Council Decision of 23 September 2013 on the security rules for protecting EU classified information (2013/488/EU)

Article 9 Management of classified information

1. The management of classified information is the application of administrative measures for controlling EUCI throughout its life-cycle to supplement the measures provided for in Articles 7, 8 and 10 and thereby help deter and detect deliberate or accidental compromise or loss of such information. Such measures relate in particular to the creation, registration, copying, translation, downgrading, declassification, carriage and destruction of EUCI.

2. Information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above shall be registered for security purposes prior to distribution and on receipt. The competent authorities in the GSC and in the Member States shall establish a registry system for this purpose. Information classified TRÈS SECRET UE/EU TOP SECRET shall be registered in designated registries.

3. Services and premises where EUCI is handled or stored shall be subject to regular inspection by the competent security authority.

4. EUCI shall be conveyed between services and premises outside physically protected areas as follows:

(a) as a general rule, EUCI shall be transmitted by electronic means protected by cryptographic products approved in accordance with Article 10(6);

(b) when the means referred to in point (a) are not used, EUCI shall be carried either:

(i)

on electronic media (e.g. USB sticks, CDs, hard drives) protected by cryptographic products approved in accordance with Article 10(6); or

(ii)

in all other cases, as prescribed by the competent security authority in accordance with the relevant protective measures laid down in Annex III.

5. Provisions for implementing this Article are set out in Annexes III and IV.