CHAPTER 1
BASIC PRINCIPLES AND MINIMUM STANDARDS
Article 1
Definitions
Article 2
Subject matter and scope
Article 3
Definition of EUCI, security classifications and markings
Article 4
Classification management
Article 5
Protection of classified information
Article 6
Security risk management
Article 7
Implementation of this Decision
Article 8
Breaches of security and compromise of EUCI
CHAPTER 2
PERSONNEL SECURITY
Article 9
Definitions
Article 10
Basic Principles
Article 11
Security authorisation procedure
Article 12
Security authorisation briefings
Article 13
Temporary security authorisations
Article 14
Attendance at classified meetings organised by the Commission
Article 15
Potential Access to EUCI
CHAPTER 3
PHYSICAL SECURITY AIMED AT PROTECTING CLASSIFIED INFORMATION
Article 16
Basic principles
Article 17
Physical security requirements and measures
Article 18
Equipment for the physical protection of EUCI
Article 19
Physical protective measures for handling and storing EUCI
Article 20
Management of keys and combinations used for protecting EUCI
CHAPTER 4
MANAGEMENT OF EU CLASSIFIED INFORMATION
Article 21
Basic principles
Article 22
Classifications and markings
Article 23
Markings
Article 24
Abbreviated classification markings
Article 25
Creation of EUCI
Article 26
Downgrading and declassification of EUCI
Article 27
EUCI registry system in the Commission
Article 28
Registry control officer
Article 29
Registration of EUCI for security purposes
Article 30
Copying and translating EU classified documents
Article 31
Carriage of EUCI
Article 32
Destruction of EUCI
Article 33
Destruction of EUCI in emergencies
CHAPTER 5
PROTECTION OF EU CLASSIFIED INFORMATION IN COMMUNICATION AND INFORMATION SYSTEMS (CIS)
Article 34
Basic principles of Information Assurance
Article 35
Definitions
Article 36
CIS handling EUCI
Article 37
Accreditation of CIS handling EUCI
Article 38
Emergency circumstances
CHAPTER 6
INDUSTRIAL SECURITY
Article 39
Basic principles
Article 40
Definitions
Article 41
Procedure for classified contracts or grant agreements
Article 42
Security elements in a classified contract or grant agreement
Article 43
Access to EUCI for contractors' and beneficiaries' staff
Article 44
Facility security clearance
Article 45
Provisions for classified contracts and grant agreements
Article 46
Specific provisions for classified contracts
Article 47
Visits in connection with classified contracts
Article 48
Transmission and carriage of EUCI in connection with classified contracts or classified grant agreements
Article 49
Transfer of EUCI to contractors or grant beneficiaries located in third states
Article 50
Handling of information classified RESTREINT UE/EU RESTRICTED in the context of classified contracts or classified grant agreements
CHAPTER 7
EXCHANGE OF CLASSIFIED INFORMATION WITH OTHER UNION INSTITUTIONS, AGENCIES, BODIES AND OFFICES, WITH MEMBER STATES, AND WITH THIRD STATES AND INTERNATIONAL ORGANISATIONS
Article 51
Basic principles
Article 52
Exchange of EUCI with other Union institutions, agencies, bodies and offices
Article 53
Exchange of EUCI with Member States
Article 54
Exchange of EUCI with third States and international organisations
Article 55
Security of information agreements
Article 56
Administrative arrangements
Article 57
Exceptional ad hoc release of EUCI
CHAPTER 8
FINAL PROVISIONS
Article 58
Replacement of previous decision
Article 59
Classified information created before the entry into force of this Decision
Article 60
Implementing rules and security notices
Article 61
Entry into force
ANNEX I
EQUIVALENCE OF SECURITY CLASSIFICATIONS
ANNEX II
LIST OF ABBREVIATIONS
ANNEX III
LIST OF NATIONAL SECURITY AUTHORITIES
BELGIUM
BULGARIA
CZECH REPUBLIC
DENMARK
GERMANY
ESTONIA
GREECE
SPAIN
FRANCE
CROATIA
IRELAND
ITALY
CYPRUS
LATVIA
LITHUANIA
LUXEMBOURG
HUNGARY
MALTA
NETHERLANDS
AUSTRIA
POLAND
PORTUGAL
ROMANIA
SLOVENIA
SLOVAKIA
FINLAND
SWEDEN
UNITED KINGDOM
Commission Decision (EU, Euratom) 2015/444
of 13 March 2015
on the security rules for protecting EU classified information
THE EUROPEAN COMMISSION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249 thereof,
Having regard to the Treaty establishing the European Atomic Energy Community, and in particular Article 106 thereof,
Having regard to the Protocol No 7 on the Privileges and Immunities of the European Union annexed to the Treaties, and in particular Article 18 thereof,
Whereas:
(1)
The Commission's security provisions regarding the protection of European Union Classified Information (EUCI) need to be reviewed and updated, taking into account institutional, organisational, operational and technological developments.
(2)
The European Commission has entered into instruments on security matters for its principal sites with the governments of Belgium, Luxembourg and Italy
(3)
The Commission, the Council and the European External Action Service are committed to applying equivalent security standards for protecting EUCI.
(4)
It is important that, where appropriate, the European Parliament and other Union institutions, agencies, bodies or offices, are associated with the principles, standards and rules for protecting classified information which are necessary in order to protect the interests of the Union and its Member States.
(5)
Risk to EUCI shall be managed as a process. This process shall be aimed at determining known security risks, defining security measures to reduce such risks to an acceptable level in accordance with the basic principles and minimum standards set out in this Decision and at applying these measures in line with the concept of defence in depth. The effectiveness of such measures shall be continuously evaluated.
(6)
Within the Commission, physical security aimed at protecting classified information is the application of physical and technical protective measures intended to prevent unauthorised access to EUCI.
(7)
The management of EUCI is the application of administrative measures for controlling EUCI throughout its life-cycle to supplement the measures provided for in Chapters 2, 3 and 5 of this Decision and thereby help deter, detect and recover from deliberate or accidental compromise or loss of such information. Such measures relate in particular to the creation, storage, registration, copying, translation, downgrading, declassification, carriage and destruction of EUCI and they supplement the general rules on document management of the Commission (Decisions 2002/47/EC , ECSC, Euratom and 2004/563/EC, Euratom ).
(8)

The provision of this Decision shall be without prejudice to:
1. Regulation (Euratom) No 3 ;
2. Regulation (EC) No 1049/2001 of the European Parliament and of the Council ;
3. Regulation (EC) No 45/2001 of the European Parliament and of the Council ;
4. Council Regulation (EEC, Euratom) No 354/83 ,
HAS ADOPTED THIS DECISION:
Cf. the ‘Arrangement entre le Gouvernement belge et le Parlement européen, le Conseil, la Commission, le Comité économique et social européen, le Comité des régions, la Banque européenne d'investissement en matière de sécurité’ of 31 December 2004, the ‘Accord de sécurité signé entre la Commission et le Gouvernement luxembourgeois’ of 20 January 2007, and the ‘Accordo tra il Governo italiano e la Commissione europea dell'energia atomica (Euratom) per l'istituzione di un Centro comune di ricerche nucleari di competenza generale’ of 22 July 1959.
Commission Decision 2002/47/EC, ECSC, Euratom of 23 January 2002 amending its rules of procedure (OJ L 21, 24.1.2002, p. 23).
Commission Decision 2004/563/EC, Euratom of 7 July 2004 amending its Rules of Procedure (OJ L 251, 27.7.2004, p. 9).
Regulation (Euratom) No 3 of 31 July 1958 implementing Article 24 of the Treaty establishing the European Atomic Energy Community (OJ 17, 6.10.1958, p. 406/58).
Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ L 145, 31.5.2001, p. 43).
Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).
Council Regulation (EEC, Euratom) No 354/83 of 1 February 1983 concerning the opening to the public of the historical archives of the European Economic Community and the European Atomic Energy Community (OJ L 43, 15.2.1983, p. 1).