Council Decision of 31 March 2011 on the security rules for protecting EU classified information (2011/292/EU)

Article 15 U.K. The organisation of security in the Council

1. As part of its role in ensuring overall consistency in the application of this Decision, the Council shall approve:

(a) agreements referred to in Article 12(2)(a);

(b) decisions authorising the release of EUCI to third States and international organisations;

(c) an annual inspection programme proposed by the Secretary-General and recommended by the Security Committee for inspections of Member States’ services and premises and of EU agencies and bodies established under Title V, Chapter 2 of the TEU as well as of Europol and Eurojust, and assessment visits to third States and international organisations in order to ascertain the effectiveness of measures implemented for protecting EUCI; and

(d) security policies as foreseen in Article 6(1).

2. The Secretary-General shall be the GSC’s Security Authority. In that capacity, the Secretary-General shall:

(a) implement the Council’s security policy and keep it under review;

(b) coordinate with Member States’ NSAs on all security matters relating to the protection of classified information relevant for the Council’s activities;

(c) grant EU PSCs to GSC officials and other servants in accordance with Article 7(3) before they may be granted access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above;

(d) as appropriate, order investigations into any actual or suspected compromise or loss of classified information held by or originating in the Council and request the relevant security authorities to assist in such investigations;

(e) undertake periodic inspections of the security arrangements for protecting classified information on GSC premises;

(f) undertake periodic inspections of the security arrangements for protecting EUCI in EU agencies and bodies established under Title V, Chapter 2, of the TEU, Europol, Eurojust, as well as in crisis management operations established under Title V, Chapter 2, of the TEU and by EU Special Representatives (EUSR) and the members of their teams;

(g) undertake, jointly and in agreement with the NSA concerned, periodic inspections of the security arrangements for protecting EUCI in Member States’ services and premises;

(h) coordinate security measures with the competent authorities of the Member States which are responsible for protecting classified information and, as appropriate, third States or international organisations, including on the nature of threats to the security of EUCI and the means of protection against them;

(i) enter into the administrative arrangements referred to in Article 12(2)(b); and

(j) undertake initial and periodic assessment visits to third States or international organisations in order to ascertain the effectiveness of measures implemented for protecting EUCI provided to or exchanged with them.

The Security Office of the GSC shall be at the disposal of the Secretary-General to assist in these responsibilities.

3. For the purposes of implementing Article 14(3), Member States should:

(a) designate an NSA responsible for security arrangements for protecting EUCI in order that:

(i)

EUCI held by any national department, body or agency, public or private, at home or abroad, is protected in accordance with this Decision;

(ii)

security arrangements for protecting EUCI are periodically inspected;

(iii)

all individuals employed within a national administration or by a contractor who may be granted access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above are appropriately security cleared or are otherwise duly authorised by virtue of their functions in accordance with national laws and regulations;

(iv)

security programmes are set up as necessary in order to minimise the risk of EUCI being compromised or lost;

(v)

security matters related to protecting EUCI are coordinated with other competent national authorities, including those referred to in this Decision; and

(vi)

responses are given to appropriate security clearance requests from EU agencies and bodies established under Title V, Chapter 2 of the TEU, Europol, Eurojust, as well as crisis management operations established under Title V, Chapter 2, of the TEU and EUSRs and their teams.

NSAs are listed in Appendix C;

(b) ensure that their competent authorities provide information and advice to their governments, and through them to the Council, on the nature of threats to the security of EUCI and the means of protection against them.