Appendices
Appendix A

DEFINITIONS
For the purposes of this Decision, the following definitions shall apply:
- ‘Accreditation’ means the process leading to a formal statement by the Security Accreditation Authority (SAA) that a system is approved to operate with a defined level of classification, in a particular security mode in its operational environment and at an acceptable level of risk, based on the premise that an approved set of technical, physical, organisational and procedural security measures has been implemented;
- ‘Asset’ means anything that is of value to an organisation, its business operations and their continuity, including information resources that support the organisation’s mission;
- ‘Authorisation for access to EUCI’ means a decision by the GSC Appointing Authority taken on the basis of an assurance given by a competent authority of a Member State that a GSC official, other servant or seconded national expert may, provided his ‘need-to-know’ has been determined and he has been appropriately briefed on his responsibilities, be granted access to EUCI up to a specified level (CONFIDENTIEL UE/EU CONFIDENTIAL or above) until a specified date;
- ‘CIS life-cycle’ means the entire duration of existence of a CIS, which includes initiation, conception, planning, requirements analysis, design, development, testing, implementation, operation, maintenance and decommissioning;
- ‘Classified contract’ means a contract entered into by the GSC with a contractor for the supply of goods, execution of works or provision of services, the performance of which requires or involves access to or the creation of EUCI;
- ‘Classified subcontract’ means a contract entered into by a contractor of the GSC with another contractor (i.e. the subcontractor) for the supply of goods, execution of works or provision of services, the performance of which requires or involves access to or the creation of EUCI;
- ‘Communication and information system’ (CIS) — see Article 10(2);
- ‘Contractor’ means an individual or legal entity possessing the legal capacity to undertake contracts;
- ‘Cryptographic (Crypto) material’ means cryptographic algorithms, cryptographic hardware and software modules, and products including implementation details and associated documentation and keying material;
- ‘Cryptographic product’ means a product whose primary and main functionality is the provision of security services (confidentiality, integrity, availability, authenticity, non-repudiation) through one or more cryptographic mechanisms;
- ‘CSDP operation’ means a military or civilian crisis management operation under Title V, Chapter 2, of the TEU;
- ‘Declassification’ means the removal of any security classification;
- ‘Defence in depth’ means the application of a range of security measures organised as multiple layers of defence;
- ‘Designated Security Authority’ (DSA) means an authority responsible to the National Security Authority (NSA) of a Member State which is responsible for communicating to industrial or other entities national policy on all matters of industrial security and for providing direction and assistance in its implementation. The function of DSA may be carried out by the NSA or by any other competent authority;
- ‘Document’ means any recorded information regardless of its physical form or characteristics;
- ‘Downgrading’ means a reduction in the level of security classification;
- ‘EU classified information’ (EUCI) — see Article 2(1);
- ‘Facility Security Clearance’ (FSC) means an administrative determination by an NSA or DSA that, from the security viewpoint, a facility can afford an adequate level of protection to EUCI of a specified security classification level;
- ‘Handling’ of EUCI means all possible actions to which EUCI may be subject throughout its life-cycle. It comprises its creation, processing, carriage, downgrading, declassification and destruction. In relation to CIS it also comprises its collection, display, transmission and storage;
- ‘Holder’ means a duly authorised individual with an established need-to-know who is in possession of an item of EUCI and is accordingly responsible for protecting it;
- ‘Industrial or other entity’ means an entity involved in supplying goods, executing works or providing services; this may be an industrial, commercial, service, scientific, research, educational or development entity or a self-employed individual;
- ‘Industrial security’ — see Article 11(1);
- ‘Information Assurance’ — see Article 10(1);
- ‘Interconnection’ — see Annex IV, paragraph 32;
- ‘Management of classified information’ — see Article 9(1);
- ‘Material’ means any document, data carrier or item of machinery or equipment, either manufactured or in the process of manufacture;
- ‘Originator’ means the Union institution, body or agency, Member State, third state or international organisation under whose authority classified information has been created and/or introduced into the Union’s structures;
- ‘Personnel security’ — see Article 7(1);
- ‘Personnel Security Clearance’ (PSC) means a statement by a competent authority of a Member State which is made following completion of a security investigation conducted by the competent authorities of a Member State and which certifies that an individual may be granted access to EUCI up to a specified level (CONFIDENTIEL UE/EU CONFIDENTIAL or above) until a specified date;
- ‘Personnel Security Clearance Certificate’ (PSCC) means a certificate issued by a competent authority establishing that an individual is security cleared and holds a valid security clearance certificate or authorisation from the Appointing Authority for access to EUCI, and which shows the level of EUCI to which that individual may be granted access (CONFIDENTIEL UE/EU CONFIDENTIAL or above), the date of validity of the relevant PSC and the date of expiry of the certificate itself;
- ‘Physical security’ — see Article 8(1);
- ‘Programme/Project Security Instruction’ (PSI) means a list of security procedures which are applied to a specific programme/project in order to standardise security procedures. It may be revised throughout the programme/project;
- ‘Registration’ — see Annex III, paragraph 18;
- ‘Residual risk’ means the risk which remains after security measures have been implemented, given that not all threats are countered and not all vulnerabilities can be eliminated;
- ‘Risk’ means the potential that a given threat will exploit internal and external vulnerabilities of an organisation or of any of the systems it uses and thereby cause harm to the organisation and to its tangible or intangible assets. It is measured as a combination of the likelihood of threats occurring and their impact.
  - ‘Risk acceptance’ is the decision to agree to the further existence of a residual risk after risk treatment.
  - ‘Risk assessment’ consists of identifying threats and vulnerabilities and conducting the related risk analysis, i.e. the analysis of probability and impact.
  - ‘Risk communication’ consists of developing awareness of risks among CIS user communities, informing approval authorities such risks and reporting them to operating authorities.
  - ‘Risk treatment’ consists of mitigating, removing, reducing (through an appropriate combination of technical, physical, organisational or procedural measures), transferring or monitoring the risk;
- ‘Security Aspects Letter’ (SAL) means a set of special contractual conditions issued by the contracting authority which forms an integral part of any classified contract involving access to or the creation of EUCI, that identifies the security requirements or those elements of the contract requiring security protection;
- ‘Security Classification Guide’ (SCG) means a document which describes the elements of a programme or contract which are classified, specifying the applicable security classification levels. The SCG may be expanded throughout the life of the programme or contract and the elements of information may be re-classified or downgraded; where an SCG exists it shall be part of the SAL;
- ‘Security investigation’ means the investigative procedures conducted by the competent authority of a Member State in accordance with its national laws and regulations in order to obtain an assurance that nothing adverse is known which would prevent an individual from being granted a PSC or an authorisation for access to EUCI up to a specified level (CONFIDENTIEL UE/EU CONFIDENTIAL or above);
- ‘Security mode of operation’ means the definition of the conditions under which a CIS operates based on the classification of information handled and the clearance levels, formal access approvals, and need-to-know of its users. Four modes of operation exist for handling or transmitting classified information: dedicated mode, system-high mode, compartmented mode and multilevel mode:
  - ‘Dedicated mode’ means a mode of operation in which all individuals with access to the CIS are cleared to the highest classification level of information handled within the CIS, and with a common need-to-know for all of the information handled within the CIS,
  - ‘System-high mode’ means a mode of operation in which all individuals with access to the CIS are cleared to the highest classification level of information handled within the CIS, but not all individuals with access to the CIS have a common need-to-know for the information handled within the CIS; approval to access information may be granted by an individual,
  - ‘Compartmented mode’ means a mode of operation in which all individuals with access to the CIS are cleared to the highest classification level of information handled within the CIS, but not all individuals with access to the CIS have a formal authorisation to access all of the information handled within the CIS; formal authorisation implies a formal central management of access control as distinct from an individual’s discretion to grant access,
  - ‘Multilevel mode’ means a mode of operation in which not all individuals with access to the CIS are cleared to the highest classification level of information handled within the CIS, and not all individuals with access to the CIS have a common need-to-know for the information handled within the CIS;
- ‘Security risk management process’ means the entire process of identifying, controlling and minimising uncertain events that may affect the security of an organisation or of any of the systems it uses. It covers the entirety of risk-related activities, including assessment, treatment, acceptance and communication;
- ‘TEMPEST’ means the investigation, study and control of compromising electromagnetic emanations and the measures to suppress them;
- ‘Threat’ means a potential cause of an unwanted incident which may result in harm to an organisation or any of the systems it uses; such threats may be accidental or deliberate (malicious) and are characterised by threatening elements, potential targets and attack methods;
- ‘Vulnerability’ means a weakness of any nature that can be exploited by one or more threats. A vulnerability may be an omission or it may relate to a weakness in controls in terms of their strength, completeness or consistency and may be of a technical, procedural, physical, organisational or operational nature.
Appendix B

EQUIVALENCE OF SECURITY CLASSIFICATIONS
Diffusion Restreinte/Beperkte Verspreiding is not a security classification in Belgium. Belgium handles and protects ‘ RESTREINT UE/EU RESTRICTED ’ information in a manner no less stringent than the standards and procedures described in the security rules of the Council of the European Union.
Germany: VS = Verschlusssache.
France does not use the classification ‘ RESTREINT ’ in its national system. France handles and protects ‘ RESTREINT UE/EU RESTRICTED ’ information in a manner no less stringent than the standards and procedures described in the security rules of the Council of the European Union.
The Maltese and English markings for Malta can be used interchangeably.
The UK no longer uses the classification ‘ UK CONFIDENTIAL ’ in its national system. The UK handles and protects ‘ CONFIDENTIEL UE/EU CONFIDENTIAL ’ classified information in accordance with the protective security requirements for ‘ UK SECRET ’ .
EU | TRÈS SECRET UE/EU TOP SECRET | SECRET UE/EU SECRET | CONFIDENTIEL UE/EU CONFIDENTIAL | RESTREINT UE/EU RESTRICTED
Belgium | Très Secret (Loi 11.12.1998 ) Zeer Geheim (Wet 11.12.1998 ) | Secret (Loi 11.12.1998 ) Geheim (Wet 11.12.1998 ) | Confidentiel (Loi 11.12.1998 ) Vertrouwelijk (Wet 11.12.1998 ) | nota below
Bulgaria | Cтpoгo ceкретно | Ceкретно | Поверително | За служебно ползване
Czechia | Přísně tajné | Tajné | Důvěrné | Vyhrazené
Denmark | YDERST HEMMELIGT | HEMMELIGT | FORTROLIGT | TIL TJENESTEBRUG
Germany | STRENG GEHEIM | GEHEIM | VS - VERTRAULICH | VS - NUR FÜR DEN DIENSTGEBRAUCH
Estonia | Täiesti salajane | Salajane | Konfidentsiaalne | Piiratud
Ireland | Top Secret | Secret | Confidential | Restricted
Greece | Άκρως Απόρρητο Abr: ΑΑΠ | Απόρρητο Abr: (ΑΠ) | Εμπιστευτικό Αbr: (ΕΜ) | Περιορισμένης Χρήσης Abr: (ΠΧ)
Spain | SECRETO | RESERVADO | CONFIDENCIAL | DIFUSIÓN LIMITADA
France | Très Secret Défense | Secret Défense | Confidentiel Défense | nota below
Croatia | VRLO TAJNO | TAJNO | POVJERLJIVO | OGRANIČENO
Italy | Segretissimo | Segreto | Riservatissimo | Riservato
Cyprus | Άκρως Απόρρητο Αbr: (ΑΑΠ) | Απόρρητο Αbr: (ΑΠ) | Εμπιστευτικό Αbr: (ΕΜ) | Περιορισμένης Χρήσης Αbr: (ΠΧ)
Latvia | Sevišķi slepeni | Slepeni | Konfidenciāli | Dienesta vajadzībām
Lithuania | Visiškai slaptai | Slaptai | Konfidencialiai | Riboto naudojimo
Luxembourg | Très Secret Lux | Secret Lux | Confidentiel Lux | Restreint Lux
Hungary | Szigorúan titkos! | Titkos! | Bizalmas! | Korlátozott terjesztésű!
Malta | L-Ogħla Segretezza Top Secret | Sigriet Secret | Kunfidenzjali Confidential | Ristrett Restricted
Netherlands | Stg. ZEER GEHEIM | Stg. GEHEIM | Stg. CONFIDENTIEEL | Dep. VERTROUWELIJK
Austria | Streng Geheim | Geheim | Vertraulich | Eingeschränkt
Poland | Ściśle Tajne | Tajne | Poufne | Zastrzeżone
Portugal | Muito Secreto | Secreto | Confidencial | Reservado
Romania | Strict secret de importanță deosebită | Strict secret | Secret | Secret de serviciu
Slovenia | STROGO TAJNO | TAJNO | ZAUPNO | INTERNO
Slovakia | Prísne tajné | Tajné | Dôverné | Vyhradené
Finland | ERITTÄIN SALAINEN YTTERST HEMLIG | SALAINEN HEMLIG | LUOTTAMUKSELLINEN KONFIDENTIELL | KÄYTTÖ RAJOITETTU BEGRÄNSAD TILLGÅNG
Sweden | Kvaliciferat hemlig | Hemlig | Konfidentiell | Begränsat hemlig
United Kingdom | UK TOP SECRET | UK SECRET | nota below | UK OFFICIAL SENSITIVE
Appendix C

LIST OF NATIONAL SECURITY AUTHORITIES (NSAs)
BELGIUM Autorité nationale de Sécurité SPF Affaires étrangères, Commerce extérieur et Coopération au Développement 15, rue des Petits Carmes 1000 Bruxelles Tel. Secretariat: +32 25014542 Fax +32 25014596 Email: nvo-ans@diplobel.fed.be | ESTONIA National Security Authority Department Estonian Foreign Intelligence Service Rahumäe tee 4B 11316 Tallinn Tel. +372 6939211 Fax +372 6935001 Email: nsa@fis.gov.ee
BULGARIA State Commission on Information Security 4 Kozloduy Str. 1202 Sofia Tel. +359 29333600 Fax +359 29873750 Email: dksi@government.bg Website: www.dksi.bg | IRELAND National Security Authority Department of Foreign Affairs and Trade 76 - 78 Harcourt Street Dublin 2 D02 DX45 Ireland Tel. 1: +353 14082842 Tel. 2: +353 14082724 Email: nsa@dfa.ie
CZECHIA Národní bezpečnostní úřad (National Security Authority) Na Popelce 2/16 150 06 Praha 56 Tel. +420 257283335 Fax +420 257283110 Email: oms@nbu.cz Website: www.nbu.cz | GREECE Γενικό Επιτελείο Εθνικής Άμυνας (ΓΕΕΘΑ) Διεύθυνση Ασφαλείας και Αντιπληροφοριών ΣΤΓ 1020 -Χολαργός (Αθήνα) Ελλάδα Τηλ.: +30 2106572045 (ώρες γραφείου) +30 2106572009 (ώρες γραφείου) Φαξ: +30 2106536279 +30 2106577612 Hellenic National Defence General Staff (HNDGS) Counter Intelligence and Security Directorate (NSA) 227-231 HOLARGOS STG 1020 ATHENS Tel. +30 2106572045 +30 2106572009 Fax +30 2106536279 +30 2106577612
DENMARK Politiets Efterretningstjeneste (Danish Security Intelligence Service) Klausdalsbrovej 1 2860 Søborg Tel. +45 45159007 Fax +45 45150190 Forsvarets Efterretningstjeneste (Danish Defence Intelligence Service) Kastellet 30 2100 Copenhagen Ø Tel. +45 33325566 Fax +45 33931320 | SPAIN Autoridad Nacional de Seguridad Oficina Nacional de Seguridad Calle Argentona, 30 28023 Madrid Tel. +34 913725000 Fax +34 913725808 Email: nsa-sp@areatec.com
GERMANY Bundesministerium des Innern, für Bau und Heimat Section ÖS II 5 Alt-Moabit 140 D-10557 Berlin Tel. +49 30186810 Fax +49 30186811441 Email 1: OESII5@bmi.bund.de Email 2: PersGS@bmi.bund.de | FRANCE Secrétariat général de la défense et de la sécurité nationale Sous-direction Protection du secret (SGDSN/PSD) 51 Boulevard de la Tour-Maubourg 75700 Paris 07 SP Tel. +33 171758177 Fax +33 171758200
CROATIA Office of the National Security Council Croatian NSA Jurjevska 34 10000 Zagreb Croatia Tel. +385 14681222 Fax +385 14686049 Email: NSACroatia@uvns.hr Website: www.uvns.hr | LUXEMBOURG Autorité nationale de Sécurité Boîte postale 2379 1023 Luxembourg Tel. +352 24782210 central Tel. +352 24782253 direct Fax +352 24782243
ITALY Presidenza del Consiglio dei Ministri D.I.S. - U.C.Se Via di Santa Susanna, 15 00187 Roma Tel. +39 0661174266 Fax +39 064885273 | HUNGARY Nemzeti Biztonsági Felügyelet (National Security Authority of Hungary) 1024 Budapest, Szilágyi Erzsébet fasor 11/B Postal address: 1399 Budapest, Pf. 710/50 Tel. +36 13911862 Fax +36 13911889 Email: nbf@nbf.hu Website: www.nbf.hu
CYPRUS ΥΠΟΥΡΓΕΙΟ ΑΜΥΝΑΣ ΣΤΡΑΤΙΩΤΙΚΟ ΕΠΙΤΕΛΕΙΟ TΟΥ ΥΠΟΥΡΓΟΥ ΑΜΥΝΑΣ ΕΘΝΙΚΗ ΑΡΧΗ ΑΣΦΑΛΕΙΑΣ (ΕΑΑ) Υπουργείο Άμυνας Λεωφόρος Στροβόλου 172-174, 1432 Λευκωσία Ταχυδρομικός Κώδικας: 2048 Τηλεφωνα: +357 22807569, +357 22807643, +357 22807764 Τηλεομοιότυπ: +357 22302351 Ηλεκτρονικό Ταχυδρομείο: cynsa@mod.gov.cy Ministry of Defence Minister’s Military Staff National Security Authority (NSA) 172-174 Strovolou Avenue, 1432 Nicosia Postal code: 2048 Tel. +357 22807569, +357 22807643, +357 22807764 Fax +357 22302351 Email: cynsa@mod.gov.cy | MALTA Ministry for Home Affairs and National Security P.O. Box 146 MT-Valletta Tel. +356 21249844 Fax +356 25695321
LATVIA National Security Authority Constitution Protection Bureau of the Republic of Latvia P.O.Box 286 LV-1001 Riga Tel. +371 67025418 Email: ndi@sab.gov.lv | NETHERLANDS Ministerie van Binnenlandse Zaken en Koninkrijksrelaties Postbus 20010 2500 EA Den Haag Tel. +31 703204400 Fax +31 703200733 Ministerie van Defensie Beveiligingsautoriteit Postbus 20701 2500 ES Den Haag Tel. +31 703187060 Fax +31 703187522
LITHUANIA Lietuvos Respublikos paslapčių apsaugos koordinavimo komisija (The Commission for Secrets Protection Coordination of the Republic of Lithuania National Security Authority) Pilaitės ave. 19 LT-06264 Vilnius Tel. +370 570666128 Fax +370 70666700 Email: nsa@vsd.lt | AUSTRIA Informationssicherheitskommission Bundeskanzleramt Ballhausplatz 2 1010 Wien Tel. +43 153115202594 Fax +43 153109202594 Email: isk@bka.gv.at
POLAND Agencja Bezpieczeństwa Wewnętrznego — ABW (Internal Security Agency) 2A Rakowiecka St. 00-993 Warszawa Tel. +48 225857663 Fax +48 225858509 Email: nsa@abw.gov.pl Website: www.abw.gov.pl | SLOVAKIA Národný bezpečnostný úrad (National Security Authority) Budatínska 30 851 06 Bratislava Tel. +421 268691111 Fax +421 268691700 Email: podatelna@nbu.gov.sk Website: www.nbu.gov.sk
PORTUGAL Presidência do Conselho de Ministros Autoridade Nacional de Segurança Rua da Junqueira, 69 1300-342 Lisboa Tel. +351 213031710 Fax +351 213031711 | FINLAND National Security Authority Ministry for Foreign Affairs P.O. Box 453 FI-00023 Government Tel. +358 916055890 Email: NSA@formin.fi
ROMANIA Oficiul Registrului Național al Informațiilor Secrete de Stat – Romanian NSA – ORNISS National Registry Office for Classified Information Strada Mureș nr. 4 012275 Bucharest Tel. +40 212075114 Fax +40 212240714 Email: nsa.romania@nsa.ro Website: www.orniss.ro | SWEDEN Ministry for Foreign Affairs Swedish National Security Authority 103 39 Stockholm Tel. +46 84051000 Email: ud-nsa@gov.se
SLOVENIA Urad Vlade RS za varovanje tajnih podatkov Gregorčičeva 27 1000 Ljubljana Tel. +386 14781390 Fax +386 14781399 Email: gp.uvtp@gov.si | UNITED KINGDOM UK National Security Authority Cabinet Office Room 335 70 Whitehall London SW1A 2AS Tel. 1: +44 2072765645 Tel. 2: +44 2072765497 Email: uk-nsa@cabinetoffice.gov.uk
Appendix D

LIST OF ABBREVIATIONS
Acronym | Meaning
AQUA | Appropriately Qualified Authority
BPS | Boundary Protection Services
CAA | Crypto Approval Authority
CCTV | Closed Circuit Television
CDA | Crypto Distribution Authority
CFSP | Common Foreign and Security Policy
CIS | Communication and Information Systems handling EUCI
Coreper | Committee of Permanent Representatives
CSDP | Common Security and Defence Policy
DSA | Designated Security Authority
ECSD | European Commission Security Directorate
EUCI | EU Classified Information
EUSR | EU Special Representative
FSC | Facility Security Clearance
GSC | General Secretariat of the Council
IA | Information Assurance
IAA | Information Assurance Authority
IDS | Intrusion Detection System
IT | Information Technology
NSA | National Security Authority
PSC | Personnel Security Clearance
PSCC | Personnel Security Clearance Certificate
PSI | Programme/Project Security Instructions
SAA | Security Accreditation Authority
SAB | Security Accreditation Board
SAL | Security Aspects Letter
SecOPs | Security Operating Procedures
SCG | Security Classification Guide
SSRS | System-Specific Security Requirement Statement
TA | TEMPEST Authority
Substituted by Council Decision (EU) 2019/2247 of 19 December 2019 amending Decision 2013/488/EU on the security rules for protecting EU classified information.