Article 1
Purpose, scope and definitions
Article 2
Definition of EUCI, security classifications and markings
Article 3
Classification management
Article 4
Protection of classified information
Article 5
Security risk management
Article 6
Implementation of this Decision
Article 7
Personnel security
Article 8
Physical security
Article 9
Management of classified information
Article 10
Protection of EUCI handled in communication and information systems
Article 11
Industrial security
Article 12
Exchange of classified information with third States and international organisations
Article 13
Breaches of security and compromise of EUCI
Article 14
Responsibility for implementation
Article 15
The organisation of security in the Council
Article 16
Security Committee
Article 17
Replacement of previous decision
Article 18
Entry into force
ANNEXES
ANNEX I
ANNEX II
ANNEX III
ANNEX IV
ANNEX V
ANNEX VI
ANNEX I
PERSONNEL SECURITY
I.
INTRODUCTION
1.
This Annex sets out provisions for implementing Article 7. It...
2.
Throughout this Annex, except where the distinction is relevant, the...
II.
AUTHORISING ACCESS TO EUCI
3.
An individual shall only be authorised to access information classified...
4.
Each Member State and the GSC shall identify the positions...
III.
PERSONNEL SECURITY CLEARANCE REQUIREMENTS
5.
After having received a duly authorised request, NSAs or other...
6.
Should the individual concerned reside in the territory of another...
7.
Where permissible under national laws and regulations, NSAs or other...
Security investigation criteria
8.
The loyalty, trustworthiness and reliability of an individual for the...
9.
Where appropriate and in accordance with national laws and regulations,...
10.
Where appropriate and in accordance with national laws and regulations,...
Investigative requirements for access to EUCI
Initial granting of a PSC
11.
The initial PSC for access to information classified CONFIDENTIEL UE/EU...
12.
The initial PSC for access to information classified TRÈS SECRET...
13.
Where necessary and in accordance with national laws and regulations,...
Renewal of a PSC
14.
After the initial granting of a PSC and provided that...
15.
For the renewal of PSCs, the elements outlined in paragraphs...
16.
Requests for renewal shall be made in a timely manner...
PSC procedures in the GSC
17.
For officials and other servants in the GSC, the GSC...
18.
Where information relevant for a security investigation becomes known to...
19.
Following completion of the security investigation, the relevant NSA shall...
20.
The security investigation together with the results obtained shall be...
21.
The assurance on which an EU PSC is based, provided...
22.
If an individual’s period of service does not commence within...
23.
Where information becomes known to the GSC concerning a security...
24.
Any decision to withdraw an EU PSC from a GSC...
25.
National experts seconded to the GSC for a position requiring...
Records of PSCs
26.
Records of national PSCs and EU PSCs granted for access...
27.
The competent security authority may issue a Personnel Security Clearance...
Exemptions from the PSC requirement
28.
Access to EUCI by individuals in Member States duly authorised...
IV.
SECURITY EDUCATION AND AWARENESS
29.
All individuals who have been granted a PSC shall acknowledge...
30.
All individuals who are authorised to have access to, or...
31.
All individuals who cease to be employed in duties requiring...
V.
EXCEPTIONAL CIRCUMSTANCES
32.
Where permissible under national laws and regulations, a personnel security...
33.
For reasons of urgency, where duly justified in the interests...
34.
When an individual is to be assigned to a position...
35.
The above procedure shall be used for one-time access to...
36.
In very exceptional circumstances, such as missions in hostile environments...
37.
In the case of information classified TRÈS SECRET UE/EU TOP...
38.
The Security Committee shall be informed of cases when recourse...
39.
Where national laws and regulations of a Member State stipulate...
40.
The Security Committee shall receive an annual report on recourse...
VI.
ATTENDANCE AT MEETINGS IN THE COUNCIL
41.
Subject to paragraph 28, individuals assigned to participate in meetings...
42.
Where a national PSC for access to EUCI is withdrawn...
VII.
POTENTIAL ACCESS TO EUCI
43.
When individuals are to be employed in circumstances in which...
44.
Couriers, guards and escorts shall be security cleared to the...
ANNEX II
PHYSICAL SECURITY
I.
INTRODUCTION
1.
This Annex sets out provisions for implementing Article 8. It...
2.
Physical security measures shall be designed to prevent unauthorised access...
II.
PHYSICAL SECURITY REQUIREMENTS AND MEASURES
3.
Physical security measures shall be selected on the basis of...
4.
The competent security authority, applying the concept of defence in...
5.
The competent authority can be authorised to conduct entry and...
6.
When EUCI is at risk from overlooking, even accidentally, appropriate...
7.
For new facilities, physical security requirements and their functional specifications...
III.
EQUIPMENT FOR THE PHYSICAL PROTECTION OF EUCI
8.
When acquiring equipment (such as security containers, shredding machines, door...
9.
The technical specifications of equipment to be used for the...
10.
Security systems shall be inspected at regular intervals and equipment...
11.
The effectiveness of individual security measures and of the overall...
IV.
PHYSICALLY PROTECTED AREAS
12.
Two types of physically protected areas, or the national equivalents...
13.
The competent security authority shall establish that an area meets...
14.
For Administrative Areas:
15.
For Secured Areas:
16.
Where entry into a Secured Area constitutes, for all practical...
17.
Secured Areas protected against eavesdropping shall be designated technically Secured...
18.
Notwithstanding point (d) of paragraph 17, before being used in...
19.
Secured Areas which are not occupied by duty personnel on...
20.
Secured Areas and technically Secured Areas may be set up...
21.
Security operating procedures shall be drawn up for each Secured...
22.
Strong rooms shall be constructed within Secured Areas. The walls,...
V.
PHYSICAL PROTECTIVE MEASURES FOR HANDLING AND STORING EUCI
23.
EUCI which is classified RESTREINT UE/EU RESTRICTED may be handled:...
24.
EUCI which is classified RESTREINT UE/EU RESTRICTED shall be stored...
25.
EUCI which is classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU...
26.
EUCI which is classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU...
27.
EUCI which is classified TRÈS SECRET UE/EU TOP SECRET shall...
28.
EUCI which is classified TRÈS SECRET UE/EU TOP SECRET shall...
29.
Rules governing the carriage of EUCI outside physically protected areas...
VI.
CONTROL OF KEYS AND COMBINATIONS USED FOR PROTECTING EUCI
30.
The competent security authority shall define procedures for managing keys...
31.
Combination settings shall be committed to memory by the smallest...
ANNEX III
MANAGEMENT OF CLASSIFIED INFORMATION
I.
INTRODUCTION
1.
This Annex sets out provisions for implementing Article 9. It...
II.
CLASSIFICATION MANAGEMENT
Classifications and markings
2.
Information shall be classified where it requires protection with regard...
3.
The originator of EUCI shall be responsible for determining the...
4.
The classification level of EUCI shall be determined in accordance...
5.
The security classification shall be clearly and correctly indicated, regardless...
6.
Individual parts of a given document (i.e. pages, paragraphs, sections,...
7.
The overall classification level of a document or file shall...
8.
To the extent possible, documents containing parts with different classification...
9.
The classification of a letter or note covering enclosures shall...
Markings
10.
In addition to one of the security classification markings set...
Abbreviated classification markings
11.
Standardised abbreviated classification markings may be used to indicate the...
12.
The following standard abbreviations may be used within EU classified...
Creation of EUCI
13.
When creating an EU classified document:
14.
Where it is not possible to apply paragraph 13 to...
Downgrading and declassification of EUCI
15.
At the time of its creation, the originator shall indicate,...
16.
The GSC shall regularly review EUCI held by it to...
III.
REGISTRATION OF EUCI FOR SECURITY PURPOSES
17.
For every organisational entity within the GSC and Member States’...
18.
For the purposes of this Decision, registration for security purposes...
19.
All material classified CONFIDENTIEL UE/EU CONFIDENTIAL and above shall be...
20.
The Central Registry within the GSC shall keep a record...
21.
In the case of a CIS, registration procedures may be...
22.
The Council shall approve a security policy on the registration...
TRÈS SECRET UE/EU TOP SECRET registries
23.
A registry shall be designated in the Member States and...
24.
Such subordinate registries may not transmit TRÈS SECRET UE/EU TOP...
IV.
COPYING AND TRANSLATING EU CLASSIFIED DOCUMENTS
25.
TRÈS SECRET UE/EU TOP SECRET documents shall not be copied...
26.
Where the originator of documents classified SECRET UE/EU SECRET and...
27.
The security measures applicable to the original document shall apply...
V.
CARRIAGE OF EUCI
28.
Carriage of EUCI shall be subject to the protective measures...
29.
The competent security authorities in the GSC and in Member...
Within a building or self-contained group of buildings
30.
EUCI carried within a building or self-contained group of buildings...
31.
Within a building or self-contained group of buildings, information classified...
Within the EU
32.
EUCI carried between buildings or premises within the EU shall...
33.
The carriage of information classified up to SECRET UE/EU SECRET...
34.
Material classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET (e.g....
35.
The carriage of information classified TRÈS SECRET UE/EU TOP SECRET...
From within the EU to the territory of a third...
36.
EUCI carried from within the EU to the territory of...
37.
The carriage of information classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET...
38.
The carriage of information classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET...
39.
Information classified RESTREINT UE/EU RESTRICTED may also be carried by...
40.
The carriage of information classified TRÈS SECRET UE/EU TOP SECRET...
VI.
DESTRUCTION OF EUCI
41.
EU classified documents which are no longer required may be...
42.
Documents subject to registration in accordance with Article 9(2) shall...
43.
For documents classified SECRET UE/EU SECRET or TRÈS SECRET UE/EU...
44.
The registrar and the witness, where the presence of the...
45.
Classified documents, including those classified RESTREINT UE/EU RESTRICTED, shall be...
46.
The destruction of computer storage media used for EUCI shall...
VII.
INSPECTIONS AND ASSESSMENT VISITS
47.
The term ‘inspection’ shall be used hereinafter to designate any:...
48.
Inspections shall be carried out, inter alia to:
49.
Before the end of each calendar year, the Council shall...
Conduct of inspections
50.
Inspections shall be conducted in order to check the relevant...
51.
Inspections shall be conducted in two phases. Prior to the...
52.
Inspections in Member States’ national administrations shall be conducted under...
53.
Inspections of third States and international organisations shall be conducted...
54.
Inspections of EU agencies and bodies established under Title V,...
55.
In the case of inspections of EU agencies and bodies...
Inspection reports
56.
At the end of the inspection the main conclusions and...
57.
For inspections conducted in Member States’ national administrations:
58.
For assessment visits of third States and international organisations, the...
59.
For inspections of EU agencies and bodies established under Title...
60.
The GSC Security Authority shall conduct regular inspections of organisational...
Inspection checklist
61.
The GSC Security Authority (Security Office) shall draw up and...
62.
The information to complete the checklist shall be obtained in...
ANNEX IV
PROTECTION OF EUCI HANDLED IN CIS
I.
INTRODUCTION
1.
This Annex sets out provisions for implementing Article 10.
2.
The following IA properties and concepts are essential for the...
II.
INFORMATION ASSURANCE PRINCIPLES
3.
The provisions set out below shall form the baseline for...
Security risk management
4.
Security risk management shall be an integral part of defining,...
5.
The competent authorities shall review the potential threats to CIS...
6.
The aim of security risk treatment shall be to apply...
7.
The specific requirements, scale and the degree of detail determined...
Security throughout the CIS-life cycle
8.
Ensuring security shall be a requirement throughout the entire CIS...
9.
The role and interaction of each actor involved in a...
10.
Any CIS, including its technical and non-technical security measures, shall...
11.
Security assessments, inspections and reviews shall be performed periodically during...
12.
Security documentation for a CIS shall evolve over its life-cycle...
Best practice
13.
The GSC and the Member States shall cooperate to develop...
14.
The protection of EUCI handled on CIS shall draw on...
15.
The dissemination and subsequent implementation of best practice shall help...
Defence in depth
16.
To mitigate risk to CIS, a range of technical and...
17.
The competent authorities shall ensure that they can respond to...
Principle of minimality and least privilege
18.
Only the essential functionalities, devices and services to meet operational...
19.
CIS users and automated processes shall be given only the...
20.
Registration procedures performed by a CIS, where required, shall be...
Information Assurance awareness
21.
Awareness of the risks and available security measures is the...
22.
To ensure that security responsibilities are understood, IA education and...
Evaluation and approval of IT-security products
23.
The required degree of confidence in the security measures, defined...
24.
The level of assurance shall be verified by using internationally...
25.
Cryptographic products for protecting EUCI shall be evaluated and approved...
26.
Prior to being recommended for approval by the Council or...
27.
Where warranted on specific operational grounds, the Council or the...
28.
An AQUA shall be a CAA of a Member State...
29.
The Council shall approve a security policy on the qualification...
Transmission within Secured Areas
30.
Notwithstanding the provisions of this Decision, when transmission of EUCI...
Secure interconnection of CIS
31.
For the purposes of this Decision, an interconnection shall mean...
32.
A CIS shall treat any interconnected IT system as untrusted...
33.
For all interconnections of CIS with another IT system the...
34.
There shall be no interconnection between an accredited CIS and...
35.
The direct or cascaded interconnection of a CIS accredited to...
Computer storage media
36.
Computer storage media shall be destroyed in accordance with procedures...
37.
Computer storage media shall be reused, downgraded or declassified in...
Emergency circumstances
38.
Notwithstanding the provisions of this Decision, the specific procedures described...
39.
EUCI may be transmitted using cryptographic products which have been...
40.
Classified information transmitted under the circumstances set out in paragraph...
41.
Should recourse be made to paragraph 38 a subsequent report...
III.
INFORMATION ASSURANCE FUNCTIONS AND AUTHORITIES
42.
The following IA functions shall be established in the Member...
Information Assurance Authority
43.
The IAA shall be responsible for:
TEMPEST Authority
44.
The TEMPEST Authority (TA) shall be responsible for ensuring compliance...
Crypto Approval Authority
45.
The Crypto Approval Authority (CAA) shall be responsible for ensuring...
Crypto Distribution Authority
46.
The Crypto Distribution Authority (CDA) shall be responsible for:
Security Accreditation Authority
47.
The SAA for each system shall be responsible for:
48.
The GSC SAA shall be responsible for accrediting all CIS...
49.
The relevant SAA of a Member State shall be responsible...
50.
A joint Security Accreditation Board (SAB) shall be responsible for...
Information Assurance Operational Authority
51.
The IA Operational Authority for each system shall be responsible...
ANNEX V
INDUSTRIAL SECURITY
I.
INTRODUCTION
1.
This Annex sets out provisions for implementing Article 11. It...
2.
The Council shall approve a policy on industrial security outlining...
II.
SECURITY ELEMENTS IN A CLASSIFIED CONTRACT
Security classification guide (SCG)
3.
Prior to launching a call for tender or letting a...
4.
In order to determine the security classification of the various...
Security aspects letter (SAL)
5.
The contract-specific security requirements shall be described in an SAL....
6.
The SAL shall contain the provisions requiring the contractor and/or...
Programme/project security instructions (PSI)
7.
Depending on the scope of programmes or projects involving access...
III.
FACILITY SECURITY CLEARANCE (FSC)
8.
An FSC shall be granted by the NSA or DSA...
9.
When issuing an FSC, the relevant NSA or DSA shall,...
10.
Where relevant, the GSC, as the contracting authority, shall notify...
11.
The contracting authority shall not award a classified contract with...
12.
The NSA/DSA or any other competent security authority which has...
13.
Withdrawal of an FSC by the relevant NSA/DSA or any...
IV.
CLASSIFIED CONTRACTS AND SUB-CONTRACTS
14.
Where EUCI is provided to a bidder at the pre-contractual...
15.
Once a classified contract or sub-contract has been awarded, the...
16.
When such contracts are terminated, the GSC, as the contracting...
17.
As a general rule, the contractor or subcontractor shall be...
18.
Specific provisions for the disposal of EUCI during the performance...
19.
Where the contractor or subcontractor is authorised to retain EUCI...
20.
The conditions under which the contractor may subcontract shall be...
21.
A contractor shall obtain permission from the GSC, as the...
22.
The contractor shall be responsible for ensuring that all sub-contracting...
23.
With regard to EUCI created or handled by the contractor...
V.
VISITS IN CONNECTION WITH CLASSIFIED CONTRACTS
24.
Where the GSC, contractors or subcontractors require access to information...
25.
All visitors shall hold an appropriate PSC and have a...
26.
Visitors shall be given access only to EUCI related to...
VI.
TRANSMISSION AND CARRIAGE OF EUCI
27.
With regard to the transmission of EUCI by electronic means,...
28.
With regard to the carriage of EUCI, the relevant provisions...
29.
For the transport of classified material as freight, the following...
VII.
TRANSFER OF EUCI TO CONTRACTORS LOCATED IN THIRD STATES
30.
EUCI shall be transferred to contractors and subcontractors located in...
VIII.
HANDLING AND STORAGE OF INFORMATION CLASSIFIED RESTREINT UE/EU RESTRICTED
31.
In liaison, as appropriate, with the NSA/DSA of the Member...
32.
To the extent necessary under national laws and regulations, NSAs/DSAs...
33.
An FSC or a PSC for contractors or subcontractors and...
34.
The GSC, as the contracting authority, shall examine the responses...
35.
The conditions under which the contractor may subcontract shall be...
36.
Where a contract involves handling information classified RESTREINT UE/EU RESTRICTED...
ANNEX VI
EXCHANGE OF CLASSIFIED INFORMATION WITH THIRD STATES AND INTERNATIONAL ORGANISATIONS
I.
INTRODUCTION
1.
This Annex sets out provisions for implementing Article 12.
II.
FRAMEWORKS GOVERNING THE EXCHANGE OF CLASSIFIED INFORMATION
2.
Where the Council determines that a long-term need exists to...
3.
Where EUCI generated for the purposes of a CSDP operation...
4.
In the absence of a framework referred to in paragraphs...
III.
SECURITY OF INFORMATION AGREEMENTS
5.
Security of information agreements shall establish the basic principles and...
6.
Security of information agreements shall provide for technical implementing arrangements...
7.
No EUCI shall be exchanged by electronic means unless explicitly...
8.
Security of information agreements shall provide that prior to the...
9.
When the Council concludes a security of information agreement, a...
10.
In order to assess the effectiveness of the security regulations,...
11.
The team conducting an assessment visit on behalf of the...
12.
The findings of such visits shall be set out in...
13.
Every endeavour shall be made to conduct a full security...
14.
The Security Committee may decide that pending examination of the...
15.
In mutual agreement with the third State or international organisation...
16.
Once the security of information agreement is in force and...
IV.
ADMINISTRATIVE ARRANGEMENTS
17.
Where a long-term need exists to exchange information classified as...
18.
Where, for urgent operational reasons, a framework for exchanging classified...
19.
Administrative arrangements shall as a general rule take the form...
20.
An assessment visit referred to in paragraph 10 shall be...
21.
No EUCI shall be exchanged by electronic means unless explicitly...
V.
EXCHANGE OF CLASSIFIED INFORMATION IN THE CONTEXT OF CSDP OPERATIONS...
22.
Framework participation agreements govern the participation of third States or...
23.
ad hoc participation agreements concluded for a specific CSDP operation...
24.
ad hoc administrative arrangements on a third State’s or international...
25.
No implementing arrangements or assessment visits are required prior to...
26.
Where the host State on whose territory an CSDP operation...
27.
The provisions on classified information to be included in framework...
28.
If a security of information agreement is subsequently concluded between...
29.
No exchange of EUCI by electronic means shall be permitted...
30.
EUCI generated for the purposes of a CSDP operation may...
VI.
EXCEPTIONAL AD HOC RELEASE OF EUCI
31.
Where no framework is in place in accordance with Sections...
32.
If the Security Committee issues a recommendation in favour of...
33.
If the Security Committee’s recommendation is not in favour of...
34.
Where deemed appropriate, and subject to the prior written consent...
35.
Following a decision to release EUCI, the GSC shall forward...
VII.
AUTHORITY TO RELEASE EUCI TO THIRD STATES OR INTERNATIONAL ORGANISATIONS...
36.
Where a framework exists in accordance with paragraph 2 for...
37.
Where a framework exists in accordance with paragraph 3 for...
38.
The Secretary-General may delegate such authorisations to senior GSC officials...
Appendices
Appendix A
Appendix B
Appendix C
Appendix D
Appendix A
DEFINITIONS
For the purposes of this Decision, the following definitions shall...
‘Accreditation’ means the process leading to a formal statement by...
Appendix B
Appendix C
LIST OF NATIONAL SECURITY AUTHORITIES (NSAs)
BELGIUM
DENMARK
BULGARIA
GERMANY
CZECH REPUBLIC
ESTONIA
IRELAND
SPAIN
GREECE
FRANCE
ITALY
LATVIA
CYPRUS
LITHUANIA
LUXEMBOURG
NETHERLANDS
HUNGARY
MALTA
AUSTRIA
POLAND
ROMANIA
PORTUGAL
SLOVENIA
SLOVAKIA
SWEDEN
FINLAND
UNITED KINGDOM
Appendix D
Council Decision
of 31 March 2011
on the security rules for protecting EU classified information
(2011/292/EU)
THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 240(3) thereof,
Having regard to Council Decision 2009/937/EU of 1 December 2009 adopting the Council’s Rules of Procedure , and in particular Article 24 thereof,
Whereas:
(1)
In order to develop Council activities in all areas which require handling classified information, it is appropriate to establish a comprehensive security system for protecting classified information covering the Council, its General Secretariat and the Member States.
(2)
This Decision should apply where the Council, its preparatory bodies and the General Secretariat of the Council (GSC) handle EU classified information (EUCI).
(3)
In accordance with national laws and regulations and to the extent required for the functioning of the Council, the Member States should respect this Decision where their competent authorities, personnel or contractors handle EUCI, in order that each may be assured that an equivalent level of protection is afforded to EUCI.
(4)
The Council and the Commission are committed to applying equivalent security standards for protecting EUCI.
(5)
The Council underlines the importance of associating, where appropriate, the European Parliament and other EU institutions, agencies, bodies or offices with the principles, standards and rules for protecting classified information which are necessary in order to protect the interests of the Union and its Member States.
(6)
EU agencies and bodies established under Title V, Chapter 2, of the Treaty on European Union, Europol and Eurojust apply, in the context of their internal organisation, the basic principles and minimum standards laid down in this Decision for protecting EUCI, as provided for in their respective founding acts.
(7)
Crisis management operations established under Title V, Chapter 2, of the TEU and their personnel apply the security rules adopted by the Council for protecting EUCI.
(8)
EU Special Representatives and the members of their teams apply the security rules adopted by the Council for protecting EUCI.
(9)
This Decision is taken without prejudice to Articles 15 and 16 of the Treaty on the Functioning of the European Union (TFEU) and to instruments implementing them.
(10)
This Decision is taken without prejudice to existing practices in Member States with regard to informing their national Parliaments about the activities of the Union,
HAS ADOPTED THIS DECISION:
OJ L 325, 11.12.2009, p. 35.