Council Decision of 23 September 2013 on the security rules for protecting EU classified information (2013/488/EU)

Article 16 U.K. The organisation of security in the Council

1. As part of its role in ensuring overall consistency in the application of this Decision, the Council shall approve:

(a) agreements referred to in Article 13(2)(a);

(b) decisions authorising or consenting to the release of EUCI originating in or held by the Council to third States and international organisations, in accordance with the principle of originator consent;

(c) an annual assessment visit programme recommended by the Security Committee for visits to assess Member States’ services and premises, Union bodies, agencies and entities which apply this Decision or the principles thereof, and for assessment visits to third States and international organisations in order to ascertain the effectiveness of measures implemented for protecting EUCI; and

(d) security policies as foreseen in Article 6(1).

2. The Secretary-General shall be the GSC’s Security Authority. In that capacity, the Secretary-General shall:

(a) implement the Council’s security policy and keep it under review;

(b) coordinate with Member States’ NSAs on all security matters relating to the protection of classified information relevant for the Council’s activities;

(c) grant GSC officials, other servants and seconded national experts authorisation for access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above in accordance with Article 7(3);

(d) as appropriate, order investigations into any actual or suspected compromise or loss of classified information held by or originating in the Council and request the relevant security authorities to assist in such investigations;

(e) undertake periodic inspections of the security arrangements for protecting classified information on GSC premises;

(f) undertake periodic visits to assess the security arrangements for protecting EUCI in Union bodies, agencies and entities which apply this Decision or the principles thereof;

(g) undertake, jointly and in agreement with the NSA concerned, periodic assessments of the security arrangements for protecting EUCI in Member States’ services and premises;

(h) ensure that security measures are coordinated as necessary with the competent authorities of the Member States which are responsible for protecting classified information and, as appropriate, third States or international organisations, including on the nature of threats to the security of EUCI and the means of protection against them; and

(i) enter into the administrative arrangements referred to in Article 13(2)(b).

The Security Office of the GSC shall be at the disposal of the Secretary-General to assist in those responsibilities.

3. For the purposes of implementing Article 15(3), Member States should:

(a) designate an NSA, as listed in Appendix C, responsible for security arrangements for protecting EUCI in order that:

(i)

EUCI held by any national department, body or agency, public or private, at home or abroad, is protected in accordance with this Decision;

(ii)

security arrangements for protecting EUCI are periodically inspected or assessed;

(iii)

all individuals employed within a national administration or by a contractor who may be granted access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above are appropriately security cleared or are otherwise duly authorised by virtue of their functions in accordance with national laws and regulations;

(iv)

security programmes are set up as necessary in order to minimise the risk of EUCI being compromised or lost;

(v)

security matters related to protecting EUCI are coordinated with other competent national authorities, including those referred to in this Decision; and

(vi)

responses are given to appropriate security clearance requests in particular from any Union bodies, agencies, entities, operations established under Title V, Chapter 2 of the TEU, and EU Special Representatives (EUSRs) and their teams which apply this Decision or the principles thereof;

(b) ensure that their competent authorities provide information and advice to their governments, and through them to the Council, on the nature of threats to the security of EUCI and the means of protection against them.