Article 1. . . . . . . . . ....
Article 2. . . . . . . . . ....
ANNEX
COMMISSION PROVISIONS ON SECURITY
. . . . . . . . . ..... . . . . . . . . ....
Article 1. . . . . . . . . ....
Article 2. . . . . . . . . ....
Article 3. . . . . . . . . ....
Article 4. . . . . . . . . ....
Article 5. . . . . . . . . ....
Article 6. . . . . . . . . ....
ANNEX
RULES ON SECURITY
PART I:
BASIC PRINCIPLES AND MINIMUM STANDARDS OF SECURITY
1.
INTRODUCTION
2.
GENERAL PRINCIPLES
3.
FOUNDATIONS OF SECURITY
4.
PRINCIPLES OF INFORMATION SECURITY
4.1.
Objectives
4.2.
Definitions
4.3.
Classification
4.4.
Aims of security measures
5.
ORGANISATION OF SECURITY
5.1.
Common minimum standards
5.2.
Organisation
6.
SECURITY OF PERSONNEL
6.1.
Clearance of personnel
6.2.
Records of personnel clearances
6.3.
Security instruction of personnel
6.4.
Management responsibilities
6.5.
Security status of personnel
7.
PHYSICAL SECURITY
7.1.
Need for protection
7.2.
Checking
7.3.
Security of buildings
7.4.
Contingency plans
8.
SECURITY OF INFORMATION
9.
COUNTER-SABOTAGE AND CONTROL OF OTHER FORMS OF MALICIOUS WILFUL DAMAGE...
10.
RELEASE OF CLASSIFIED INFORMATION TO THIRD STATES OR INTERNATIONAL ORGANISATIONS...
PART II:
THE ORGANISATION OF SECURITY IN THE COMMISSION
11.
THE MEMBER OF THE COMMISSION RESPONSIBLE FOR SECURITY MATTERS
12.
THE COMMISSION SECURITY POLICY ADVISORY GROUP
13.
THE COMMISSION SECURITY BOARD
14.
THE COMMISSION SECURITY DIRECTORATE
15.
SECURITY INSPECTIONS
16.
CLASSIFICATIONS, SECURITY DESIGNATORS AND MARKINGS
16.1.
Levels of classification
16.2.
Security designators
16.3.
Markings
16.4.
Affixing of classification
16.5.
Affixing of security designators
17.
CLASSIFICATION MANAGEMENT
17.1.
General
17.2.
Application of classifications
17.3.
Downgrading and declassification
18.
PHYSICAL SECURITY
18.1.
General
18.2.
Security requirements
18.3.
Physical security measures
18.3.1.
Security areas
18.3.2.
Administrative area
18.3.3.
Entry and exit controls
18.3.4.
Guard patrols
18.3.5.
Security containers and strong rooms
18.3.6.
Locks
18.3.7.
Control of keys and combinations
18.3.8.
Intrusion detection devices
18.3.9.
Approved equipment
18.3.10.
Physical protection of copying and telefax machines
18.4.
Protection against overlooking and eavesdropping
18.4.1.
Overlooking
18.4.2.
Eavesdropping
18.4.3.
Introduction of electronic and recording equipment
18.5.
Technically secure areas
19.
GENERAL RULES ON THE NEED TO KNOW PRINCIPLE AND EU...
19.1.
General
19.2.
Specific rules on access to TRES SECRET UE/EU TOP SECRET...
19.3.
Specific rules on access to SECRET UE and CONFIDENTIEL UE...
19.4.
Specific rules on access to RESTREINT UE information
19.5.
Transfers
19.6.
Special instructions
20.
SECURITY CLEARANCE PROCEDURE FOR COMMISSION OFFICIALS AND OTHER EMPLOYEES
21.
PREPARATION, DISTRIBUTION, TRANSMISSION, COURRIER PERSONAL SECURITY AND EXTRA COPIES OF...
21.1.
Preparation
1.. . . . . . . . . ....
2.. . . . . . . . . ....
3.. . . . . . . . . ....
21.2.
Distribution
1.. . . . . . . . . ....
2.. . . . . . . . . ....
3.. . . . . . . . . ....
4.. . . . . . . . . ....
21.3.
Transmission of EU classified documents
21.3.1.
Packaging, receipts
1.. . . . . . . . . ....
2.. . . . . . . . . ....
3.. . . . . . . . . ....
4.. . . . . . . . . ....
5.. . . . . . . . . ....
21.3.2.
Transmission within a building or group of buildings
21.3.3.
Transmission within a country
1.. . . . . . . . . ....
2.. . . . . . . . . ....
3.
Exceptionally, TRES SECRET UE/EU TOP SECRET documents may be taken...
4.. . . . . . . . . ....
5.
The Commission Security Directorate will prepare instructions on the personal...
21.3.4.
Transmission from one State to another
1.. . . . . . . . . ....
2.. . . . . . . . . ....
3.
The Member of the Commission responsible for security matters may...
4.. . . . . . . . . ....
21.3.5.
Transmission of RESTREINT UE documents
21.4.
Courier personnel security
21.5.
Electronic and other means of technical transmission
1.. . . . . . . . . ....
2.. . . . . . . . . ....
21.6.
Extra copies and translations of and extracts from EU classified...
1.. . . . . . . . . ....
2.. . . . . . . . . ....
3.. . . . . . . . . ....
22.
EUCI REGISTRIES, MUSTERS, CHECKS, ARCHIVE STORAGE AND DESTRUCTION OF EUCI...
22.1.
Local EUCI Registries
1.. . . . . . . . . ....
2.. . . . . . . . . ....
3.. . . . . . . . . ....
4.. . . . . . . . . ....
5.. . . . . . . . . ....
6.
Under the authority of the relevant Head of department the...
7.
The Local EUCI Registries shall keep a register of the...
8.. . . . . . . . . ....
22.2.
The TRES SECRET UE/EU TOP SECRET Registry
22.2.1.
General
1.. . . . . . . . . ....
2.. . . . . . . . . ....
3.. . . . . . . . . ....
4.. . . . . . . . . ....
5.. . . . . . . . . ....
6.. . . . . . . . . ....
22.2.2.
The Central TRES SECRET UE/EU TOP SECRET Registry
22.2.3.
TRES SECRET UE/EU TOP SECRET sub-registries
22.3.
Inventories, musters and checks of EU classified documents
1.. . . . . . . . . ....
2.. . . . . . . . . ....
3.. . . . . . . . . ....
4.
These operations shall afford the opportunity to secure holders' views...
22.4.
Archive storage of EU classified information
1.. . . . . . . . . ....
2.
To minimise storage problems, the Control Officers of all registries...
3.. . . . . . . . . ....
22.5.
Destruction of EU classified documents
1.
To prevent the unnecessary accumulation of EU classified documents, those...
2.. . . . . . . . . ....
3.. . . . . . . . . ....
4.. . . . . . . . . ....
22.6.
Destruction in emergencies
1.. . . . . . . . . ....
2.. . . . . . . . . ....
3.. . . . . . . . . ....
4.. . . . . . . . . ....
23.
SECURITY MEASURES FOR SPECIFIC MEETINGS HELD OUTSIDE THE COMMISSION PREMISES...
23.1.
General
23.2.
Responsibilities
23.2.1.
The Commission Security Directorate
23.2.2.
Meeting Security Officer (MSO)
23.3.
Security measures
23.3.1.
Security areas
23.3.2.
Passes
23.3.3.
Control of photographic and audio equipment
23.3.4.
Checking of briefcases, portable computers and packages
23.3.5.
Technical security
23.3.6.
Delegations' documents
23.3.7.
Safe custody of documents
23.3.8.
Inspection of offices
23.3.9.
Disposal of EU classified waste
24.
BREACHES OF SECURITY AND COMPROMISE OF EU CLASSIFIED INFORMATION
24.1.
Definitions
24.2.
Reporting breaches of security
24.3.
Legal action
25.
PROTECTION OF EU CLASSIFIED INFORMATION HANDLED IN INFORMATION TECHNOLOGY AND...
25.1.
Introduction
25.1.1.
General
25.1.2.
Threats to, and vulnerabilities of systems
25.1.3.
Main purpose of security measures
25.1.4.
System-specific security requirement statement (SSRS)
25.1.5.
Security modes of operation
25.2.
Definitions
25.3.
Security responsibilities
25.3.1.
General
25.3.2.
The Security accreditation authority (SAA)
25.3.3.
The INFOSEC Authority (IA)
25.3.4.
The Technical Systems Owner (TSO)
25.3.5.
The Information Owner (IO)
25.3.6.
Users
25.3.7.
INFOSEC training
25.4.
Non technical security measures
25.4.1.
Personnel security
25.4.2.
Physical security
25.4.3.
Control of access to a system
25.5.
Technical security measures
25.5.1.
Security of information
25.5.2.
Control and accountability of information
25.5.3.
Handling and control of removable computer storage media
25.5.4.
Declassification and destruction of computer storage media
25.5.5.
Communications security
25.5.6.
Installation and radiation security
25.6.
Security during handling
25.6.1.
Security operating procedures (SecOPs)
25.6.2.
Software protection/configuration management
25.6.3.
Checking for the presence of malicious software/computer viruses
25.6.4.
Maintenance
25.7.
Procurement
25.7.1.
General
25.7.2.
Accreditation
25.7.3.
Evaluation and certification
25.7.4.
Routine checking of security features for continued accreditation
25.8.
Temporary or occasional use
25.8.1.
Security of microcomputers/personal computers
25.8.2.
Use of privately-owned IT equipment for official Commission work
25.8.3.
Use of contractor-owned or nationally-supplied IT equipment for official Commission...
26.
RELEASE OF EU CLASSIFIED INFORMATION TO THIRD STATES OR INTERNATIONAL...
26.1.1.
Principles regulating the release of EU classified information
26.1.2.
Levels
26.1.3.
Security agreements
27.
COMMON MINIMUM STANDARDS ON INDUSTRIAL SECURITY
27.1.
Introduction
27.2.
Definitions
27.3.
Organisation
(a). . . . . . . . . ....
(b). . . . . . . . . ....
(c). . . . . . . . . ....
(d). . . . . . . . . ....
(e). . . . . . . . . ....
27.4.
Classified contracts and grant decisions
(a)
The security classification of contracts or grant agreements must take...
(b). . . . . . . . . ....
(c). . . . . . . . . ....
(d). . . . . . . . . ....
(e). . . . . . . . . ....
(f). . . . . . . . . ....
(g). . . . . . . . . ....
(h). . . . . . . . . ....
(i). . . . . . . . . ....
(j). . . . . . . . . ....
(k). . . . . . . . . ....
(l). . . . . . . . . ....
(m). . . . . . . . . ....
(n). . . . . . . . . ....
(o). . . . . . . . . ....
(p). . . . . . . . . ....
27.5.
Visits
27.6.
Transmission and transportation of EU classified information
(a). . . . . . . . . ....
(b)
The international transportation of EU classified material relating to classified...
Appendix 1
Appendix 2
PRACTICAL CLASSIFICATION GUIDE
. . . . . . . . . ....
Appendix 3
Guidelines for the release of EU classified information to third States or international organisations: Level 1 cooperation
PROCEDURES
1.. . . . . . . . . ....
2.. . . . . . . . . ....
3.
In doing so he/she:
4.. . . . . . . . . ....
SECURITY PROVISIONS TO BE APPLIED BY BENEFICIARIES
5.. . . . . . . . . ....
6.. . . . . . . . . ....
7.
Personnel
8.
Transmission of documents
9.
Registration
10.
Destruction
11.
Protection of documents
12.
Copies, translations and extracts
13.
Breaches of security
14.
Inspections
15.
Reporting
Appendix 4
Guidelines for the release of EU classified information to third States or international organisations: Level 2 cooperation
PROCEDURES
1.. . . . . . . . . ....
2.. . . . . . . . . ....
3.. . . . . . . . . ....
4.
In doing so he/she:
5.
The Commission Security Policy Advisory Group's opinion shall be on...
6.. . . . . . . . . ....
SECURITY RULES TO BE APPLIED BY BENEFICIARIES
7.. . . . . . . . . ....
8.. . . . . . . . . ....
9.. . . . . . . . . ....
10.
Personnel
11.
Transmission of documents
12.
Registration on arrival
13.
Return of documents
14.
Protection
15.
Physical security
16.
Breaches of security
17.
Inspections
18.
Reporting
Appendix 5
Guidelines for the release of EU classified information to third States or international organisations: Level 3 cooperation
PROCEDURES
1.. . . . . . . . . ....
2.. . . . . . . . . ....
3.. . . . . . . . . ....
4.. . . . . . . . . ....
5.. . . . . . . . . ....
6.. . . . . . . . . ....
7.. . . . . . . . . ....
8.. . . . . . . . . ....
9.. . . . . . . . . ....
10.. . . . . . . . . ....
SECURITY PROVISIONS TO BE APPLIED BY BENEFICIARIES
11.. . . . . . . . . ....
12.. . . . . . . . . ....
13.
Transmission of documents
14.
Registration on arrival
15.
Use and protection of the classified information exchanged
16.
Destruction
17.
Breaches of security
Appendix 6
Commission Decision
of 29 November 2001
amending its internal Rules of Procedure
(notified under document number C(2001) 3031)
(2001/844/EC, ECSC, Euratom) (repealed)
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Repealed by Commission Decision (EU, Euratom) 2015/444 of 13 March 2015 on the security rules for protecting EU classified information.