p.1)

Amended by:

		Official Journal
		No	page	date
►M1	COMMISSION DECISION of 3 February 2005	L 31	66	4.2.2005
►M2	COMMISSION DECISION of 31 January 2006	L 34	32	7.2.2006
►M3	COMMISSION DECISION of 2 August 2006	L 215	38	5.8.2006

---

▼B

COMMISSION DECISION

of 29 November 2001

amending its internal Rules of Procedure

(notified under document number C(2001) 3031)

(2001/844/EC, ECSC, Euratom)

Article 1

The Commission's provisions on security, the text of which is annexed to this Decision, are hereby added to the Commission's Rules of Procedure as an annex.

Article 2

This Decision shall enter into force on the day of its publication in the Official Journal of the European Communities.

It shall apply from 1 December 2001.

---

ANNEX

COMMISSION PROVISIONS ON SECURITY

Whereas:

▼M2

▼B

Article 1

The Commission's rules on security are set out in the Annex.

Article 2

1.  The Member of the Commission responsible for security matters shall take appropriate measures to ensure that, when handling EU classified information, the rules referred to in Article 1 are respected within the Commission by Commission officials and other servants, by personnel seconded to the Commission, as well as within all Commission premises, including its Representations and Offices in the Union and its Delegations in third countries and by contractors external to the Commission.

▼M3

When a contract or grant agreement between the Commission and an external contractor or beneficiary involves the processing of EU classified information in the contractor's or beneficiary's premises, the appropriate measures to be taken by the said external contractor or beneficiary to ensure that the rules referred to in Article 1 are complied with, when handling EU classified information, shall be an integral part of the contract or grant agreement.

▼B

2.  Member States, other institutions, bodies, offices and agencies established by virtue or on the basis of the Treaties shall be allowed to receive EU classified information on the condition that they ensure that, when EU classified information is handled, rules strictly equivalent to those referred to in Article 1 are respected within their services and premises, in particular by:

Article 3

Third states, international organisations and other bodies shall be allowed to receive EU classified information on the condition that they ensure that, when such information is handled, rules strictly equivalent to those referred to in Article 1 are respected.

Article 4

In keeping with the basic principles and minimum standards of security contained in Part I of the Annex, the Member of the Commission responsible for security matters may take measures in accordance with Part II of the Annex.

Article 5

As from the date of their application, these provisions shall replace:

Article 6

As from the date of application of these provisions, all classified information held by the Commission until that date, with the exception of Euratom classified information, shall:

---

ANNEX

RULES ON SECURITY

Contents
PART I:	BASIC PRINCIPLES AND MINIMUM STANDARDS OF SECURITY
1.	INTRODUCTION
2.	GENERAL PRINCIPLES
3.	FOUNDATIONS OF SECURITY
4.	PRINCIPLES OF INFORMATION SECURITY
4.1.	Objectives
4.2.	Definitions
4.3.	Classification
4.4.	Aims of security measures
5.	ORGANISATION OF SECURITY
5.1.	Common minimum standards
5.2.	Organisation
6.	SECURITY OF PERSONNEL
6.1.	Clearance of personnel
6.2.	Records of personnel clearances
6.3.	Security instruction of personnel
6.4.	Management responsibilities
6.5.	Security status of personnel
7.	PHYSICAL SECURITY
7.1.	Need for protection
7.2.	Checking
7.3.	Security of buildings
7.4.	Contingency plans
8.	SECURITY OF INFORMATION
9.	COUNTER-SABOTAGE AND CONTROL OF OTHER FORMS OF MALICIOUS WILFUL DAMAGE
10.	RELEASE OF CLASSIFIED INFORMATION TO THIRD STATES OR INTERNATIONAL ORGANISATIONS
PART II:	THE ORGANISATION OF SECURITY IN THE COMMISSION
11.	THE MEMBER OF THE COMMISSION RESPONSIBLE FOR SECURITY MATTERS
12.	THE COMMISSION SECURITY POLICY ADVISORY GROUP
13.	THE COMMISSION SECURITY BOARD
14.	THE ►M2  COMMISSION SECURITY DIRECTORATE ◄
15.	SECURITY INSPECTIONS
16.	CLASSIFICATIONS, SECURITY DESIGNATORS AND MARKINGS
16.1.	Levels of classification
16.2.	Security designators
16.3.	Markings
16.4.	Affixing of classification
16.5.	Affixing of security designators
17.	CLASSIFICATION MANAGEMENT
17.1.	General
17.2.	Application of classifications
17.3.	Downgrading and declassification
18.	PHYSICAL SECURITY
18.1.	General
18.2.	Security requirements
18.3.	Physical security measures
18.3.1.	Security areas
18.3.2.	Administrative area
18.3.3.	Entry and exit controls
18.3.4.	Guard patrols
18.3.5.	Security containers and strong rooms
18.3.6.	Locks
18.3.7.	Control of keys and combinations
18.3.8.	Intrusion detection devices
18.3.9.	Approved equipment
18.3.10.	Physical protection of copying and telefax machines
18.4.	Protection against overlooking and eavesdropping
18.4.1.	Overlooking
18.4.2.	Eavesdropping
18.4.3.	Introduction of electronic and recording equipment
18.5.	Technically secure areas
19.	GENERAL RULES ON THE NEED TO KNOW PRINCIPLE AND EU PERSONAL SECURITY CLEARANCES
19.1.	General
19.2.	Specific rules on access to TRES SECRET UE/EU TOP SECRET information
19.3.	Specific rules on access to SECRET UE and CONFIDENTIEL UE information
19.4.	Specific rules on access to RESTREINT UE information
19.5.	Transfers
19.6.	Special instructions
20.	SECURITY CLEARANCE PROCEDURE FOR COMMISSION OFFICIALS AND OTHER EMPLOYEES
21.	PREPARATION, DISTRIBUTION, TRANSMISSION, COURRIER PERSONAL SECURITY AND EXTRA COPIES OR TRANSLATIONS AND EXTRACTS OF EU CLASSIFIED DOCUMENTS
21.1.	Preparation
21.2.	Distribution
21.3.	Transmission of EU classified documents
21.3.1.	Packaging, receipts
21.3.2.	Transmission within a building or group of buildings
21.3.3.	Transmission within a country
21.3.4.	Transmission from one State to another
21.3.5.	Transmission of RESTREINT UE documents
21.4.	Courier personnel security
21.5.	Electronic and other means of technical transmission
21.6.	Extra copies and translations of and extracts from EU classified documents
22.	EUCI REGISTRIES, MUSTERS, CHECKS, ARCHIVE STORAGE AND DESTRUCTION OF EUCI
22.1.	Local EUCI Registries
22.2.	The TRES SECRET UE/EU TOP SECRET Registry
22.2.1.	General
22.2.2.	The Central TRES SECRET UE/EU TOP SECRET Registry
22.2.3.	TRES SECRET UE/EU TOP SECRET sub-registries
22.3.	Inventories, musters and checks of EU classified documents
22.4.	Archive storage of EU classified documents
22.5.	Destruction of EU classified documents
22.6.	Destruction in emergencies
23.	SECURITY MEASURES FOR SPECIFIC MEETINGS HELD OUTSIDE THE COMMISSION PREMISES AND INVOLVING EU CLASSIFIED INFORMATION
23.1.	General
23.2.	Responsibilities
23.2.1.	The ►M2  Commission Security Directorate ◄
23.2.2.	Meeting Security Officer (MSO)
23.3	Security measures
23.3.1.	Security areas
23.3.2.	Passes
23.3.3.	Control of photographic and audio equipment
23.3.4.	Checking of briefcases, portable computers and packages
23.3.5.	Technical security
23.3.6.	Delegations' documents
23.3.7.	Safe custody of documents
23.3.8.	Inspection of offices
23.3.9.	Disposal of EU classified waste
24.	BREACHES OF SECURITY AND COMPROMISE OF EU CLASSIFIED INFORMATION
24.1.	Definitions
24.2.	Reporting breaches of security
24.3.	Legal action
25.	PROTECTION OF EU CLASSIFIED INFORMATION HANDLED IN INFORMATION TECHNOLOGY AND COMMUNICATION SYSTEMS
25.1.	Introduction
25.1.1.	General
25.1.2.	Threats to, and vulnerabilities of systems
25.1.3.	Main purpose of security measures
25.1.4.	System-specific security requirement statement (SSRS)
25.1.5.	Security modes of operation
25.2.	Definitions
25.3.	Security responsibilities
25.3.1.	General
25.3.2.	The Security accreditation authority (SAA)
25.3.3.	The INFOSEC Authority (IA)
25.3.4.	The Technical Systems Owner (TSO)
25.3.5.	The Information Owner (IO)
25.3.6.	Users
25.3.7.	INFOSEC training
25.4.	Non technical security measures
25.4.1.	Personnel security
25.4.2.	Physical security
25.4.3.	Control of access to a system
25.5.	Technical security measures
25.5.1.	Security of information
25.5.2.	Control and accountability of information
25.5.3.	Handling and control of removable computer storage media
25.5.4.	Declassification and destruction of computer storage media
25.5.5.	Communications security
25.5.6.	Installation and radiation security
25.6.	Security during handling
25.6.1.	Security operating procedures (SecOPs)
25.6.2.	Software protection/configuration management
25.6.3.	Checking for the presence of malicious software/computer viruses
25.6.4.	Maintenance
25.7.	Procurement
25.7.1.	General
25.7.2.	Accreditation
25.7.3.	Evaluation and certification
25.7.4.	Routine checking of security features for continued accreditation
25.8.	Temporary or occasional use
25.8.1.	Security of microcomputers/personal computers
25.8.2.	Use of privately-owned IT equipment for official Commission work
25.8.3.	Use of contractor-owned or nationally-supplied IT equipment for official Commission work
26.	RELEASE OF EU CLASSIFIED INFORMATION TO THIRD STATES OR INTERNATIONAL ORGANISATIONS
26.1.1.	Principles regulating the release of EU classified information
26.1.2.	Levels
26.1.3.	Security agreements
APPENDIX 1:	Comparison of national security classifications
APPENDIX 2:	Practical classification guide
APPENDIX 3:	Guidelines for the release of EU classified information to third States or international organisations: Level 1 cooperation
APPENDIX 4:	Guidelines for the release of EU classified information to third States or international organisations: Level 2 cooperation
APPENDIX 5:	Guidelines for the release of EU classified information to third States or international organisations: Level 3 cooperation
APPENDIX 6:	List of abbreviations

PART I:   BASIC PRINCIPLES AND MINIMUM STANDARDS OF SECURITY

1.   INTRODUCTION

These provisions lay down the basic principles and minimum standards of security to be respected in an appropriate manner by the Commission in all its places of employment, as well as by all recipients of EUCI, so that security is safeguarded and each may be assured that a common standard of protection is established.

2.   GENERAL PRINCIPLES

The Commission's security policy forms an integral part of its general internal management policy and is thus based on the principles governing its general policy.

These principles include legality, transparency, accountability and subsidiarity (proportionality).

Legality indicates the need to stay strictly within the legal framework in executing security functions and the need to conform to the legal requirements. It also means that responsibilities in the domain of security have to be based on proper legal provisions. The provisions in the Staff Regulations fully apply, notably its Article 17 on the obligation of staff to exercise discretion with regard to Commission information and its Title VI on disciplinary measures. Finally it means that breaches of security within the responsibility of the Commission have to be dealt with in a manner consistent with Commission policy on disciplinary actions and with its policy on cooperation with Member States in the area of criminal justice.

Transparency indicates the need for clarity regarding all security rules and provisions, for balance between the different services and the different domains (physical security versus information protection etc.) and the need for a consistent and structured security awareness policy. It also defines a need for clear written guidelines for implementing security measures.

Accountability means that responsibilities in the domain of security will be clearly defined. Moreover it indicates the need to test regularly whether these responsibilities have been correctly executed.

Subsidiarity, or proportionality, means that security shall be organised on the lowest possible level and as close as possible to the Directorates General and services of the Commission. It also indicates that security activities shall be limited to only those elements that really need it. And finally it means that security measures shall be proportional to the interests to be protected and to the actual or potential threat to these interests, allowing for a defence which causes the least possible disruption.

3.   FOUNDATIONS OF SECURITY

The foundations of sound security are:

4.   PRINCIPLES OF INFORMATION SECURITY

4.1.   Objectives

Information security has the following principal objectives:

4.2.   Definitions

Throughout these rules:

4.3.   Classification

4.4.   Aims of security measures

The security measures shall:

5.   ORGANISATION OF SECURITY

5.1.   Common minimum standards

The Commission shall ensure that common minimum standards of security are observed by all recipients of EUCI, inside the institution and under its competence, e.g. by all departments and contractors, so that EU classified information can be passed in the confidence that it will be handled with equal care. Such minimum standards shall include criteria for the clearance of personnel, and procedures for the protection of EU classified information.

The Commission shall only allow access of EUCI to outside bodies under the condition that they ensure that, when EUCI is handled, provisions at least strictly equivalent to these minimum standards are respected.

▼M3

Such minimum standards shall also be applied when the Commission confers by contract or grant agreement, tasks involving, entailing and/or containing EU classified information on industrial or other entities: these common minimum standards are contained in Section 27 of Part II.

▼B

5.2.   Organisation

Within the Commission security is organised on two levels:

6.   SECURITY OF PERSONNEL

6.1.   Clearance of personnel

All persons who require access to information classified ►M1  CONFIDENTIEL UE ◄ or above shall be appropriately cleared before such access is authorised. Similar clearance shall be required in the case of persons whose duties involve the technical operation or maintenance of communication and information systems containing classified information. This clearance shall be designed to determine whether such individuals:

Particularly close scrutiny in the clearance procedures shall be given to persons:

In the circumstances outlined in subparagraphs (d), (e) and (f), the fullest practicable use shall be made of the technique of background investigation.

When persons not having an established ‘need to know’ are to be employed in circumstances in which they may have access to EU classified information (e.g. messengers, security agents, maintenance personnel and cleaners, etc.), they shall first be appropriately security-cleared.

6.2.   Records of personnel clearances

All Commission departments handling EU classified information or housing secure communication or information systems shall maintain a record of the clearances granted to the personnel assigned thereto. Each clearance shall be verified as the occasion demands to ensure that it is adequate for that person's current assignment; it shall be re-examined as a matter of priority whenever new information is received indicating that continued assignment on classified work is no longer consistent with the interests of security. The Local Security Officer of the Commission department shall hold record of the clearances within his or her domain.

6.3.   Security instruction of personnel

All personnel employed in positions where they could have access to classified information shall be thoroughly instructed on taking up assignment and at regular intervals in the need for security and the procedures for accomplishing it. Such personnel are required to certify in writing that they have read and fully understand the present security provisions.

6.4.   Management responsibilities

Managers shall have the duty of knowing those of their staff who are engaged in classified work or who have access to secure communication or information systems and of recording and reporting any incidents or apparent vulnerabilities, likely to have a bearing on security.

6.5.   Security status of personnel

Procedures shall be established to ensure that, when adverse information becomes known concerning an individual, it is determined whether the individual is employed on classified work or has access to secure communication or information systems, and the ►M2  Commission Security Directorate ◄ is informed. If it is established that such an individual constitutes a security risk, he or she shall be barred or removed from assignments where he or she might endanger security.

7.   PHYSICAL SECURITY

7.1.   Need for protection

The degree of physical security measures to be applied to ensure the protection of EU classified information shall be proportional to the classification, volume of and threat to the information and material held. All holders of EU classified information shall follow uniform practices regarding classification of that information and meet common standards of protection regarding custody, transmission and disposal of information and material requiring protection.

7.2.   Checking

Before leaving areas containing EU classified information unattended, persons having custody thereof shall ensure that it is securely stored and that all security devices have been activated (locks, alarms, etc.). Further independent checks shall be carried out after working hours.

7.3.   Security of buildings

Buildings housing EU classified information or secure communication and information systems shall be protected against unauthorised access. The nature of the protection afforded to EU classified information, e.g. barring of windows, locks for doors, guards at entrances, automated access control systems, security checks and patrols, alarm systems, intrusion detection systems and guard dogs, shall depend on:

The nature of the protection afforded to communication and information systems shall similarly depend upon an assessment of the value of the assets at stake and of the potential damage if security were compromised, upon the physical nature and location of the building in which the system is housed, and upon the location of the system within the building.

7.4.   Contingency plans

Detailed plans shall be prepared in advance for the protection of classified information during a local or national emergency.

8.   SECURITY OF INFORMATION

Information security (INFOSEC) relates to the identification and application of security measures to protect EU classified information processed, stored or transmitted in communication, information and other electronic systems against loss of confidentiality, integrity or availability, whether accidental or intentional. Adequate countermeasures shall be taken in order to prevent access to EU classified information by unauthorised users, to prevent the denial of access to EU classified information to authorised users, and to prevent corruption or unauthorised modification or deletion of EU classified information.

9.   COUNTER-SABOTAGE AND CONTROL OF OTHER FORMS OF MALICIOUS WILFUL DAMAGE

Physical precautions for the protection of important installations housing classified information are the best protective security safeguards against sabotage and malicious wilful damage, and clearance of personnel alone is not an effective substitute. The competent national body shall be asked to provide intelligence regarding espionage, sabotage, terrorism and other subversive activities.

10.   RELEASE OF CLASSIFIED INFORMATION TO THIRD STATES OR INTERNATIONAL ORGANISATIONS

The decision to release EU classified information originating in the Commission to a third State or international organisation shall be taken by the Commission as a college. If the originator of the information for which release is desired is not the Commission, the Commission shall first seek the originator's consent to release. If the originator cannot be established, the Commission will assume the former's responsibility.

If the Commission receives classified information from third States, from international organisations or from other third parties, that information shall be given protection appropriate to its classification and equivalent to the standards established in these provisions for EU classified information, or such higher standards as may be required by the third party releasing the information. Mutual checks may be arranged.

The above principles shall be implemented in accordance with the detailed provisions set out in Part II, Section 26, and Appendixes 3, 4 and 5.

PART II:   THE ORGANISATION OF SECURITY IN THE COMMISSION

11.   THE MEMBER OF THE COMMISSION RESPONSIBLE FOR SECURITY MATTERS

The Member of the Commission responsible for security matters shall:

In particular, the Member of the Commission responsible for security matters shall be responsible for:

12.   THE COMMISSION SECURITY POLICY ADVISORY GROUP

A Commission Security Policy Advisory Group shall be set up. It shall consist of the Member of the Commission responsible for security matters or his/her delegate, who shall have the chair, and of representatives of the NSA of each Member State. Representatives of other European institutions may also be invited. Representatives of relevant EC and EU decentralised agencies may also be invited to attend when questions concerning them are discussed.

The Commission Security Policy Advisory Group shall meet at the request of its chair or any of its members. The Group shall have the task to examine and assess all relevant security issues, and to present recommendations to the Commission as appropriate.

▼M2

13.   THE COMMISSION SECURITY BOARD

A Commission Security Board shall be set up. It shall consist of the Director-General for Administration and Personnel, who shall have the chair, a Member of the Cabinet of the Commissioner responsible for security matters, a Member of the Cabinet of the President, the Deputy Secretary-General who chairs the Commission crisis management group, the Directors-General of the Legal Service, External Relations, Justice, Freedom and Security, the Joint Research Centre, Informatics and the Internal Audit Service and the Director of the Commission Security Directorate, or their representatives. Other Commission officials may be invited. Its remit is to assess security measures within the Commission and to make recommendations in this domain to the Member of the Commission responsible for security matters.

▼B

14.   THE ►M2  COMMISSION SECURITY DIRECTORATE ◄

In order to fulfil the responsibilities mentioned in Section 11 the Member of the Commission responsible for security matters shall have the ►M2  Commission Security Directorate ◄ at his or her disposal for co-ordinating, supervising and implementing security measures.

The ►M2  Director of the Commission Security Directorate ◄ shall be the principal adviser to the Member of the Commission responsible for security matters on security matters and shall act as secretary to the Security Policy Advisory Group. In this regard he or she shall direct the updating of the security regulations and co-ordinate security measures with the competent authorities of the Member States and, as appropriate, with international organisations linked to the Commission by security agreements. To that effect, he/she shall act as a liaison officer.

The ►M2  Director of the Commission Security Directorate ◄ shall be responsible for the accreditation of IT systems and networks within the Commission. The ►M2  Director of the Commission Security Directorate ◄ shall decide, in agreement with the relevant NSA, on the accreditation of IT systems and networks involving the Commission on the one hand, and on the other hand any other recipient of EU classified information.

15.   SECURITY INSPECTIONS

Periodic inspections of the security arrangements for the protection of EU classified information shall be carried out by the ►M2  Commission Security Directorate ◄ .

The ►M2  Commission Security Directorate ◄ may be assisted in this task by the security services of other EU institutions holding EUCI or by Member State National Security Authorities ( 5 ).

At the request of a Member State an inspection of EUCI can be conducted by its NSA within the Commission, jointly with the ►M2  Commission Security Directorate ◄ and in mutual agreement.

16.   CLASSIFICATIONS, SECURITY DESIGNATORS AND MARKINGS

16.1.   Levels of classification ( 6 )

Information is classified at the following levels (see also, Appendix 2):

No other classifications are permitted.

16.2.   Security designators

To set limits to the validity of a classification (for classified information signifying automatic downgrading or declassification) an agreed security designator may be used. This designator shall either be ‘UNTIL …(time/date)’ or ‘UNTIL …(event)’.

Additional security designators such as CRYPTO or any other EU-recognised security designator, shall apply where there is a need for limited distribution and special handling in addition to that designated by the security classification.

Security designators shall only be used in combination with a classification.

16.3.   Markings

A marking may be used for specifying the field covered by the document or a particular distribution on a need-to-know basis, or (for non-classified information) to signify the end of an embargo.

A marking is not a classification and must not be used in lieu of one.

The ESDP marking shall be applied to documents and copies thereof concerning the security and defence of the Union or of one or more of its Member States, or concerning military or non-military crisis management.

16.4.   Affixing of classification

Classification shall be affixed as follows:

16.5.   Affixing of security designators

Security designators shall be affixed directly under the classification, by the same means as those for affixing classifications.

17.   CLASSIFICATION MANAGEMENT

17.1.   General

Information shall be classified only when necessary. The classification shall be clearly and correctly indicated, and shall be maintained only as long as the information requires protection.

The responsibility for classifying information and for any subsequent downgrading or declassification rests solely with the originator.

Officials and other employees of the Commission shall classify, downgrade or declassify information on instruction from or with the agreement of their Head of department.

The detailed procedures for the treatment of classified documents have been so framed as to ensure that they are subject to protection appropriate to the information they contain.

The number of persons authorised to originate ►M1  TRES SECRET UE/EU TOP SECRET ◄ documents shall be kept to a minimum, and their names kept on a list drawn up by the ►M2  Commission Security Directorate ◄ .

17.2.   Application of classifications

The classification of a document shall be determined by the level of sensitivity of its contents in accordance with the definition at Section 16. It is important that classification is correctly and sparingly used. This applies especially to ►M1  TRES SECRET UE/EU TOP SECRET ◄ classification.

The originator of a document that is to be given a classification shall bear in mind the rules set out above and curb any tendency to over- or under-classify.

A practical guide for the classification is contained in Appendix 2.

Individual pages, paragraphs, sections, annexes, appendices, attachments and enclosures of a given document may require different classifications and shall be classified accordingly. The classification of the document as a whole shall be that of its most highly classified part.

The classification of a letter or note covering enclosures shall be as high as the highest classification of its enclosures. The originator should indicate clearly at which level it should be classified when detached from its enclosures.

Public access shall remain governed by Regulation (EC) No 1049/2001.

17.3.   Downgrading and declassification

EU classified documents may be downgraded or declassified only with the permission of the originator, and, if necessary, after discussion with other interested parties. Downgrading or declassification shall be confirmed in writing. The originator shall be responsible for informing its addressees of the change, and they in turn shall be responsible for informing any subsequent addressees, to whom they have sent or copied the document, of the change.

If possible, originators shall specify on classified documents a date, period or event when the contents may be downgraded or declassified. Otherwise, they shall keep the documents under review every five years, at the latest, in order to ensure that the original classification is necessary.

18.   PHYSICAL SECURITY

18.1.   General

The main objectives of physical security measures are to prevent an unauthorised person from gaining access to EU classified information and/or material, to prevent theft and degradation of equipment and other property and to prevent harassment or any other type of aggression of staff, other employees and visitors.

18.2.   Security requirements

All premises, areas, buildings, rooms, communication and information systems, etc. in which EU classified information and material is stored and/or handled shall be protected by appropriate physical security measures.

In deciding what degree of physical security protection is necessary, account shall be taken of all relevant factors such as:

The physical security measures applied shall be designed to:

18.3.   Physical security measures

18.3.1.   Security areas

Areas where information classified ►M1  CONFIDENTIEL UE ◄ or higher is handled and stored shall be so organised and structured as to correspond to one of the following:

18.3.2.   Administrative area

Around or leading up to Class I or Class II security areas, an administrative area of lesser security may be established. Such an area requires a visibly defined perimeter allowing personnel and vehicles to be checked. Only ►M1  RESTREINT UE ◄ and non-classified information shall be handled and stored in such areas.

18.3.3.   Entry and exit controls

Entry and exit into and from Class I and Class II security areas shall be controlled by a pass or personal recognition system applicable to all staff normally working in these areas. A system of visitor checks designed to deny unauthorised access to EU classified information shall also be established. Pass systems may be supported by automated identification, which shall be regarded as a supplement to, but not a total replacement for, guards. A change in the threat assessment may entail a strengthening of the entry and exit control measures, for example during the visit of prominent persons.

18.3.4.   Guard patrols

Patrols of Class I and Class II security areas are to take place outside normal working hours to protect EU assets against compromise, damage or loss. The frequency of patrols will be determined by local circumstances but, as a guide, are to be conducted once every 2 hours.

18.3.5.   Security containers and strong rooms

Three classes of containers shall be used for the storage of EU classified information:

For strong rooms constructed within a Class I or a Class II security area, and for all Class I security areas where information classified ►M1  CONFIDENTIEL UE ◄ and higher is stored on open shelves or displayed on charts, maps, etc., the walls, floors and ceilings, door(s) with lock(s) need to be certified by the SAA as offering equivalent protection to the class of security container approved for the storage of information of the same classification.

18.3.6.   Locks

Locks used with security containers and strong rooms in which EU classified information is stored shall meet the following standards:

18.3.7.   Control of keys and combinations

Keys of security containers shall not be taken out of the Commission buildings. Combination settings of security containers shall be committed to memory by persons needing to know them. For use in an emergency, the Local Security Officer of the Commission department concerned shall be responsible for holding spare keys and a written record of each combination setting; the latter shall be held in separate sealed opaque envelopes. Working keys, spare security keys and combination settings shall be kept in separate security containers. These keys and combination settings should be given security protection no less stringent than the material to which they give access.

Knowledge of the combination settings of security containers shall be restricted to as few people as practicable. Combinations shall be reset:

18.3.8.   Intrusion detection devices

When alarm systems, closed circuit television and other electrical devices are used to protect EU classified information, an emergency electrical supply shall be available to ensure the continuous operation of the system if the main power supply is interrupted. Another basic requirement is that a malfunction in or tampering with such systems shall result in an alarm or other reliable warning to the surveillance personnel.

18.3.9.   Approved equipment

The ►M2  Commission Security Directorate ◄ shall maintain up-to-date lists by type and model of the security equipment that they have approved for the protection of classified information under various specified circumstances and conditions. The ►M2  Commission Security Directorate ◄ shall base these lists, inter alia, on information from NSAs.

18.3.10.   Physical protection of copying and telefax machines

Copying and telefax machines shall be physically protected to the extent necessary to ensure that only authorised persons can use them for processing classified information and that all classified products are subject to proper controls.

18.4.   Protection against overlooking and eavesdropping

18.4.1.   Overlooking

All appropriate measures shall be taken by day and by night to ensure that EU classified information is not seen, even accidentally, by any unauthorised person.

18.4.2.   Eavesdropping

Services or areas in which information classified ►M1  SECRET UE ◄ and above is regularly discussed shall be protected against passive and active eavesdropping attacks where the risk demands it. The assessment of the risk of such attacks shall be the responsibility of the ►M2  Commission Security Directorate ◄ after consultation, as necessary, with NSAs.

18.4.3.   Introduction of electronic and recording equipment

It is not permitted to introduce mobile phones, private computers, recording devices, cameras and other electronic or recording devices into security areas or technically secure areas without prior authorisation from the ►M2  Director of the Commission Security Directorate ◄ .

To determine the protective measures to be taken in premises sensitive to passive eavesdropping (e.g. insulation of walls, doors, floors and ceilings, measurement of compromising emanations) and to active eavesdropping (e.g. search for microphones), the ►M2  Commission Security Directorate ◄ may request assistance from experts from NSAs.

Likewise, when circumstances require, the telecommunications equipment and the electrical or electronic office equipment of any kind used during meetings at ►M1  SECRET UE ◄ level and above may be checked by technical security specialists of NSAs at the request of the ►M2  Director of the Commission Security Directorate ◄ .

18.5.   Technically secure areas

Certain areas may be designated as technically secure areas. A special entry check shall be carried out. Such areas shall be kept locked by an approved method when not occupied and all keys treated as security keys. Such areas shall be subject to regular physical inspections, which will also be undertaken following any unauthorised entry or suspicion of such an entry.

A detailed inventory of equipment and furniture shall be kept in order to monitor their movements. No item of furniture or equipment shall be brought into such an area until it has undergone a careful inspection by specially trained security personnel, designed to detect any listening devices. As a general rule, the installation of communication lines in technically secure areas is not permitted without prior authorisation from the appropriate authority.

19.   GENERAL RULES ON THE NEED TO KNOW PRINCIPLE AND EU PERSONAL SECURITY CLEARANCES

19.1.   General

Access to EU classified information shall be authorised only for persons having a ‘need-to-know’ for carrying out their duties or missions. Access to ►M1  TRES SECRET UE/EU TOP SECRET ◄ , ►M1  SECRET UE ◄ and ►M1  CONFIDENTIEL UE ◄ information shall be authorised only for persons in possession of the appropriate security clearance.

The responsibility for determining ‘need-to-know’ shall rest with the department in which the person concerned is to be employed.

Requesting the clearance of personnel shall be the responsibility of each department.

This will result in the issue of a ‘EU personal security certificate’ showing the level of classified information to which the cleared person may have access and the date of expiry.

An EU personal security certificate for a given classification may give the holder access to information with a lower classification.

Persons other than officials or other employees, such as external contractors, experts or consultants, with whom it may be necessary to discuss, or to whom it may be necessary to show, EU classified information, must have a EU personal security clearance as regards EU classified information and be briefed as to their responsibility for security.

Public access shall remain governed by Regulation (EC) No 1049/2001.

19.2.   Specific rules on access to ►M1  TRES SECRET UE/EU TOP SECRET ◄ information

All persons who are to have access to ►M1  TRES SECRET UE/EU TOP SECRET ◄ information shall first be screened for access to such information.

All persons who are required to have access to ►M1  TRES SECRET UE/EU TOP SECRET ◄ information shall be designated by the Member of the Commission responsible for security matters and their names kept in the appropriate ►M1  TRES SECRET UE/EU TOP SECRET ◄ registry. The ►M2  Commission Security Directorate ◄ will create and maintain this registry.

Before having access to ►M1  TRES SECRET UE/EU TOP SECRET ◄ information, all persons shall sign a certificate to the effect that they have been briefed on Commission security procedures and that they fully understand their special responsibility for safeguarding ►M1  TRES SECRET UE/EU TOP SECRET ◄ information, and the consequences which the EU rules and national law or administrative rules provide when classified information passes into unauthorised hands, either by intent or through negligence.

In the case of persons having access to ►M1  TRES SECRET UE/EU TOP SECRET ◄ information at meetings, etc., the competent Control Officer of the service or body in which that person is employed shall notify the body organising the meeting that the persons concerned have such authorisation.

The names of all persons ceasing to be employed on duties requiring access to ►M1  TRES SECRET UE/EU TOP SECRET ◄ information shall be removed from the ►M1  TRES SECRET UE/EU TOP SECRET ◄ list. In addition, the attention of all such persons shall be drawn again to their special responsibility for the safeguarding of ►M1  TRES SECRET UE/EU TOP SECRET ◄ information. They shall also sign a declaration stating that they will neither use nor pass on ►M1  TRES SECRET UE/EU TOP SECRET ◄ information in their possession.

19.3.   Specific rules on access to ►M1  SECRET UE ◄ and ►M1  CONFIDENTIEL UE ◄ information

All persons who are to have access to ►M1  SECRET UE ◄ or ►M1  CONFIDENTIEL UE ◄ information shall first be screened to the appropriate grading.

All persons who are to have access to ►M1  SECRET UE ◄ or ►M1  CONFIDENTIEL UE ◄ information shall be acquainted with the appropriate security provisions and shall be aware of the consequences of negligence.

In the case of persons having access to ►M1  SECRET UE ◄ or ►M1  CONFIDENTIEL UE ◄ information at meetings, etc., the Security Officer of the body in which that person is employed shall notify the body organising the meeting that the persons concerned have such authorisation.

19.4.   Specific rules on access to ►M1  RESTREINT UE ◄ information

Persons with access to ►M1  RESTREINT UE ◄ information will be made aware of these security rules and of the consequences of negligence.

19.5.   Transfers

When a member of staff is transferred from a post which involves the handling of EU classified material, the Registry will oversee the proper transfer of that material from the outgoing to the incoming official.

When a member of staff is transferred to another post involving the handling of EU classified material the Local Security Officer will brief him accordingly.

19.6.   Special instructions

Persons who are required to handle EU classified information should, on first taking up their duties and periodically thereafter, be made aware of:

All persons normally exposed to frequent contact with representatives of countries whose intelligence services target the EU and Member States as regards EU classified information and activities shall be given a briefing on the techniques known to be employed by various intelligence services.

There are no Commission security provisions concerning private travel to any destination by personnel cleared for access to EU classified information. The ►M2  Commission Security Directorate ◄ shall, however, acquaint the officials and other servants falling within their responsibility with travel regulations to which they may be subjected.

20.   SECURITY CLEARANCE PROCEDURE FOR COMMISSION OFFICIALS AND OTHER EMPLOYEES

21.   PREPARATION, DISTRIBUTION, TRANSMISSION, COURRIER PERSONAL SECURITY AND EXTRA COPIES OF TRANSLATIONS AND EXTRACTS OF EU CLASSIFIED DOCUMENTS

21.1.   Preparation

21.2.   Distribution

21.3.   Transmission of EU classified documents

21.3.1.   Packaging, receipts

21.3.2.   Transmission within a building or group of buildings

Within a given building or group of buildings, classified documents may be carried in a sealed envelope bearing only the addressee's name, on condition that it is carried by a person cleared to the level of classification of the documents.

21.3.3.   Transmission within a country

21.3.4.   Transmission from one State to another

21.3.5.   Transmission of ►M1  RESTREINT UE ◄ documents

No special provisions are laid down for the conveyance of ►M1  RESTREINT UE ◄ documents, except that they should be such as to ensure that they can not fall into any unauthorised person's hands.

21.4.   Courier personnel security

All couriers and messengers employed to carry ►M1  SECRET UE ◄ and ►M1  CONFIDENTIEL UE ◄ documents shall be appropriately security cleared.

21.5.   Electronic and other means of technical transmission

21.6.   Extra copies and translations of and extracts from EU classified documents

22.   EUCI REGISTRIES, MUSTERS, CHECKS, ARCHIVE STORAGE AND DESTRUCTION OF EUCI

22.1.   Local EUCI Registries

22.2.   The ►M1  TRES SECRET UE/EU TOP SECRET ◄ Registry

22.2.1.   General

22.2.2.   The Central ►M1  TRES SECRET UE/EU TOP SECRET ◄ Registry

As the Control Officer, the head of the Central ►M1  TRES SECRET UE/EU TOP SECRET ◄ Registry shall be responsible for:

22.2.3.    ►M1  TRES SECRET UE/EU TOP SECRET ◄ sub-registries

As the Control Officer, the head of an ►M1  TRES SECRET UE/EU TOP SECRET ◄ sub-registry shall be responsible for:

22.3.   Inventories, musters and checks of EU classified documents

22.4.   Archive storage of EU classified information

22.5.   Destruction of EU classified documents

22.6.   Destruction in emergencies

23.   SECURITY MEASURES FOR SPECIFIC MEETINGS HELD OUTSIDE THE COMMISSION PREMISES AND INVOLVING EU CLASSIFIED INFORMATION

23.1.   General

When Commission or other important meetings are held outside the Commission premises and where justified by the particular security requirements relating to the high sensitivity of the issues or information dealt with, the security measures described below shall be taken. These measures concern only the protection of EU classified information; other security measures may have to be planned.

23.2.   Responsibilities

23.2.1.   The ►M2  Commission Security Directorate ◄

The ►M2  Commission Security Directorate ◄ shall cooperate with the competent authorities of the Member State on whose territory the meeting is being held (the host Member State), in order to ensure the security of the Commission's or other important meetings and for the security of the delegates and their staff. As regards the protection of security, it should specifically ensure that:

The ►M2  Commission Security Directorate ◄ shall act as an adviser on security for the preparation of the meeting; it should be represented there to help and advise the Meeting Security Officer (MSO) and delegations as necessary.

Each delegation to a meeting shall be asked to designate a Security Officer, who will be responsible for dealing with security matters within his/her delegation and for maintaining liaison with the Meeting Security Officer, as well as with the ►M2  Commission Security Directorate ◄ representative as required.

23.2.2.   Meeting Security Officer (MSO)

A Meeting Security Officer shall be appointed and be responsible for the general preparation and control of general internal security measures and for coordination with the other security authorities concerned. The measures taken by the MSO shall in general relate to:

23.3.   Security measures

23.3.1.   Security areas

The following security areas shall be established:

23.3.2.   Passes

The MSO shall issue appropriate badges as requested by the delegations, according to their needs. Where required, a distinction may be made as regards access to different security areas.

The security instructions for the meeting shall require all persons concerned to wear and display their badges prominently at all times within the place of the meeting, so that they can be checked as needed by security personnel.

Apart from badge-holding participants, as few people as possible shall be admitted to the meeting place. The MSO shall only allow national delegations to receive visitors during the meeting upon their request. Visitors should be given a visitor's badge. A visitor's pass form bearing his/her name and the name of the person being visited shall be filled in. Visitors shall be accompanied at all times by a security guard or by the person being visited. The visitor's pass form shall be carried by the accompanying person, who shall return it, together with the visitor's badge, to the security personnel when the visitor leaves the meeting place.

23.3.3.   Control of photographic and audio equipment

No camera or recording equipment may be brought into a Class I security area, with the exception of equipment brought by photographers and by sound engineers duly authorised by the MSO.

23.3.4.   Checking of briefcases, portable computers and packages

Pass-holders allowed access to a security area may normally bring in their briefcases and portable computers (with own power supply only) without a check being made. In the case of packages for delegations, delegations may take delivery of the packages, which will either be inspected by the delegation Security Officer, screened by special equipment or opened by security personnel for inspection. If the MSO considers it necessary, more stringent measures for the inspection of briefcases and packages may be laid down.

23.3.5.   Technical security

The meeting room may be made technically secure by a technical security team, which may also conduct electronic surveillance during the meeting.

23.3.6.   Delegations' documents

Delegations shall be made responsible for taking EU classified documents to and from meetings. They shall also be responsible for the verification and security of those documents during their use in the premises assigned to them. The host Member States' help may be requested for the transportation of classified documents to and from the place of the meeting.

23.3.7.   Safe custody of documents

If the Commission or delegations are unable to store their classified documents in accordance with approved standards, they may lodge those documents in a sealed envelope with the Meeting Security Officer, against receipt, so that the latter can store the documents in accordance with approved standards.

23.3.8.   Inspection of offices

The Meeting Security Officer shall arrange for the Commission and delegations' offices to be inspected at the end of each working day to ensure that all EU classified documents are being kept in a safe place. If not, he/she shall take the appropriate measures.

23.3.9.   Disposal of EU classified waste

All waste shall be treated as EU classified, and waste-paper baskets or bags should be given to the Commission and delegations for its disposal. Before leaving the premises they have been assigned, the Commission and delegations shall take their waste to the Meeting Security Officer, who shall arrange for its destruction according to the rules.

At the end of the meeting, all documents held but no longer wanted by the Commission or delegations shall be treated as waste. A thorough search of Commission and delegations' premises shall be made before the security measures adopted for the meeting are lifted. Documents for which a receipt was signed shall, as far as applicable, be destroyed as prescribed in Section 22.5.

24.   BREACHES OF SECURITY AND COMPROMISE OF EU CLASSIFIED INFORMATION

24.1.   Definitions

A breach of security occurs as the result of an act or omission contrary to a Commission security provision that might endanger or compromise EU classified information.

Compromise of EU classified information occurs when it has wholly or in part fallen into the hands of unauthorised persons, i.e. who do not have either the appropriate security clearance or the necessary need-to-know or if there is the likelihood of such an event having occurred.

EU classified information may be compromised as a result of carelessness, negligence or indiscretion as well as by the activities of services which target the EU or its Member States, as regards EU classified information and activities, or by subversive organisations.

24.2.   Reporting breaches of security

All persons who are required to handle EU classified information shall be thoroughly briefed on their responsibilities in this domain. They shall report at once any breach of security that may come to their notice.

When a Local Security Officer or Meeting Security Officer discovers or is informed of a breach of security relating to EU classified information or of the loss or disappearance of EU classified material, he or she shall take timely action in order to:

It shall be the duty of each security authority, as soon as it is notified that such a breach of security may have occurred, to report the fact immediately to the ►M2  Commission Security Directorate ◄ .

Cases involving ►M1  RESTREINT UE ◄ information need to be reported only when they present unusual features.

On being informed that a breach of security has occurred, the Member of the Commission responsible for security matters shall:

The originating authority shall inform the addressees and shall give appropriate instructions.

24.3.   Legal action

Any individual who is responsible for compromising EU classified information shall be liable to disciplinary action according to the relevant rules and regulations, particularly title VI of the Staff Regulations. Such action shall be without prejudice to any further legal action.

In appropriate cases, on the basis of the report mentioned in Section 24.2, the Member of the Commission responsible for security matters shall take all necessary steps in order to allow the competent national authorities to start criminal law procedures.

25.   PROTECTION OF EU CLASSIFIED INFORMATION HANDLED IN INFORMATION TECHNOLOGY AND COMMUNICATIONS SYSTEMS

25.1.   Introduction

25.1.1.   General

The security policy and requirements shall apply to all communications and information systems and networks (hereinafter systems) handling information classified ►M1  CONFIDENTIEL UE ◄ and above. They shall be applied as a supplement to Commission Decision C (95) 1510 final of 23 November 1995 on the protection of informatics systems.

Systems handling ►M1  RESTREINT UE ◄ information also require security measures to protect the confidentiality of that information. All systems require security measures to protect the integrity and availability of those systems and of the information they contain.

The IT security policy applied by the Commission has the following elements:

25.1.2.   Threats to, and vulnerabilities of systems

A threat can be defined as a potential for the accidental or deliberate compromise of security. In the case of systems, such a compromise involves loss of one or more of the properties of confidentiality, of integrity and of availability. A vulnerability can be defined as a weakness or lack of controls that would facilitate or allow a threat actuation against a specific asset or target.

EU classified and unclassified information handled in systems in a concentrated form designed for rapid retrieval, communication and use is vulnerable to many threats. These include access to the information by unauthorised users or, conversely, denial of access to authorised users. There are also the risks of the unauthorised disclosure, corruption, modification or deletion of the information. Furthermore, the complex and sometimes fragile equipment is expensive and often difficult to repair or replace rapidly.

25.1.3.   Main purpose of security measures

The main purpose of the security measures stated in this section is to provide protection against unauthorised disclosure of EU classified information (the loss of confidentiality) and against the loss of integrity and availability of information. To achieve adequate security protection of a system handling EU classified information, the appropriate standards of conventional security shall be specified by the ►M2  Commission Security Directorate ◄ , along with appropriate special security procedures and techniques particularly designed for each system.

25.1.4.   System-specific security requirement statement (SSRS)

For all systems handling information classified ►M1  CONFIDENTIEL UE ◄ and above, a System-specific security requirement statement (SSRS) shall be required to be produced by its Technical System Owner (TSO, see Section 25.3.4) and the Information Owner (see Section 25.3.5) in cooperation with input and assistance as required from the project staff and from the ►M2  Commission Security Directorate ◄ (as INFOSEC Authority -IA, see Section 25.3.3) and approved by the Security Accreditation Authority (SAA, see Section 25.3.2).

An SSRS shall also be required where the availability and integrity of the ►M1  RESTREINT UE ◄ or unclassified information is deemed critical by the Security Accreditation Authority (SAA).

The SSRS shall be formulated at the earliest stage of a project's inception and shall be developed and enhanced as the project develops, fulfilling different roles at different stages in the project and system's life cycle.

25.1.5.   Security modes of operation

All systems handling information classified ►M1  CONFIDENTIEL UE ◄ and above shall be accredited to operate in one, or where warranted by requirements during different time periods, more than one, of the following security modes of operation, or their national equivalent:

25.2.   Definitions

‘Accreditation’ shall mean: the authorisation and approval granted to a system to process EU classified information in its operational environment.

Note:

Such accreditation should be made after all appropriate security procedures have been implemented and a sufficient level of protection of the system resources has been achieved. Accreditation should normally be made on the basis of the SSRS, including the following:

‘Central Information Security Officer’ (CISO) shall mean the official in a central IT service who coordinates and supervises security measures for centrally organised systems.

‘Certification’ shall mean: the issue of a formal statement, supported by an independent review of the conduct and results of an evaluation, of the extent to which a system meets the security requirement, or a computer security product meets pre-defined security claims.

‘Communications Security’ (COMSEC) shall mean: The application of security measures to telecommunications in order to deny unauthorised persons information of value which might be derived from the possession and study of such telecommunications or to ensure the authenticity of such telecommunications.

Note:

Such measures include cryptographic, transmission and emission security; and also include procedural, physical, personnel, document and computer security.

‘Computer Security’ (COMPUSEC) shall mean: The application of hardware, firmware and software security features to a computer system in order to protect against, or prevent, the unauthorised disclosure, manipulation, modification/deletion of information or denial of service.

‘Computer Security Product’ shall mean: A generic computer security item which is intended for incorporation into an IT system for use in enhancing, or providing for, confidentiality, integrity or availability of information handled.

‘Dedicated Security Mode of Operation’ shall mean: A mode of operation in which ALL individuals with access to the system are cleared to the highest classification level of information handled within the system, and with a common need-to-know for ALL of the information handled within the system.

Notes:

‘Evaluation’ shall mean: the detailed technical examination, by an appropriate authority, of the security aspects of a system or of a cryptographic or a computer security product.

Notes:

‘Information Owner’ (IO) shall mean the authority (Head of department) that has the responsibility for creating, processing and the use of information, including for deciding who shall be allowed to access this information.

‘Information Security’ (INFOSEC) shall mean: The application of security measures to protect information processed, stored or transmitted in communication, information and other electronic systems against loss of confidentiality, integrity or availability, whether accidental or intentional, and to prevent loss of integrity and availability of the systems themselves.

‘INFOSEC Measures’ include those of computer, transmission, emission and cryptographic security, and the detection, documentation and countering of threats to information and to the systems.

‘IT Area’ shall mean: an area that contains one or more computers, their local peripheral and storage units, control units and dedicated network and communications equipment.

Note:

This does not include a separate area in which remote peripheral devices or terminals/workstations are located even though those devices are connected to equipment in the IT area.

‘IT Network’ shall mean: organisation, geographically disseminated, of IT systems interconnected to exchange data, and comprising the components of the interconnected IT systems and their interface with the supporting data or communications networks.

Notes:

‘IT Network Security Features’ include the IT system security features of individual IT systems comprising the network together with those additional components and features associated with the network as such (for example, network communications, security identification and labelling mechanisms and procedures, access controls, programs and audit trails) needed to provide an acceptable level of protection for classified information.

‘IT System’ shall mean: Assembly of equipment, methods and procedures, and if necessary, personnel, organised to accomplish information processing functions.

Notes:

‘IT System Security Features’ comprise all hardware/firmware/software functions, characteristics, and features; operating procedures, accountability procedures, and access controls, the IT area, remote terminal/workstation area, and the management constraints, physical structure and devices, personnel and communications controls needed to provide an acceptable level of protection for classified information to be handled in an IT system.

‘Local Informatics Security Officer’ (LISO) shall mean the official in a Commission department who is responsible for coordinating and supervising security measures within his domain.

‘Multi-level Security Mode of Operation’ shall mean: A mode of operation in which NOT ALL individuals with access to the system are cleared to the highest classification level of information handled within the system, and NOT ALL individuals with access to the system have a common need-to-know for the information handled within the system.

Notes:

‘Remote Terminal/workstation Area’ shall mean: an area containing some computer equipment, its local peripheral devices or terminals/workstations and any associated communications equipment, separate from an IT area.

‘Security Operating Procedures’ shall mean the procedures produced by the Technical Systems Owner defining the principles to be adopted on security matters, the operating procedures to be followed and personnel responsibilities.

‘SYSTEM-HIGH Security Mode of Operation’ shall mean: A mode of operation in which ALL individuals with access to the system are cleared to the highest classification level of information handled within the system, but NOT ALL individuals with access to the system have a common need-to-know for the information handled within the system.

Notes:

‘A System Specific Security Requirement Statement’ (SSRS) is a complete and explicit statement of the security principles to be observed and of the detailed security requirements to be met. It is based on Commission security policy and risk assessment, or imposed by parameters covering the operational environment, the lowest level of personnel security clearance, the highest classification of information handled, the security mode of operation or user requirements. The SSRS is an integral part of project documentation submitted to the appropriate authorities for technical, budgetary and security approval purposes. In its final form, the SSRS constitutes a complete statement of what it means for the system to be secure.

‘Technical Systems Owner’ (TSO) shall mean the authority responsible for the creation, maintenance, operation and closing down of a system.

‘Tempest’ countermeasures: security measures intended to protect equipment and communication infrastructures against the compromise of classified information through unintentional electromagnetic emissions and through conductivity.

25.3.   Security responsibilities

25.3.1.   General

The advisory responsibilities of the Commission Security Policy Advisory Group, defined in Section 12, include INFOSEC issues. This Group shall organise its activities in such a way that it can provide expert advice on the above issues.

The ►M2  Commission Security Directorate ◄ shall be responsible for issuing detailed INFOSEC provisions, based on the provisions in this chapter.

In case of problems regarding security (incidents, breaches, etc.), immediate action shall be taken by the ►M2  Commission Security Directorate ◄ .

The ►M2  Commission Security Directorate ◄ shall have an INFOSEC Unit.

25.3.2.   The Security accreditation authority (SAA)

The ►M2  Director of the Commission Security Directorate ◄ shall be the Security Accreditation Authority (SAA) for the Commission. The SAA is responsible in the general area of security and in the specialised areas of INFOSEC, Communication security, Crypto security and Tempest security.

The SAA shall be responsible for ensuring the compliance of systems with the Commission's security policy. One of its tasks shall be to grant the approval of a system to handle EU classified information to a defined level of classification in its operational environment.

The jurisdiction of the Commission SAA shall cover all systems in operation within the premises of the Commission. When different components of a system come under the jurisdiction of the Commission SAA and other SAAs, all parties concerned may appoint a joint accreditation board under the coordination of the Commission SAA.

25.3.3.   The INFOSEC Authority (IA)

The ►M2  Director of the Commission Security Directorate ◄ INFOSEC Unit is the INFOSEC Authority for the Commission. The INFOSEC Authority is responsible for:

25.3.4.   The Technical Systems Owner (TSO)

The responsibility for the implementation and operation of controls and special security features of a system lies with the owner of that system, the Technical Systems Owner (TSO). For centrally owned systems a Central Informatics Security Officer (CISO) shall be nominated. Each department shall, as appropriate, nominate a Local Informatics Security Officer (LISO). The responsibility of a TSO includes the creation of the Security Operating Procedures (SecOPs) and extends throughout the life cycle of a system from the project concept stage to final disposal.

The TSO shall specify the security standards and practices to be met by the supplier of the system.

The TSO may delegate a part of its responsibilities where appropriate to a Local Informatics Security Officer. A single person may perform the various INFOSEC functions.

25.3.5.   The Information Owner (IO)

The Information Owner (IO) shall be responsible for EUCI (and other information) that is to be introduced, processed and produced in technical systems. He shall define the requirements for access to this information in systems. He may delegate this responsibility to an Information Manager or to a Database Manager within his domain.

25.3.6.   Users

All users shall be responsible for ensuring that their actions do not adversely affect the security of the system that they are using.

25.3.7.   INFOSEC training

INFOSEC education and training shall be available to all staff needing it.

25.4.   Non technical security measures

25.4.1.   Personnel security

Users of the system shall be cleared and have a need-to-know, as appropriate for the classification and content of the information handled within their particular system. Access to certain equipment or information specific to security of systems will call for special clearance issued according to Commission procedures.

The SAA shall designate all sensitive positions and specify the level of clearance and supervision required by all personnel occupying them.

Systems shall be specified and designed in a way that facilitates the allocation of duties and responsibilities to personnel so as to prevent one person having complete knowledge or control of the system security keys points.

IT and remote terminal/workstation areas in which the security of the system can be modified shall not be occupied by only one authorised official or other employee.

The security settings of a system shall only be changed by at least two authorised personnel working in conjunction.

25.4.2.   Physical security

IT and remote terminal/workstation areas (as defined in Section 25.2) in which information classified ►M1  CONFIDENTIEL UE ◄ and above is handled by IT means, or where potential access to such information is possible, shall be established as EU Class I or Class II security areas, as appropriate.

25.4.3.   Control of access to a system

All information and material which allow access control to a system shall be protected under arrangements commensurate with the highest classification and the category designation of the information to which it may give access.

When no longer used for this purpose, the access control information and material shall be destroyed pursuant to the provisions in Section 25.5.4.

25.5.   Technical security measures

25.5.1.   Security of information

It shall be incumbent upon the originator of the information to identify and classify all information-bearing documents, whether they are in the form of hard-copy output or computer storage media. Each page of hard-copy output shall be marked, at the top and bottom, with the classification. Output, whether it is the form of hard-copy or computer storage media shall have the same classification as the highest classification of the information used for its production. The way in which a system is operated may also impact on the classification of outputs of that system.

It shall be incumbent upon the Commission departments and their information holders to consider the problems of aggregation of individual elements of information, and the inferences that can be gained from the related elements, and determine whether or not a higher classification is appropriate to the totality of the information.

The fact that the information may be a brevity code, transmission code or in any form of binary representation does not provide any security protection and should not, therefore, influence the classification of the information.

When information is transferred from one system to another the information shall be protected during transfer and in the receiving system in the manner commensurate with the original classification and category of the information.

All computer storage media shall be handled in a manner commensurate with the highest classification of the stored information or the media label, and at all times shall be appropriately protected.

Re-usable computer storage media used for recording EU classified information shall retain the highest classification for which they have ever been used until that information has been properly downgraded or declassified and the media reclassified accordingly, or the media declassified or destroyed in accordance with a procedure approved by the SAA (see 25.5.4).

25.5.2.   Control and accountability of information

Automatic (audit trails) or manual logs shall be kept as a record of access to information classified ►M1  SECRET UE ◄ and above. These records shall be retained in accordance with these security rules.

EU classified outputs held within the IT area may be handled as one classified item and need not be registered, provided the material is identified, marked with its classification and controlled in an appropriate manner.

Where output is generated from a system handling EU classified information, and transmitted to a remote terminal/workstation area from an IT area, procedures, agreed by the SAA shall be established for controlling and logging the output. For ►M1  SECRET UE ◄ and above, such procedures shall include specific instructions for accountability of the information.

25.5.3.   Handling and control of removable computer storage media

All removable computer storage media classified ►M1  CONFIDENTIEL UE ◄ and above shall be handled as material and general rules will apply. Appropriate identification and classification markings need to be adapted to the specific physical appearances of the media, to enable it to be clearly recognised.

Users shall take the responsibility for ensuring that EU classified information is stored on media with the appropriate classification marking and protection. Procedures shall be established to ensure that, for all levels of EU information, the storage of information on computer storage media is being carried out in accordance with these security rules.

25.5.4.   Declassification and destruction of computer storage media

Computer storage media used for recording EU classified information may be downgraded or declassified in accordance with a procedure to be approved by the SAA.

Computer storage media that have held ►M1  TRES SECRET UE/EU TOP SECRET ◄ or special category information shall not be declassified and reused.

If computer storage media cannot be declassified or is not reusable, it shall be destroyed in accordance with the above mentioned procedure.

25.5.5.   Communications security

The ►M2  Director of the Commission Security Directorate ◄ is the Crypto Authority.

When EU classified information is transmitted electro-magnetically, special measures shall be implemented to protect the confidentiality, integrity and availability of such transmissions. The SAA shall determine the requirements for protecting transmissions from detection and interception. The information being transmitted in a communication system shall be protected based upon the requirements for confidentiality, integrity and availability.

When cryptographic methods are required to provide confidentiality, integrity and availability such methods and its associated products shall be specifically approved for the purpose by the SAA as Crypto Authority.

During transmission, the confidentiality of information classified ►M1  SECRET UE ◄ and above shall be protected by cryptographic methods or products approved by the Member of the Commission responsible for security matters after having consulted the Commission Security Policy Advisory Group. During transmission, the confidentiality of information classified ►M1  CONFIDENTIEL UE ◄ or ►M1  RESTREINT UE ◄ shall be protected by cryptographic methods or products approved by the Commission Crypto Authority after having consulted the Commission Security Policy Advisory Group.

Detailed rules applicable to the transmission of EU classified information shall be set out in specific security instructions approved by the ►M2  Commission Security Directorate ◄ after having consulted the Commission Security Policy Advisory Group.

Under exceptional operational circumstances, information classified ►M1  RESTREINT UE ◄ , ►M1  CONFIDENTIEL UE ◄ and ►M1  SECRET UE ◄ may be transmitted in clear text provided each occasion is explicitly authorised and duly registered by the Information Owner. Such exceptional circumstances are as follows:

A system shall have the capability of positively denying access to EU classified information at any or all of its remote workstations or terminals, when required either by physical disconnection or by special software features approved by the SAA.

25.5.6.   Installation and radiation security

Initial installation of systems and any major change thereto shall be so specified that installation is carried out by security cleared installers under constant supervision by technically qualified personnel who are cleared for access to EU classified information to the level equivalent to the highest classification which the system is expected to store and handle.

Systems handling information classified ►M1  CONFIDENTIEL UE ◄ and above shall be protected in such a way that their security cannot be threatened by compromising emanations and or conductivity, the study and control of which is referred to as ‘Tempest’.

Tempest countermeasures shall be reviewed and approved by the Tempest authority (see 25.3.2).

25.6.   Security during handling

25.6.1.   Security operating procedures (SecOPs)

Security Operating Procedures (SecOPs) define the principles to be adopted on security matters, the operating procedures to be followed, and personnel responsibilities. The SecOPs shall be prepared under the responsibility of the Technical Systems Owner (TSO).

25.6.2.   Software protection/configuration management

Security protection of applications programs shall be determined on the basis of an assessment of the security classification of the program itself rather than of the classification of the information it is to process. The software versions in use shall be verified at regular intervals to ensure their integrity and correct functioning.

New or modified versions of software shall not be used for the handling of EU classified information until verified by the TSO.

25.6.3.   Checking for the presence of malicious software/computer viruses

Checking for the presence of malicious software/computer viruses shall be periodically carried out in accordance with the requirements of the SAA.

All computer storage media arriving in the Commission shall be checked for the presence of any malicious software or computer viruses, before being introduced into any system.

25.6.4.   Maintenance

Contracts and procedures for scheduled and on-call maintenance of systems for which a SSRS has been produced shall specify requirements and arrangements for maintenance personnel and their associated equipment entering an IT area.

The requirements shall be clearly stated in the SSRS and the procedures shall be clearly stated in the SecOPs. Contractor maintenance requiring remote access diagnostic procedures shall be permitted only in exceptional circumstances, under stringent security control, and only with the approval of the SAA.

25.7.   Procurement

25.7.1.   General

Any security product to be used with the system to be procured shall either have been evaluated and certified, or currently be under evaluation and certification by an appropriate Evaluation or Certification body of one of the EU Member States against internationally acknowledged criteria (such as the Common Criteria for Information Technology Security Evaluation, re ISO 15408). Specific procedures are required to obtain ACPC approval.

In deciding whether equipment, particularly computer storage media, should be leased rather than purchased, it shall be borne in mind that such equipment, once used for handling EU classified information, cannot be released outside an appropriately secure environment without first being declassified to the approval of the SAA and that such approval may not always be possible.

25.7.2.   Accreditation

All systems for which a SSRS has to be produced, prior to handling EU classified information, shall be accredited by the SAA, based upon information provided in the SSRS, SecOPs and any other relevant documentation. Sub-systems and remote terminals/workstations shall be accredited as part of all the systems to which they are connected. Where a system supports both Commission and other organisations, the Commission and relevant Security Authorities shall mutually agree on the accreditation.

The accreditation process may be carried out in accordance with an accreditation strategy appropriate to the particular system and defined by the SAA.

25.7.3.   Evaluation and certification

Prior to accreditation, in certain instances, the hardware, firmware and software security features of a system shall be evaluated and certified as being capable of safeguarding information at the intended level of classification.

The requirements for evaluation and certification shall be included in system planning, and clearly stated in the SSRS.

The evaluation and certification processes shall be carried out in accordance with approved guidelines and by technically qualified and appropriately cleared personnel acting on behalf of the TSO.

The teams may be provided from a nominated Member State's evaluation or certification authority or its nominated representatives, for example a competent and cleared contractor.

The degree of evaluation and certification processes involved may be lessened (for example, only involving integration aspects) where systems are based on existing nationally evaluated and certified computer security products.

25.7.4.   Routine checking of security features for continued accreditation

The TSO shall establish routine control procedures that shall ensure that all security features of the system are still valid.

The types of change that would give rise to re-accreditation, or requiring the prior approval of the SAA, shall be clearly identified and stated in the SSRS. After any modification, repair or failure that could have affected the security features of the system, the TSO shall ensure that a check is made to ensure the correct operation of the security features. Continued accreditation of the system shall normally depend on the satisfactory completion of the checks.

All systems where security features have been implemented shall be inspected or reviewed on a periodic basis by the SAA. In respect of systems handling ►M1  TRES SECRET UE/EU TOP SECRET ◄ the inspections shall be carried out not less than once annually.

25.8.   Temporary or occasional use

25.8.1.   Security of microcomputers/personal computers

Microcomputers/Personal Computers (PCs) with fixed disks (or other non-volatile storage media), operating either in stand-alone mode or as networked configurations, and portable computing devices (for example, portable PCs and electronic ‘notebooks’) with fixed hard disks, shall be considered as information storage media in the same sense as floppy diskettes or other removable computer storage media.

This equipment shall be afforded the level of protection, in terms of access, handling, storage and transportation, commensurate with the highest classification level of information ever stored or processed (until downgraded or declassified in accordance with approved procedures).

25.8.2.   Use of privately-owned IT equipment for official Commission work

The use of privately-owned removable computer storage media, software and IT hardware (for example, PCs and portable computing devices) with storage capability shall be prohibited for handling EU classified information.

Privately owned hardware, software and media shall not be brought into any Class I or Class II area where EU classified information is handled without the written authorisation of the ►M2  Director of the Commission Security Directorate ◄ . This authorisation can only be provided for technical reasons in exceptional cases.

25.8.3.   Use of contractor-owned or nationally-supplied IT equipment for official Commission work

The use of contractor-owned IT equipment and software in organisations in support of official Commission work may be permitted by the ►M2  Director of the Commission Security Directorate ◄ . The use of nationally-provided IT equipment and software may also be permitted; in this case, the IT equipment shall be brought under the control of the appropriate Commission inventory. In either case, if the IT equipment is to be used for handling EU classified information, then the SAA shall be consulted in order that the elements of INFOSEC that are applicable to the use of that equipment are properly considered and implemented.

26.   RELEASE OF EU CLASSIFIED INFORMATION TO THIRD STATES OR INTERNATIONAL ORGANISATIONS

26.1.1.   Principles regulating the release of EU classified information

The Commission as a college shall decide on release of EU classified information to third States or international organisations on the basis of:

The originator of the EU classified information to be released will be asked for its agreement.

These decisions will be taken on a case-by-case basis, depending on:

The acceptance of EU classified information by third States or international organisations will imply an assurance that the information will be used for no purposes other than those motivating the release or exchange of information, and that they will provide the protection required by the Commission.

26.1.2.   Levels

Once the Commission has decided that classified information may be released to or exchanged with a given State or international organisation, it will decide on the level of cooperation that is possible. This will depend in particular on the security policy and regulations applied by that State or organisation.

There are three levels of cooperation:

26.1.3.   Security agreements

Once the Commission has decided that there is a permanent or long-term need for the exchange of classified information between the Commission and third States or other international organisations, it will draw up ‘agreements on security procedures for the exchange of classified information’ with them, defining the purpose of cooperation and the reciprocal rules on the protection of the information exchanged.

In the case of level 3 occasional cooperation, which by definition is limited in time and purpose, a simple memorandum of understanding defining the nature of the classified information to be exchanged and the reciprocal obligations regarding that information may take the place of the ‘agreement on procedures for the exchange of classified information’ on condition that it is classified no higher than ►M1  RESTREINT UE ◄ .

Draft agreements on security procedures or memoranda of understanding, shall be discussed by the Commission Security Policy Advisory Group before they are presented to the Commission for a decision.

The Member of the Commission responsible for security matters shall request all necessary assistance from Member State NSA's to ensure that the information to be released is used and protected in accordance with the provisions of the agreements on security procedures or memoranda of understanding.

▼M3

27.   COMMON MINIMUM STANDARDS ON INDUSTRIAL SECURITY

27.1.   Introduction

This Section deals with security aspects of industrial activities that are unique to negotiating and awarding contracts or grant agreements conferring tasks involving, entailing and/or containing EU classified information and to their performance by industrial or other entities, including the release of, or access to, EU classified information during the public procurement and call for proposals procedures (bidding period and pre-contract negotiations).

27.2.   Definitions

For the purpose of these common minimum standards, the following definitions shall apply:

27.3.   Organisation

27.4.   Classified contracts and grant decisions

27.5.   Visits

Visits by personnel of the Commission in the context of classified contracts to industrial or other entities in the Member States performing EU classified contracts must be arranged with the relevant NSA/DSA. Visits by employees of industrial or other entities within the framework of an EU classified contract must be arranged between the NSAs/DSAs concerned. However, the NSAs/DSAs involved in an EU classified contract may agree on a procedure whereby visits by employees of industrial or other entities can be arranged directly.

27.6.   Transmission and transportation of EU classified information

▼M1

---

Appendix 1

▼B

---

Appendix 2

PRACTICAL CLASSIFICATION GUIDE

This guide is indicative and may not be construed as modifying the substantial provisions laid down in Sections 16, 17, 20 and 21.

---

Appendix 3

Guidelines for the release of EU classified information to third States or international organisations: Level 1 cooperation

PROCEDURES

SECURITY PROVISIONS TO BE APPLIED BY BENEFICIARIES

5.	The Member of the Commission responsible for security matters shall notify the beneficiary States or international organisations of the Commission's decision to authorise the release of EU classified information.

6.

The decision to release shall come into force only when the beneficiaries have given a written assurance that they will: — Use the information for no other than the agreed purposes; — Protect the information in accordance with these security provisions and in particular the special rules set out below.

7.

Personnel (a) The number of officials having access to the EU classified information shall be strictly limited, based on the need-to-know principle, to those persons whose duties require such access. (b) All officials or nationals authorised to have access to information classified ►M1  CONFIDENTIEL UE ◄ or above shall hold either a security certificate at the appropriate level or the equivalent security clearance, either one being issued by their own State's government.

8.

Transmission of documents (a) The practical procedures for the transmission of documents shall be decided by agreement. Pending the conclusion of such an agreement the provisions of Section 21 apply. The agreement shall in particular specify the registries to which EU classified information is to be forwarded. (b) If the classified information whose release is authorised by the Commission includes ►M1  TRES SECRET UE/EU TOP SECRET ◄ , the beneficiary State or international organisation shall set up a central EU registry and, if necessary, EU sub-registries. These registries shall apply strictly equivalent provisions as those of Section 22 of these security provisions.

9.

Registration As soon as a registry receives a EU document classified ►M1  CONFIDENTIEL UE ◄ or above, it shall list the document in a special register held by the organisation, with columns for the date received, particulars of the document (date, reference and copy number), its classification, title, the recipient's name or title, the date of return of the receipt and the date the document is returned to the EU originator or is destroyed.

10.

Destruction (a) EU classified documents shall be destroyed in accordance with the instructions set out in Section 22 of these security provisions. Copies of the destruction certificates for ►M1  SECRET UE ◄ and ►M1  TRES SECRET UE/EU TOP SECRET ◄ documents shall be sent to the EU registry that has forwarded the documents. (b) EU classified documents shall be included in emergency destruction plans for the beneficiary bodies' own classified documents.

11.	Protection of documents Every step shall be taken to prevent unauthorised persons from having access to EU classified information.

12.

Copies, translations and extracts No photocopies or translation shall be made of a document classified ►M1  CONFIDENTIEL UE ◄ or ►M1  SECRET UE ◄ , or extracts taken, without the authorisation of the head of the security organisation concerned, who shall register and check those copies, translations or extracts and stamp them as necessary. The reproduction or translation of a ►M1  TRES SECRET UE/EU TOP SECRET ◄ document shall be authorised only by the originating authority, which shall specify the number of copies authorised; if the originating authority cannot be determined, the request shall be referred to the ►M2  Commission Security Directorate§ ◄ .

13.

Breaches of security When a breach of security involving a EU classified document has taken place or is suspected, the following action shall be taken immediately, subject to the conclusion of a security agreement: (a) Carry out an investigation to establish the circumstances of the breach of security; (b) Notify the ►M2  Commission Security Directorate ◄ , the relevant National Security Authority and the originating authority, or clearly state that the latter has not been notified if this has not been done; (c) Take action to minimise the effects of the breach of security; (d) Reconsider and implement measures to prevent any recurrence; (e) Implement any measures recommended by the ►M2  Commission Security Directorate ◄ to prevent a recurrence.

14.	Inspections The ►M2  Commission Security Directorate ◄ shall be permitted, by agreement with the States or international organisations concerned, to carry out an assessment of the effectiveness of measures for the protection of the EU classified information released.

15.

Reporting Subject to the conclusion of a security agreement, as long as the State or international organisation holds EU classified information, it shall submit a yearly report, by a date specified when the authorisation to release the information is given, confirming that these security provisions have been complied with.

---

Appendix 4

Guidelines for the release of EU classified information to third States or international organisations: Level 2 cooperation

PROCEDURES

SECURITY RULES TO BE APPLIED BY BENEFICIARIES

7.	The Member of the Commission responsible for security matters shall notify the beneficiary States or international organisations of the Commission's decision to authorise the release of EU classified information and of its restrictions.

8.	The decision to release shall come into force only when the beneficiaries have given a written assurance that they will: — Use the information for no other than the agreed purposes; — Protect the information in accordance with the provisions laid down by the Commission.

9.	The following rules of protection shall apply unless the Commission, having obtained the Commission Security Policy Advisory Group's technical opinion, decides on a particular procedure for the handling of EU classified documents (deleting mention of the EU classification, specific marking, etc.).

10.

Personnel (a) The number of officials having access to EU classified information shall be strictly limited, based on the need-to-know principle, to those persons whose duties require such access; (b) All officials or nationals authorised to have access to the classified information released by the Commission shall have a national security clearance or authorisation for access, to an appropriate level equivalent to that of the EU, as defined in the comparative table; (c) These national security clearances or authorisations shall be forwarded to the ►M2  Director of the Commission Security Directorate ◄ for information.

11.

Transmission of documents The practical procedures for the transmission of documents shall be decided by agreement. Pending the conclusion of such an agreement the provisions of Section 21 shall apply. The agreement shall in particular specify the registries to which EU classified information is to be forwarded and the precise addresses to which the documents shall be forwarded as well as the courier or mail services used for the transmission of the EU classified information.

12.

Registration on arrival The addressee State's NSA or its equivalent in the State receiving on behalf of its government the classified information forwarded by the Commission, or the security bureau of the recipient international organisation, shall open a special register to record EU classified information on its receipt. The Register shall contain columns indicating the date received, particulars of the document (date, reference and copy number), its classification, title, the addressee's name or title, the date of return of the receipt and the date of return of the document to EU or its destruction.

13.	Return of documents When the recipient returns a classified document to the Commission, it shall proceed as indicated in the paragraph ‘Transmission of documents’ above.

14.

Protection (a) When the documents are not in use, they shall be stored in a security container that is approved for the storage of nationally-classified material of the same classification. The container shall bear no indication of its contents, which shall be accessible only to persons authorised to handle EU classified information. Where combination locks are used, the combination shall be known only to those officials in the State or organisation having authorised access to the EU classified information stored in the container and shall be changed every six months, or sooner on the transfer of an official, on withdrawal of the security clearance of one of the officials knowing the combination or if there is a risk of compromise. (b) EU classified documents shall be removed from the security container only by those officials cleared for access to the EU classified documents and having need-to-know. They shall remain responsible for the safe custody of those documents as long as they are in their possession and, in particular, for ensuring that no unauthorised person has access to the documents. They shall also ensure that the documents are stored in a security container when they have finished consulting them and outside working hours. (c) No photocopies shall be made of a document classified ►M1  CONFIDENTIEL UE ◄ or above, nor extracts taken, without the authorisation of the ►M2  Commission Security Directorate ◄ . (d) The procedure for the rapid and total destruction of the documents in an emergency shall be defined and confirmed with the ►M2  Commission Security Directorate ◄ .

15.

Physical security (a) When not in use, security containers used for storage of EU classified documents shall be kept locked at all times; (b) When it is necessary for maintenance or cleaning staff to enter or work in a room which houses such security containers, they shall be escorted at all times by a member of the State's or organisation's security service or by the official more specifically responsible for supervising the security of the room; (c) Outside normal working hours (at night, at weekends and on public holidays) the security containers containing EU classified documents shall be protected either by a guard or by an automatic alarm system.

16.

Breaches of security When a breach of security involving a EU classified document has taken place or is suspected, the following action shall be taken immediately: (a) Forward a report immediately to the ►M2  Commission Security Directorate ◄ or the NSA of the Member State that has taken the initiative in forwarding documents (with a copy to the ►M2  Commission Security Directorate ◄ ); (b) Conduct an enquiry, on completion of which a full report shall be submitted to the security body (see (a) above). The requisite measures to remedy the situation shall then be adopted.

17.	Inspections The ►M2  Commission Security Directorate ◄ shall be permitted, by agreement with the States or international organisations concerned, to carry out an assessment of the effectiveness of measures for the protection of the EU classified information released.

18.

Reporting Subject to the conclusion of a security agreement, as long as the State or international organisation holds EU classified information, it shall submit a yearly report, by a date specified when the authorisation to release the information is given, confirming that these security provisions have been complied with.

---

Appendix 5

Guidelines for the release of EU classified information to third States or international organisations: Level 3 cooperation

PROCEDURES

1.	From time to time, the Commission may wish to cooperate in certain special circumstances with States or organisations that cannot give the assurances required by these security rules, but that cooperation may call for the release of EU classified information.

2.

The authority to release EU classified information to third States or international organisations whose security policy and regulations are markedly different from EU's lies with the originator. The authority to release EUCI created within the Commission lies with the Commission as a college. In principle, it is restricted to information classified up to and including ►M1  SECRET UE ◄ ; it excludes classified information protected by special security designators or markings.

3.	The Commission shall consider the wisdom of releasing classified information, assess the beneficiaries' need to know and decide on the nature of the classified information that may be communicated.

4.

If the Commission is in favour, the Member of the Commission responsible for security matters — Shall seek the opinions of the originators of the EUCI to be released; — Shall arrange for a meeting of the Commission Security Policy Advisory Group or, under a silent procedure if necessary, enquire from the Member States' National Security Authorities with a view to obtaining the Commission Security Policy Advisory Group's opinion.

5.

The Commission Security Policy Advisory Group's opinion shall be on the following: (a) An evaluation of the security risks incurred by EU or its Member States; (b) The level of classification of the information that may be released; (c) Downgrading or declassification before the information is released; (d) Procedures for handling the documents to be released (see paragraph below); (e) The possible methods of transmission (use of public postal services, public or secure telecommunications systems, diplomatic bag, cleared couriers, etc.).

6.

The documents released to the States or organisations covered in this Appendix shall, in principle, be prepared without reference to the source or an EU classification. The Commission Security Policy Advisory Group may recommend: — The use of a specific marking or codename; — The use of a specific system of classification linking the sensitivity of the information to the control measures required of the beneficiary methods of transmission of the documents.

7.	The ►M2  member of the Commission responsible for security matters ◄ shall forward the Commission Security Policy Advisory Group's opinion to the Commission for a decision.

8.

Once the Commission has approved the release of EU classified information and the practical implementing procedures, the ►M2  Commission Security Directorate ◄ shall establish the necessary contact with the security body of the State or organisation concerned to facilitate the application of the security measures envisaged.

9.	The Member of the Commission responsible for security matters shall inform the Member States about the nature and classification of the information, listing the organisations and countries to which it may be released, as decided by the Commission.

10.	The ►M2  Commission Security Directorate ◄ shall take all the necessary measures to facilitate any consequent damage assessment and review of procedures. Whenever the conditions of cooperation change, the Commission shall reconsider the issue.

SECURITY PROVISIONS TO BE APPLIED BY BENEFICIARIES

11.

The Member of the Commission responsible for security matters shall notify the beneficiary States or international organisations of the Commission's decision to authorise the release of EU classified information, together with the detailed rules of protection proposed by the Commission Security Policy Advisory Group and approved by the Commission.

12.	The decision shall come into force only when the beneficiaries have given a written assurance that they will: — Use the information for no other purpose than the cooperation decided by the Commission; — Offer the information the protection required by the Commission.

13.

Transmission of documents (a) The practical procedures for the transmission of documents shall be agreed between the ►M2  Commission Security Directorate ◄ and the security bodies of the recipient States or international organisations. They shall in particular specify the precise addresses to which the documents must be forwarded. (b) Documents classified ►M1  CONFIDENTIEL UE ◄ and higher shall be transmitted under double cover. The inner envelope shall bear the specific stamp or codename decided upon and a mention of the special classification approved for the document. A receipt form shall be enclosed for each classified document. The receipt form, which shall not itself be classified, shall quote only the particulars of the document (its reference, date, copy number) and its language, not the title. (c) The inner envelope shall then be placed in the outer envelope, which shall carry a package number for receipting purposes. The outer envelope shall not bear a security classification. (d) A receipt showing the package number shall always be given to the couriers.

14.

Registration on arrival The addressee State's NSA or its equivalent in the State receiving the classified information forwarded by the Commission on behalf of its government, or the security bureau of the recipient international organisation, shall open a special register to record EU classified information on its receipt. The Register shall contain columns indicating the date received, particulars of the document (date, reference and copy number), its classification, title, the addressee's name or title, the date of return of the receipt and the date of return of the receipt to EU and the date of destruction of the document.

15.

Use and protection of the classified information exchanged (a) Information at the level of ►M1  SECRET UE ◄ shall be handled by specifically designated officials, authorised to have access to information with this classification. It shall be stored in good quality security cabinets that can be opened only by the persons authorised to have access to the information they contain. The areas in which those cabinets are located shall be permanently guarded and a system of verification shall be set up to ensure that only duly authorised persons are allowed to enter. ►M1  SECRET UE ◄ -level information shall be forwarded by diplomatic bag, secure mail services or by secure telecommunications. An ►M1  SECRET UE ◄ document shall be copied only with the originating authority's written agreement. All copies shall be registered and monitored. Receipts shall be issued for all operations relating to ►M1  SECRET UE ◄ documents; (b)  ►M1  CONFIDENTIEL UE ◄ shall be handled by duly designated officials authorised to be informed on the subject. Documents shall be stored in locked security cabinets in controlled areas; ►M1  CONFIDENTIEL UE ◄ information shall be forwarded by diplomatic bag, military mail services and secure telecommunications. Copies may be made by the recipient body, their number and distribution being recorded in special registers; (c)  ►M1  RESTREINT UE ◄ information shall be handled in premises that are not accessible to unauthorised personnel and stored in locked containers. Documents may be forwarded by public postal services as registered mail in a double envelope and, in emergency situations during operations, by the unprotected public telecommunications systems. The recipients may make copies; (d) Unclassified information shall not call for special protection measures and may be forwarded by mail and public telecommunications systems. The addressees may make copies.

16.

Destruction Documents no longer needed shall be destroyed. In the case of ►M1  RESTREINT UE ◄ and ►M1  CONFIDENTIEL UE ◄ documents, an appropriate note shall be entered in the special registers. In the case of ►M1  SECRET UE ◄ documents, destruction certificates shall be issued and signed by two persons witnessing their destruction.

17.

Breaches of security If ►M1  CONFIDENTIEL UE ◄ or ►M1  SECRET UE ◄ information is compromised or there is a suspicion of compromise, the NSA of the State or the head of security in the organisation shall conduct an enquiry into the circumstances of the compromise. The ►M2  Commission Security Directorate ◄ shall be notified of its results. The necessary steps shall be taken to remedy inadequate procedures or storage methods if they have given rise to the compromise.

---

Appendix 6

---

( 1 ) OJ L 17/58, 6.10.1958, p. 406/58.

( 2 ) OJ L 151, 15.6.1990, p. 1.

( 3 ) OJ L 101, 11.4.2001, p. 1.

( 4 ) OJ L 145, 31.5.2001, p. 43.

( 5 ) Without prejudice to the Vienna Convention of 1961 on diplomatic relations and the Protocol on the privileges and immunities of the European Communities of 8 April 1965.

( 6 ) See a comparative table of EU, NATO, WEU and Member States' security classifications in Appendix 1.