Commission Decision (EU, Euratom) 2017/46Show full title

CHAPTER 1 GENERAL PROVISIONS

Article 1 Subject matter and scope

1. This decision applies to all communication and information systems (CISs) which are owned, procured, managed or operated by or on behalf of the Commission and all usage of those CISs by the Commission.

2. This decision sets out the basic principles, objectives, organisation and responsibilities regarding the security of those CISs, and in particular for Commission departments owning, procuring, managing or operating CISs and including CISs provided by an internal IT service provider. When a CIS is provided, owned, managed or operated by an external party on the basis of a bilateral agreement or contract with the Commission, the terms of the agreement or contract shall comply with this decision.

3. This decision applies to all Commission departments and Executive Agencies. When a Commission CIS is used by other bodies and institutions on the basis of a bilateral agreement with the Commission, the terms of the agreement shall comply with this decision.

4. Notwithstanding any specific indications concerning particular groups of staff, this decision shall apply to the Members of the Commission, to Commission staff falling under the scope of the Staff Regulations of Officials of the European Union (the ‘Staff Regulations’) and the Conditions of Employment of Other Servants of the Union (the ‘CEOS’)(1), to national experts seconded to the Commission (‘SNEs’)(2), to external service providers and their staff, to trainees and to any individual with access to CIS in the scope of this decision.

5. This Decision shall apply to the European Anti-Fraud Office (OLAF) in so far as this is compatible with Union legislation and Commission Decision 1999/352/EC, ECSC, Euratom(3). In particular, measures provided for in this Decision, including instructions, inspections, inquiries and equivalent measures, may not apply to the CIS of the Office where this is not compatible with the independence of the Office's investigative function and/or the confidentiality of information obtained by the Office in the exercise of this function.

Article 2 Definitions

For the purposes of this Decision the following definitions shall apply:

(1)

‘Accountable’ means to be answerable for actions, decisions and performance.

(2)

‘CERT-EU’ is the Computer Emergency Response Team for the EU institutions and agencies. Its mission is to support the European Institutions to protect themselves against intentional and malicious attacks that would hamper the integrity of their IT assets and harm the interests of the EU. The scope of CERT-EU's activities covers prevention, detection, response and recovery.

(3)

‘Commission department’ means any Commission Directorate-General or service, or any Cabinet of a Member of the Commission.

(4)

‘Commission Security Authority’ refers to the role laid down in Decision (EU, Euratom) 2015/444.

(5)

‘Communication and information system’ or ‘CIS’ means any system enabling the handling of information in electronic form, including all assets required for its operation, as well as infrastructure, organisation, personnel and information resources. This definition includes business applications, shared IT services, outsourced systems, and end-user devices.

(6)

‘Corporate Management Board’ (CMB) provides the highest level of corporate management oversight for operational and administrative issues in the Commission.

(7)

‘Data owner’ means the individual responsible for ensuring the protection and use of a specific data set handled by a CIS.

(8)

‘Data set’ means a set of information which serves a specific business process or activity of the Commission.

(9)

‘Emergency procedure’ means a predefined set of methods and responsibilities for responding to urgent situations in order to prevent a major impact on the Commission.

(10)

‘Information security policy’ means a set of information security objectives, which are or have to be established, implemented and checked. It comprises, but is not limited to, Decisions (EU, Euratom) 2015/444 and (EU, Euratom) 2015/443.

(11)

‘Information Security Steering Board’ (ISSB) means the governance body that supports the Corporate Management Board in its IT-security-related tasks.

(12)

‘Internal IT service provider’ means a Commission department providing shared IT services.

(13)

‘IT security’ or ‘security of CIS’ means the preservation of confidentiality, integrity and availability of CISs and the data sets that they process.

(14)

‘IT security guidelines’ consist of recommended but voluntary measures that help support IT security standards or serve as a reference when no applicable standard is in place.

(15)

‘IT security incident’ means an event that could adversely affect the confidentiality, integrity or availability of a CIS.

(16)

‘IT security measure’ means a technical or organisational measure aimed at mitigating IT security risks,

(17)

‘IT security need’ means a precise and unambiguous definition of the levels of confidentiality, integrity and availability associated with a piece of information or an IT system with a view to determining the level of protection required.

(18)

‘IT security objective’ means a statement of intent to counter specified threats and/or satisfy specified organisational security requirements or assumptions.

(19)

‘IT security plan’ means the documentation of the IT security measures required to meet the IT security needs of a CIS.

(20)

‘IT security policy’ means a set of IT security objectives, which are or have to be established, implemented and checked. It comprises this decision and its implementing rules.

(21)

‘IT security requirement’ means a formalised IT security need through a predefined process.

(22)

‘IT security risk’ means an effect that an IT security threat might induce on a CIS by exploiting a vulnerability. As such, an IT security risk is characterised by two factors: (1) uncertainty, i.e. the likelihood of an IT security threat to cause an unwanted event; and (2) impact, i.e. the consequences that such an unwanted event may have on a CIS.

(23)

‘IT security standards’ means specific mandatory IT security measures that help enforce and support the IT security policy.

(24)

‘IT security strategy’ means a set of projects and activities which are designed to achieve the objectives of the Commission and which have to be established, implemented and checked.

(25)

‘IT security threat’ means a factor that can potentially lead to an unwanted event which may result in harm to a CIS. Such threats may be accidental or deliberate and are characterised by threatening elements, potential targets and attack methods.

(26)

‘Local Informatics Security Officer’ or ‘LISO’ means the officer who is responsible for IT security liaison for a Commission department.

(27)

‘Personal data’, ‘processing of personal data’, ‘controller’ and ‘personal data filing system’ shall have the same meaning as in Regulation (EC) No 45/2001, and in particular Article 2 thereof.

(28)

‘Processing of information’ means all functions of a CIS with respect to data sets, including creation, modification, display, storage, transmission, deletion and archiving of information. Processing of information can be provided by a CIS as a set of functionalities to users and as IT services to other CIS.

(29)

‘Professional secrecy’ means the protection of business data information of the kind covered by the obligation of professional secrecy, in particular information about undertakings, their business relations or their cost components as laid down in Article 339 of the TFEU.

(30)

‘Responsible’ means having the obligation to act and take decisions to achieve required outcomes.

(31)

‘Security in the Commission’ means the security of persons, assets and information in the Commission, and in particular the physical integrity of persons and assets, the integrity, confidentiality and availability of information and communication and information systems, as well as the unobstructed functioning of Commission operations.

(32)

‘Shared IT service’ means the service a CIS provides to other CISs in the processing of information.

(33)

‘System owner’ is the individual responsible for the overall procurement, development, integration, modification, operation, maintenance, and retirement of a CIS.

(34)

‘User’ means any individual who uses functionality provided by a CIS, whether inside or outside the Commission.

Article 3 Principles for IT security in the Commission

1. IT security in the Commission shall be based on the principles of legality, transparency, proportionality and accountability.

2. IT security issues shall be taken into account from the start of the development and implementation of Commission CISs. In order to do so, the Directorate-General for Informatics and the Directorate-General for Human Resources and Security shall be involved for their respective areas of responsibility.

3. Effective IT security shall ensure appropriate levels of:

(a) authenticity: the guarantee that information is genuine and from bona fide sources;

(b) availability: the property of being accessible and usable upon request by an authorised entity;

(c) confidentiality: the property that information is not disclosed to unauthorised individuals, entities or processes.

(d) integrity: the property of safeguarding the accuracy and completeness of assets and information;

(e) non-repudiation: the ability to prove an action or event has taken place, so that this event or action cannot subsequently be denied;

(f) protection of personal data: the provision of appropriate safeguards in regard to personal data in full compliance with Regulation (EC) No 45/2001;

(g) professional secrecy: the protection of information of the kind covered by the obligation of professional secrecy, in particular information about undertakings, their business relations or their cost components as laid down in Article 339 of the TFEU.

4. IT security shall be based on a risk management process. This process shall aim at determining the levels of IT security risks and defining security measures to reduce such risks to an appropriate level and at a proportionate cost.

5. All CIS shall be identified, assigned to a system owner and recorded in an inventory.

6. The security requirements of all CIS shall be determined on the basis of their security needs and of the security needs of the information they process. CIS that provide services to other CIS may be designed to support specified levels of security needs.

7. IT security plans and IT security measures shall be proportionate to the security needs of the CIS.

The processes related to these principles and activities shall be further detailed in implementing rules.

(1)

Laid down by Council Regulation (EEC, Euratom, ECSC) No 259/68 of 29 February 1968 laying down the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Communities and instituting special measures temporarily applicable to officials of the Commission (Conditions of Employment of Other Servants) (OJ L 56, 4.3.1968, p. 1).

(2)

Commission Decision of 12 November 2008 laying down rules on the secondment to the Commission of national experts and national experts in professional training (C(2008) 6866 final).

(3)

Commission Decision 1999/352/EC, ECSC, Euratom of 28 April 1999 establishing the European Anti-fraud Office (OLAF) (OJ L 136, 31.5.1999, p. 20).