<Legislation xmlns="http://www.legislation.gov.uk/namespaces/legislation" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" DocumentURI="http://www.legislation.gov.uk/eudn/2018/559" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559" NumberOfProvisions="11" xsi:schemaLocation="http://www.legislation.gov.uk/namespaces/legislation http://www.legislation.gov.uk/schema/legislation.xsd" SchemaVersion="2.0" RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I."><ukm:Metadata xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dct="http://purl.org/dc/terms/" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:ukm="http://www.legislation.gov.uk/namespaces/metadata">
					<dc:identifier>http://www.legislation.gov.uk/eudn/2018/559</dc:identifier><dc:title>Commission Decision (EU, Euratom) 2018/559 of 6 April 2018 laying down implementing rules for Article 6 of Decision (EU, Euratom) 2017/46 on the security of communication and information systems in the European Commission</dc:title><dct:alternative>Commission Decision (EU, Euratom) 2018/559</dct:alternative><dc:description>Commission Decision (EU, Euratom) 2018/559 of 6 April 2018 laying down implementing rules for Article 6 of Decision (EU, Euratom) 2017/46 on the security of communication and information systems in the European Commission</dc:description><dc:modified>2020-12-10</dc:modified><dc:publisher>King's Printer of Acts of Parliament</dc:publisher><dc:source>https://webarchive.nationalarchives.gov.uk/eu-exit/https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32018D0559</dc:source><dc:type>text</dc:type><dc:format>text/xml</dc:format><dc:language>en</dc:language><dct:valid>2018-04-06</dct:valid>
					
					<atom:link rel="self" href="http://www.legislation.gov.uk/eudn/2018/559/data.xml" type="application/xml"/><atom:link rel="http://www.legislation.gov.uk/def/navigation/resources" href="http://www.legislation.gov.uk/eudn/2018/559/resources" title="More Resources"/>
					
					
					
					<atom:link rel="http://www.legislation.gov.uk/def/navigation/act" href="http://www.legislation.gov.uk/eudn/2018/559" title="whole act"/><atom:link rel="http://www.legislation.gov.uk/def/navigation/introduction" href="http://www.legislation.gov.uk/eudn/2018/559/introduction" title="introduction"/><atom:link rel="http://www.legislation.gov.uk/def/navigation/signature" href="http://www.legislation.gov.uk/eudn/2018/559/signature" title="signature"/>
					<atom:link rel="http://www.legislation.gov.uk/def/navigation/body" href="http://www.legislation.gov.uk/eudn/2018/559/body" title="body"/>
					<atom:link rel="http://www.legislation.gov.uk/def/navigation/annexes" href="http://www.legislation.gov.uk/eudn/2018/559/annexes" title="annexes"/>
					
					<atom:link rel="http://www.legislation.gov.uk/def/date/euexitday" href="http://www.legislation.gov.uk/eudn/2018/559/2020-01-31" title="2020-01-31"/><atom:link rel="http://www.legislation.gov.uk/def/date/euexitTransitionEnd" href="http://www.legislation.gov.uk/eudn/2018/559/2020-12-31" title="2020-12-31"/>					
					
					
					
					<atom:link rel="alternate" type="application/rdf+xml" href="http://www.legislation.gov.uk/eudn/2018/559/data.rdf" title="RDF/XML"/><atom:link rel="alternate" type="application/akn+xml" href="http://www.legislation.gov.uk/eudn/2018/559/data.akn" title="AKN"/><atom:link rel="alternate" type="application/xhtml+xml" href="http://www.legislation.gov.uk/eudn/2018/559/data.xht" title="HTML snippet"/><atom:link rel="alternate" type="text/html" href="http://www.legislation.gov.uk/eudn/2018/559/data.htm" title="Website (XHTML) Default View"/><atom:link rel="alternate" type="text/csv" href="http://www.legislation.gov.uk/eudn/2018/559/data.csv" title="CSV"/><atom:link rel="alternate" type="application/pdf" href="http://www.legislation.gov.uk/eudn/2018/559/data.pdf" title="PDF"/>
					<atom:link rel="alternate" type="application/akn+xhtml" href="http://www.legislation.gov.uk/eudn/2018/559/data.html" title="HTML5 snippet"/>

					<atom:link rel="alternate" href="http://www.legislation.gov.uk/eudn/2018/559/pdfs/eudn_20180559_adopted_en.pdf" type="application/pdf" title="Original PDF"/>
					<atom:link rel="http://purl.org/dc/terms/tableOfContents" hreflang="en" href="http://www.legislation.gov.uk/eudn/2018/559/contents" title="Table of Contents"/>
					
					<atom:link rel="http://purl.org/dc/terms/hasVersion" href="http://www.legislation.gov.uk/eudn/2018/559/adopted" title="adopted"/><atom:link rel="http://purl.org/dc/terms/hasVersion" href="http://www.legislation.gov.uk/eudn/2018/559/2018-04-06" title="2018-04-06"/>
					
					
					<ukm:EUMetadata><ukm:DocumentClassification>
            <ukm:DocumentCategory Value="euretained"/>
            <ukm:DocumentMainType Value="EuropeanUnionDecision"/>
            <ukm:DocumentStatus Value="revised"/>
         </ukm:DocumentClassification><ukm:Year Value="2018"/><ukm:Number Value="559"/><ukm:EURLexIdentifiers>
            <ukm:Cellar Value="7ec299cb-3d15-11e8-b5fe-01aa75ed71a1"/>
            <ukm:OfficialJournal Value="JOL_2018_093_R_0003"/>
            <ukm:ELI Value="dec:2018:559:oj"/>
            <ukm:CELEX Value="32018D0559"/>
         </ukm:EURLexIdentifiers><ukm:EnactmentDate Date="2018-04-06"/><ukm:EURLexModified Date="2018-07-06T14:35:16Z"/><ukm:EURLexExtracted Date="2018-07-06T18:51:03Z"/><ukm:XMLGenerated Date="2020-12-10T20:17:15Z"/><ukm:XMLImported Date="2020-12-10T20:27:06Z"/><ukm:Treaty Title="Treaty establishing the European Atomic Energy Community (consolidated version 2012) Treaty on the Functioning of the European Union (consolidated version 2012)" Code="EURATOM_2012 TFEU_2012"/><ukm:CreatedBy Label="Directorate-General for Human Resources and Security" URI="http://publications.europa.eu/resource/authority/corporate-body/HR"/><ukm:CreatedBy Label="European Commission" URI="http://publications.europa.eu/resource/authority/corporate-body/COM"/><ukm:Subject Scheme="SubjectMatter" Label="Security system" URI="http://publications.europa.eu/resource/authority/fd_070/SECR"/><ukm:Subject Scheme="EuroVoc" Label="communications systems" URI="http://eurovoc.europa.eu/4361"/><ukm:Subject Scheme="SubjectMatter" Label="Technology" URI="http://publications.europa.eu/resource/authority/fd_070/TECN"/><ukm:Subject Scheme="EuroVoc" Label="European Commission" URI="http://eurovoc.europa.eu/4038"/><ukm:Subject Scheme="DirectoryCode" Label="Information technology, telecommunications and data-processing" URI="http://publications.europa.eu/resource/authority/fd_555/132060"/><ukm:Subject Scheme="DirectoryCode" Label="Industrial policy: sectoral operations" URI="http://publications.europa.eu/resource/authority/fd_555/1320"/><ukm:Subject Scheme="DirectoryCode" Label="Industrial policy and internal market" URI="http://publications.europa.eu/resource/authority/fd_555/13"/><ukm:Subject Scheme="EuroVoc" Label="protection of communications" URI="http://eurovoc.europa.eu/2832"/><ukm:Subject Scheme="EuroVoc" Label="information system" URI="http://eurovoc.europa.eu/4359"/><ukm:Subject Scheme="EuroVoc" Label="safety standard" URI="http://eurovoc.europa.eu/5234"/><ukm:Subject Scheme="EuroVoc" Label="data protection" URI="http://eurovoc.europa.eu/5181"/><ukm:Subject Scheme="SubjectMatter" Label="Telecommunications" URI="http://publications.europa.eu/resource/authority/fd_070/TELE"/><ukm:Subject Scheme="EuroVoc" Label="information technology" URI="http://eurovoc.europa.eu/5188"/><ukm:Subject Scheme="EuroVoc" Label="computer systems" URI="http://eurovoc.europa.eu/1426"/><ukm:EURLexMetadata>
            <WORK xmlns="">
               <URI>
                  <VALUE>http://publications.europa.eu/resource/cellar/7ec299cb-3d15-11e8-b5fe-01aa75ed71a1</VALUE>
                  <IDENTIFIER>7ec299cb-3d15-11e8-b5fe-01aa75ed71a1</IDENTIFIER>
                  <TYPE>cellar</TYPE>
               </URI>
               <SAMEAS>
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/oj/JOL_2018_093_R_0003</VALUE>
                     <IDENTIFIER>JOL_2018_093_R_0003</IDENTIFIER>
                     <TYPE>oj</TYPE>
                  </URI>
               </SAMEAS>
               <SAMEAS>
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/eli/dec/2018/559/oj</VALUE>
                     <IDENTIFIER>dec:2018:559:oj</IDENTIFIER>
                     <TYPE>eli</TYPE>
                  </URI>
               </SAMEAS>
               <SAMEAS>
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/celex/32018D0559</VALUE>
                     <IDENTIFIER>32018D0559</IDENTIFIER>
                     <TYPE>celex</TYPE>
                  </URI>
               </SAMEAS>
               <IDENTIFIER type="data">
                  <VALUE>http://data.europa.eu/eli/dec/2018/559/oj</VALUE>
               </IDENTIFIER>
               <IS_ABOUT type="concept">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/authority/fd_555/132060</VALUE>
                     <IDENTIFIER>132060</IDENTIFIER>
                     <TYPE>fd_555</TYPE>
                  </URI>
                  <OP-CODE>132060</OP-CODE>
                  <IDENTIFIER>132060</IDENTIFIER>
                  <PREFLABEL>Information technology, telecommunications and data-processing</PREFLABEL>
               </IS_ABOUT>
               <IS_ABOUT type="concept">
                  <URI>
                     <VALUE>http://eurovoc.europa.eu/1426</VALUE>
                     <IDENTIFIER>1426</IDENTIFIER>
                     <TYPE>EUROVOC</TYPE>
                  </URI>
                  <IDENTIFIER>1426</IDENTIFIER>
                  <PREFLABEL>computer systems</PREFLABEL>
                  <ALTLABEL>informatics</ALTLABEL>
               </IS_ABOUT>
               <RESOURCE_LEGAL_IS_ABOUT_SUBJECT-MATTER type="concept_level">
                  <RESOURCE_LEGAL_IS_ABOUT_SUBJECT-MATTER_1 type="concept">
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/authority/fd_070/SECR</VALUE>
                        <IDENTIFIER>SECR</IDENTIFIER>
                        <TYPE>fd_070</TYPE>
                     </URI>
                     <OP-CODE>SECR</OP-CODE>
                     <IDENTIFIER>SECR</IDENTIFIER>
                     <PREFLABEL>Security system</PREFLABEL>
                  </RESOURCE_LEGAL_IS_ABOUT_SUBJECT-MATTER_1>
               </RESOURCE_LEGAL_IS_ABOUT_SUBJECT-MATTER>
               <IS_ABOUT type="concept">
                  <URI>
                     <VALUE>http://eurovoc.europa.eu/5188</VALUE>
                     <IDENTIFIER>5188</IDENTIFIER>
                     <TYPE>EUROVOC</TYPE>
                  </URI>
                  <IDENTIFIER>5188</IDENTIFIER>
                  <PREFLABEL>information technology</PREFLABEL>
                  <ALTLABEL>communications technology</ALTLABEL>
               </IS_ABOUT>
               <ID_CELEX type="data">
                  <VALUE>32018D0559</VALUE>
               </ID_CELEX>
               <RESOURCE_LEGAL_NUMBER_NATURAL type="data">
                  <VALUE>559</VALUE>
               </RESOURCE_LEGAL_NUMBER_NATURAL>
               <RESOURCE_LEGAL_DATE_ENTRY-INTO-FORCE type="date">
                  <VALUE>2018-05-01</VALUE>
                  <YEAR>2018</YEAR>
                  <MONTH>05</MONTH>
                  <DAY>01</DAY>
                  <ANNOTATION>
                     <COMMENT_ON_DATE>{DATPUB|http://publications.europa.eu/resource/authority/fd_335/DATPUB} +20 {V|http://publications.europa.eu/resource/authority/fd_335/V} {ART|http://publications.europa.eu/resource/authority/fd_335/ART} 11</COMMENT_ON_DATE>
                     <TYPE_OF_DATE>{EV|http://publications.europa.eu/resource/authority/fd_335/EV}</TYPE_OF_DATE>
                  </ANNOTATION>
               </RESOURCE_LEGAL_DATE_ENTRY-INTO-FORCE>
               <WORK_IS_ABOUT_CONCEPT_EUROVOC type="concept_facet">
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_CONCEPT type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/4361</VALUE>
                        <IDENTIFIER>4361</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>4361</IDENTIFIER>
                     <PREFLABEL>communications systems</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_CONCEPT>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_TT type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/4361</VALUE>
                        <IDENTIFIER>4361</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>4361</IDENTIFIER>
                     <PREFLABEL>communications systems</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_TT>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_DOM type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/100150</VALUE>
                        <IDENTIFIER>100150</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>32</IDENTIFIER>
                     <PREFLABEL>32 EDUCATION AND COMMUNICATIONS</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_DOM>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_MTH type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/100221</VALUE>
                        <IDENTIFIER>100221</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>3226</IDENTIFIER>
                     <PREFLABEL>3226 communications</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_MTH>
               </WORK_IS_ABOUT_CONCEPT_EUROVOC>
               <RESOURCE_LEGAL_REPERTOIRE type="data">
                  <VALUE>REP</VALUE>
               </RESOURCE_LEGAL_REPERTOIRE>
               <IDENTIFIER type="data">
                  <VALUE>immc:C(2018)1726/965078</VALUE>
               </IDENTIFIER>
               <RESOURCE_LEGAL_IN-FORCE type="data">
                  <VALUE>true</VALUE>
               </RESOURCE_LEGAL_IN-FORCE>
               <RESOURCE_LEGAL_IS_ABOUT_SUBJECT-MATTER type="concept_level">
                  <RESOURCE_LEGAL_IS_ABOUT_SUBJECT-MATTER_1 type="concept">
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/authority/fd_070/TECN</VALUE>
                        <IDENTIFIER>TECN</IDENTIFIER>
                        <TYPE>fd_070</TYPE>
                     </URI>
                     <OP-CODE>TECN</OP-CODE>
                     <IDENTIFIER>TECN</IDENTIFIER>
                     <PREFLABEL>Technology</PREFLABEL>
                  </RESOURCE_LEGAL_IS_ABOUT_SUBJECT-MATTER_1>
               </RESOURCE_LEGAL_IS_ABOUT_SUBJECT-MATTER>
               <WORK_IS_ABOUT_CONCEPT_EUROVOC type="concept_facet">
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_CONCEPT type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/4038</VALUE>
                        <IDENTIFIER>4038</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>4038</IDENTIFIER>
                     <PREFLABEL>European Commission</PREFLABEL>
                     <ALTLABEL>EC Commission</ALTLABEL>
                     <ALTLABEL>Commission of the European Communities</ALTLABEL>
                     <ALTLABEL>EU Commission</ALTLABEL>
                     <ALTLABEL>CEC</ALTLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_CONCEPT>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_TT type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/1451</VALUE>
                        <IDENTIFIER>1451</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>1451</IDENTIFIER>
                     <PREFLABEL>EU institution</PREFLABEL>
                     <ALTLABEL>European Union institution</ALTLABEL>
                     <ALTLABEL>Community institution</ALTLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_TT>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_DOM type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/100144</VALUE>
                        <IDENTIFIER>100144</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>10</IDENTIFIER>
                     <PREFLABEL>10 EUROPEAN UNION</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_DOM>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_MTH type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/100174</VALUE>
                        <IDENTIFIER>100174</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>1006</IDENTIFIER>
                     <PREFLABEL>1006 EU institutions and European civil service</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_MTH>
               </WORK_IS_ABOUT_CONCEPT_EUROVOC>
               <DATE type="date">
                  <VALUE>9999-12-31</VALUE>
                  <YEAR>9999</YEAR>
                  <MONTH>12</MONTH>
                  <DAY>31</DAY>
               </DATE>
               <LASTMODIFICATIONDATE type="date">
                  <VALUE>2018-07-06T16:35:16.555+02:00</VALUE>
                  <YEAR>2018</YEAR>
                  <MONTH>07</MONTH>
                  <DAY>06</DAY>
               </LASTMODIFICATIONDATE>
               <RESOURCE_LEGAL_YEAR type="data">
                  <VALUE>2018</VALUE>
               </RESOURCE_LEGAL_YEAR>
               <RESOURCE_LEGAL_IS_ABOUT_CONCEPT_DIRECTORY-CODE type="concept_level">
                  <RESOURCE_LEGAL_IS_ABOUT_CONCEPT_DIRECTORY-CODE_3 type="concept">
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/authority/fd_555/132060</VALUE>
                        <IDENTIFIER>132060</IDENTIFIER>
                        <TYPE>fd_555</TYPE>
                     </URI>
                     <OP-CODE>132060</OP-CODE>
                     <IDENTIFIER>132060</IDENTIFIER>
                     <PREFLABEL>Information technology, telecommunications and data-processing</PREFLABEL>
                  </RESOURCE_LEGAL_IS_ABOUT_CONCEPT_DIRECTORY-CODE_3>
                  <RESOURCE_LEGAL_IS_ABOUT_CONCEPT_DIRECTORY-CODE_2 type="concept">
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/authority/fd_555/1320</VALUE>
                        <IDENTIFIER>1320</IDENTIFIER>
                        <TYPE>fd_555</TYPE>
                     </URI>
                     <OP-CODE>1320</OP-CODE>
                     <IDENTIFIER>1320</IDENTIFIER>
                     <PREFLABEL>Industrial policy: sectoral operations</PREFLABEL>
                  </RESOURCE_LEGAL_IS_ABOUT_CONCEPT_DIRECTORY-CODE_2>
                  <RESOURCE_LEGAL_IS_ABOUT_CONCEPT_DIRECTORY-CODE_1 type="concept">
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/authority/fd_555/13</VALUE>
                        <IDENTIFIER>13</IDENTIFIER>
                        <TYPE>fd_555</TYPE>
                     </URI>
                     <OP-CODE>13</OP-CODE>
                     <IDENTIFIER>13</IDENTIFIER>
                     <PREFLABEL>Industrial policy and internal market</PREFLABEL>
                  </RESOURCE_LEGAL_IS_ABOUT_CONCEPT_DIRECTORY-CODE_1>
               </RESOURCE_LEGAL_IS_ABOUT_CONCEPT_DIRECTORY-CODE>
               <ID_SECTOR type="data">
                  <VALUE>3</VALUE>
               </ID_SECTOR>
               <DATE type="date">
                  <VALUE>2018-04-06</VALUE>
                  <YEAR>2018</YEAR>
                  <MONTH>04</MONTH>
                  <DAY>06</DAY>
               </DATE>
               <YEAR type="data">
                  <VALUE>2018</VALUE>
               </YEAR>
               <DATE_CREATION_LEGACY type="date">
                  <VALUE>2018-04-11</VALUE>
                  <YEAR>2018</YEAR>
                  <MONTH>04</MONTH>
                  <DAY>11</DAY>
               </DATE_CREATION_LEGACY>
               <WORK_DATE_DOCUMENT type="date">
                  <VALUE>2018-04-06</VALUE>
                  <YEAR>2018</YEAR>
                  <MONTH>04</MONTH>
                  <DAY>06</DAY>
                  <ANNOTATION>
                     <COMMENT_ON_DATE>{DATADOPT|http://publications.europa.eu/resource/authority/fd_365/DATADOPT}</COMMENT_ON_DATE>
                  </ANNOTATION>
               </WORK_DATE_DOCUMENT>
               <BASED_ON type="concept">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/authority/treaty/TFEU_2012</VALUE>
                     <IDENTIFIER>TFEU_2012</IDENTIFIER>
                     <TYPE>treaty</TYPE>
                  </URI>
                  <OP-CODE>TFEU_2012</OP-CODE>
                  <IDENTIFIER>TFEU_2012</IDENTIFIER>
                  <PREFLABEL>Treaty on the Functioning of the European Union (consolidated version 2012)</PREFLABEL>
                  <ALTLABEL>TFEU (2012)</ALTLABEL>
                  <ALTLABEL>Consolidated version of the Treaty on the Functioning of the European Union (2012)</ALTLABEL>
               </BASED_ON>
               <BASED_ON type="concept">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/authority/treaty/EURATOM_2012</VALUE>
                     <IDENTIFIER>EURATOM_2012</IDENTIFIER>
                     <TYPE>treaty</TYPE>
                  </URI>
                  <OP-CODE>EURATOM_2012</OP-CODE>
                  <IDENTIFIER>EURATOM_2012</IDENTIFIER>
                  <PREFLABEL>Treaty establishing the European Atomic Energy Community (consolidated version 2012)</PREFLABEL>
                  <ALTLABEL>Euratom Treaty (2012)</ALTLABEL>
                  <ALTLABEL>EAEC Treaty (2012)</ALTLABEL>
                  <ALTLABEL>Consolidated version of the Treaty establishing the European Atomic Energy Community (2012)</ALTLABEL>
               </BASED_ON>
               <WORK_ID_DOCUMENT type="data">
                  <VALUE>oj:JOL_2018_093_R_0003</VALUE>
               </WORK_ID_DOCUMENT>
               <RESOURCE_LEGAL_BASED_ON_RESOURCE_LEGAL type="link">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/cellar/f9fd8acf-d7c9-11e6-ad7c-01aa75ed71a1</VALUE>
                     <IDENTIFIER>f9fd8acf-d7c9-11e6-ad7c-01aa75ed71a1</IDENTIFIER>
                     <TYPE>cellar</TYPE>
                  </URI>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/oj/JOL_2017_006_R_0005</VALUE>
                        <IDENTIFIER>JOL_2017_006_R_0005</IDENTIFIER>
                        <TYPE>oj</TYPE>
                     </URI>
                  </SAMEAS>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/celex/32017D0046</VALUE>
                        <IDENTIFIER>32017D0046</IDENTIFIER>
                        <TYPE>celex</TYPE>
                     </URI>
                  </SAMEAS>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/eli/dec/2017/46/oj</VALUE>
                        <IDENTIFIER>dec:2017:46:oj</IDENTIFIER>
                        <TYPE>eli</TYPE>
                     </URI>
                  </SAMEAS>
                  <ANNOTATION>
                     <COMMENT_ON_LEGAL_BASIS>A06</COMMENT_ON_LEGAL_BASIS>
                     <ARTICLE>6</ARTICLE>
                  </ANNOTATION>
               </RESOURCE_LEGAL_BASED_ON_RESOURCE_LEGAL>
               <RESOURCE_LEGAL_BASED_ON_RESOURCE_LEGAL type="link">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/cellar/d1b2a21b-4a59-4b7e-a084-471afcf6bdbc</VALUE>
                     <IDENTIFIER>d1b2a21b-4a59-4b7e-a084-471afcf6bdbc</IDENTIFIER>
                     <TYPE>cellar</TYPE>
                  </URI>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/eli/treaty/tfeu_2016/art_249/oj</VALUE>
                        <IDENTIFIER>treaty:tfeu_2016:art_249:oj</IDENTIFIER>
                        <TYPE>eli</TYPE>
                     </URI>
                  </SAMEAS>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/celex/12016E249</VALUE>
                        <IDENTIFIER>12016E249</IDENTIFIER>
                        <TYPE>celex</TYPE>
                     </URI>
                  </SAMEAS>
               </RESOURCE_LEGAL_BASED_ON_RESOURCE_LEGAL>
               <IS_ABOUT type="concept">
                  <URI>
                     <VALUE>http://eurovoc.europa.eu/5234</VALUE>
                     <IDENTIFIER>5234</IDENTIFIER>
                     <TYPE>EUROVOC</TYPE>
                  </URI>
                  <IDENTIFIER>5234</IDENTIFIER>
                  <PREFLABEL>safety standard</PREFLABEL>
               </IS_ABOUT>
               <IS_ABOUT type="concept">
                  <URI>
                     <VALUE>http://eurovoc.europa.eu/4359</VALUE>
                     <IDENTIFIER>4359</IDENTIFIER>
                     <TYPE>EUROVOC</TYPE>
                  </URI>
                  <IDENTIFIER>4359</IDENTIFIER>
                  <PREFLABEL>information system</PREFLABEL>
                  <ALTLABEL>on-line system</ALTLABEL>
                  <ALTLABEL>automatic information system</ALTLABEL>
               </IS_ABOUT>
               <IS_ABOUT type="concept">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/authority/fd_070/TELE</VALUE>
                     <IDENTIFIER>TELE</IDENTIFIER>
                     <TYPE>fd_070</TYPE>
                  </URI>
                  <OP-CODE>TELE</OP-CODE>
                  <IDENTIFIER>TELE</IDENTIFIER>
                  <PREFLABEL>Telecommunications</PREFLABEL>
               </IS_ABOUT>
               <WORK_IS_ABOUT_CONCEPT_EUROVOC type="concept_facet">
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_CONCEPT type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/2832</VALUE>
                        <IDENTIFIER>2832</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>2832</IDENTIFIER>
                     <PREFLABEL>protection of communications</PREFLABEL>
                     <ALTLABEL>data espionage</ALTLABEL>
                     <ALTLABEL>telephone tapping</ALTLABEL>
                     <ALTLABEL>wiretapping</ALTLABEL>
                     <ALTLABEL>eavesdropping</ALTLABEL>
                     <ALTLABEL>interception of communications</ALTLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_CONCEPT>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_TT type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/538</VALUE>
                        <IDENTIFIER>538</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>538</IDENTIFIER>
                     <PREFLABEL>rights of the individual</PREFLABEL>
                     <ALTLABEL>fundamental rights</ALTLABEL>
                     <ALTLABEL>citizens' rights</ALTLABEL>
                     <ALTLABEL>enjoyment of political rights</ALTLABEL>
                     <ALTLABEL>fundamental freedom</ALTLABEL>
                     <ALTLABEL>personal freedom</ALTLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_TT>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_DOM type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/100145</VALUE>
                        <IDENTIFIER>100145</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>12</IDENTIFIER>
                     <PREFLABEL>12 LAW</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_DOM>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_MTH type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/100184</VALUE>
                        <IDENTIFIER>100184</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>1236</IDENTIFIER>
                     <PREFLABEL>1236 rights and freedoms</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_MTH>
               </WORK_IS_ABOUT_CONCEPT_EUROVOC>
               <CREATED_BY type="concept">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/authority/corporate-body/COM</VALUE>
                     <IDENTIFIER>COM</IDENTIFIER>
                     <TYPE>corporate-body</TYPE>
                  </URI>
                  <OP-CODE>COM</OP-CODE>
                  <IDENTIFIER>COM</IDENTIFIER>
                  <PREFLABEL>European Commission</PREFLABEL>
                  <ALTLABEL>Commission of the European Communities</ALTLABEL>
                  <ALTLABEL>European Commission</ALTLABEL>
                  <ALTLABEL>Commission</ALTLABEL>
               </CREATED_BY>
               <IS_ABOUT type="concept">
                  <URI>
                     <VALUE>http://eurovoc.europa.eu/5181</VALUE>
                     <IDENTIFIER>5181</IDENTIFIER>
                     <TYPE>EUROVOC</TYPE>
                  </URI>
                  <IDENTIFIER>5181</IDENTIFIER>
                  <PREFLABEL>data protection</PREFLABEL>
                  <ALTLABEL>data security</ALTLABEL>
               </IS_ABOUT>
               <WORK_CREATED_BY_AGENT type="concept">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/authority/corporate-body/HR</VALUE>
                     <IDENTIFIER>HR</IDENTIFIER>
                     <TYPE>corporate-body</TYPE>
                  </URI>
                  <OP-CODE>HR</OP-CODE>
                  <IDENTIFIER>HR</IDENTIFIER>
                  <PREFLABEL>Directorate-General for Human Resources and Security</PREFLABEL>
                  <ALTLABEL>Personnel and Administration DG</ALTLABEL>
                  <ALTLABEL>DG Human Resources and Security</ALTLABEL>
                  <ALTLABEL>DG IX – Personnel and Administration</ALTLABEL>
                  <ALTLABEL>Directorate-General for Personnel and Administration</ALTLABEL>
               </WORK_CREATED_BY_AGENT>
               <RESOURCE_LEGAL_COMMENT_INTERNAL type="data">
                  <VALUE>MAN2</VALUE>
               </RESOURCE_LEGAL_COMMENT_INTERNAL>
               <RESOURCE_LEGAL_DATE_END-OF-VALIDITY type="date">
                  <VALUE>9999-12-31</VALUE>
                  <YEAR>9999</YEAR>
                  <MONTH>12</MONTH>
                  <DAY>31</DAY>
               </RESOURCE_LEGAL_DATE_END-OF-VALIDITY>
               <RESOURCE_LEGAL_ELI type="data">
                  <VALUE>http://data.europa.eu/eli/dec/2018/559/oj</VALUE>
               </RESOURCE_LEGAL_ELI>
               <WORK_ID_DOCUMENT type="data">
                  <VALUE>celex:32018D0559</VALUE>
               </WORK_ID_DOCUMENT>
               <RESOURCE_LEGAL_ID_CELEX type="data">
                  <VALUE>32018D0559</VALUE>
               </RESOURCE_LEGAL_ID_CELEX>
               <RESOURCE_LEGAL_PUBLISHED_IN_OFFICIAL-JOURNAL type="link">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/cellar/699121bb-3d10-11e8-b5fe-01aa75ed71a1</VALUE>
                     <IDENTIFIER>699121bb-3d10-11e8-b5fe-01aa75ed71a1</IDENTIFIER>
                     <TYPE>cellar</TYPE>
                  </URI>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/oj/JOL_2018_093_R</VALUE>
                        <IDENTIFIER>JOL_2018_093_R</IDENTIFIER>
                        <TYPE>oj</TYPE>
                     </URI>
                  </SAMEAS>
               </RESOURCE_LEGAL_PUBLISHED_IN_OFFICIAL-JOURNAL>
               <RESOURCE_LEGAL_TYPE type="data">
                  <VALUE>D</VALUE>
               </RESOURCE_LEGAL_TYPE>
               <WORK_CITES_WORK type="link">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/cellar/1ec52f4a-cc70-11e4-ab4d-01aa75ed71a1</VALUE>
                     <IDENTIFIER>1ec52f4a-cc70-11e4-ab4d-01aa75ed71a1</IDENTIFIER>
                     <TYPE>cellar</TYPE>
                  </URI>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/immc/20150302-043%3AC%282015%29629%2F801639</VALUE>
                        <IDENTIFIER>20150302-043:C(2015)629/801639</IDENTIFIER>
                        <TYPE>immc</TYPE>
                     </URI>
                  </SAMEAS>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/oj/JOL_2015_072_R_0010</VALUE>
                        <IDENTIFIER>JOL_2015_072_R_0010</IDENTIFIER>
                        <TYPE>oj</TYPE>
                     </URI>
                  </SAMEAS>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/eli/dec/2015/443/oj</VALUE>
                        <IDENTIFIER>dec:2015:443:oj</IDENTIFIER>
                        <TYPE>eli</TYPE>
                     </URI>
                  </SAMEAS>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/celex/32015D0443</VALUE>
                        <IDENTIFIER>32015D0443</IDENTIFIER>
                        <TYPE>celex</TYPE>
                     </URI>
                  </SAMEAS>
               </WORK_CITES_WORK>
               <IDENTIFIER type="data">
                  <VALUE>32018D0559</VALUE>
               </IDENTIFIER>
               <IDENTIFIER type="data">
                  <VALUE>celex:32018D0559</VALUE>
               </IDENTIFIER>
               <IS_ABOUT type="concept">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/authority/fd_070/SECR</VALUE>
                     <IDENTIFIER>SECR</IDENTIFIER>
                     <TYPE>fd_070</TYPE>
                  </URI>
                  <OP-CODE>SECR</OP-CODE>
                  <IDENTIFIER>SECR</IDENTIFIER>
                  <PREFLABEL>Security system</PREFLABEL>
               </IS_ABOUT>
               <RESOURCE_LEGAL_BASED_ON_CONCEPT_TREATY type="concept">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/authority/treaty/EURATOM_2012</VALUE>
                     <IDENTIFIER>EURATOM_2012</IDENTIFIER>
                     <TYPE>treaty</TYPE>
                  </URI>
                  <OP-CODE>EURATOM_2012</OP-CODE>
                  <IDENTIFIER>EURATOM_2012</IDENTIFIER>
                  <PREFLABEL>Treaty establishing the European Atomic Energy Community (consolidated version 2012)</PREFLABEL>
                  <ALTLABEL>Euratom Treaty (2012)</ALTLABEL>
                  <ALTLABEL>EAEC Treaty (2012)</ALTLABEL>
                  <ALTLABEL>Consolidated version of the Treaty establishing the European Atomic Energy Community (2012)</ALTLABEL>
               </RESOURCE_LEGAL_BASED_ON_CONCEPT_TREATY>
               <RESOURCE_LEGAL_BASED_ON_CONCEPT_TREATY type="concept">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/authority/treaty/TFEU_2012</VALUE>
                     <IDENTIFIER>TFEU_2012</IDENTIFIER>
                     <TYPE>treaty</TYPE>
                  </URI>
                  <OP-CODE>TFEU_2012</OP-CODE>
                  <IDENTIFIER>TFEU_2012</IDENTIFIER>
                  <PREFLABEL>Treaty on the Functioning of the European Union (consolidated version 2012)</PREFLABEL>
                  <ALTLABEL>TFEU (2012)</ALTLABEL>
                  <ALTLABEL>Consolidated version of the Treaty on the Functioning of the European Union (2012)</ALTLABEL>
               </RESOURCE_LEGAL_BASED_ON_CONCEPT_TREATY>
               <WORK_IS_ABOUT_CONCEPT_EUROVOC type="concept_facet">
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_CONCEPT type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/4359</VALUE>
                        <IDENTIFIER>4359</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>4359</IDENTIFIER>
                     <PREFLABEL>information system</PREFLABEL>
                     <ALTLABEL>on-line system</ALTLABEL>
                     <ALTLABEL>automatic information system</ALTLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_CONCEPT>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_TT type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/1422</VALUE>
                        <IDENTIFIER>1422</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>1422</IDENTIFIER>
                     <PREFLABEL>information</PREFLABEL>
                     <ALTLABEL>means of information</ALTLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_TT>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_DOM type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/100150</VALUE>
                        <IDENTIFIER>100150</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>32</IDENTIFIER>
                     <PREFLABEL>32 EDUCATION AND COMMUNICATIONS</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_DOM>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_MTH type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/100222</VALUE>
                        <IDENTIFIER>100222</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>3231</IDENTIFIER>
                     <PREFLABEL>3231 information and information processing</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_MTH>
               </WORK_IS_ABOUT_CONCEPT_EUROVOC>
               <WORK_IS_ABOUT_CONCEPT_EUROVOC type="concept_facet">
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_CONCEPT type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/5234</VALUE>
                        <IDENTIFIER>5234</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>5234</IDENTIFIER>
                     <PREFLABEL>safety standard</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_CONCEPT>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_TT type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/3641</VALUE>
                        <IDENTIFIER>3641</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>3641</IDENTIFIER>
                     <PREFLABEL>technical regulations</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_TT>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_DOM type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/100158</VALUE>
                        <IDENTIFIER>100158</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>64</IDENTIFIER>
                     <PREFLABEL>64 PRODUCTION, TECHNOLOGY AND RESEARCH</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_DOM>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_MTH type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/100261</VALUE>
                        <IDENTIFIER>100261</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>6411</IDENTIFIER>
                     <PREFLABEL>6411 technology and technical regulations</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_MTH>
               </WORK_IS_ABOUT_CONCEPT_EUROVOC>
               <WORK_HAS_RESOURCE-TYPE type="concept">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/authority/resource-type/DEC</VALUE>
                     <IDENTIFIER>DEC</IDENTIFIER>
                     <TYPE>resource-type</TYPE>
                  </URI>
                  <OP-CODE>DEC</OP-CODE>
                  <IDENTIFIER>DEC</IDENTIFIER>
                  <PREFLABEL>Decision</PREFLABEL>
                  <ALTLABEL>Decisions</ALTLABEL>
               </WORK_HAS_RESOURCE-TYPE>
               <DATE type="date">
                  <VALUE>2018-04-11</VALUE>
                  <YEAR>2018</YEAR>
                  <MONTH>04</MONTH>
                  <DAY>11</DAY>
               </DATE>
               <DATE type="date">
                  <VALUE>2018-05-01</VALUE>
                  <YEAR>2018</YEAR>
                  <MONTH>05</MONTH>
                  <DAY>01</DAY>
               </DATE>
               <IS_ABOUT type="concept">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/authority/fd_070/TECN</VALUE>
                     <IDENTIFIER>TECN</IDENTIFIER>
                     <TYPE>fd_070</TYPE>
                  </URI>
                  <OP-CODE>TECN</OP-CODE>
                  <IDENTIFIER>TECN</IDENTIFIER>
                  <PREFLABEL>Technology</PREFLABEL>
               </IS_ABOUT>
               <BASED_ON type="link">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/cellar/f9fd8acf-d7c9-11e6-ad7c-01aa75ed71a1</VALUE>
                     <IDENTIFIER>f9fd8acf-d7c9-11e6-ad7c-01aa75ed71a1</IDENTIFIER>
                     <TYPE>cellar</TYPE>
                  </URI>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/oj/JOL_2017_006_R_0005</VALUE>
                        <IDENTIFIER>JOL_2017_006_R_0005</IDENTIFIER>
                        <TYPE>oj</TYPE>
                     </URI>
                  </SAMEAS>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/celex/32017D0046</VALUE>
                        <IDENTIFIER>32017D0046</IDENTIFIER>
                        <TYPE>celex</TYPE>
                     </URI>
                  </SAMEAS>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/eli/dec/2017/46/oj</VALUE>
                        <IDENTIFIER>dec:2017:46:oj</IDENTIFIER>
                        <TYPE>eli</TYPE>
                     </URI>
                  </SAMEAS>
               </BASED_ON>
               <WORK_CITES_WORK type="link">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/cellar/41a6eeeb-cc70-11e4-ab4d-01aa75ed71a1</VALUE>
                     <IDENTIFIER>41a6eeeb-cc70-11e4-ab4d-01aa75ed71a1</IDENTIFIER>
                     <TYPE>cellar</TYPE>
                  </URI>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/oj/JOL_2015_072_R_0011</VALUE>
                        <IDENTIFIER>JOL_2015_072_R_0011</IDENTIFIER>
                        <TYPE>oj</TYPE>
                     </URI>
                  </SAMEAS>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/eli/dec/2015/444/oj</VALUE>
                        <IDENTIFIER>dec:2015:444:oj</IDENTIFIER>
                        <TYPE>eli</TYPE>
                     </URI>
                  </SAMEAS>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/immc/20150302-028%3AC%282015%29630%2F801647</VALUE>
                        <IDENTIFIER>20150302-028:C(2015)630/801647</IDENTIFIER>
                        <TYPE>immc</TYPE>
                     </URI>
                  </SAMEAS>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/celex/32015D0444</VALUE>
                        <IDENTIFIER>32015D0444</IDENTIFIER>
                        <TYPE>celex</TYPE>
                     </URI>
                  </SAMEAS>
               </WORK_CITES_WORK>
               <BASED_ON type="link">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/cellar/d1b2a21b-4a59-4b7e-a084-471afcf6bdbc</VALUE>
                     <IDENTIFIER>d1b2a21b-4a59-4b7e-a084-471afcf6bdbc</IDENTIFIER>
                     <TYPE>cellar</TYPE>
                  </URI>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/eli/treaty/tfeu_2016/art_249/oj</VALUE>
                        <IDENTIFIER>treaty:tfeu_2016:art_249:oj</IDENTIFIER>
                        <TYPE>eli</TYPE>
                     </URI>
                  </SAMEAS>
                  <SAMEAS>
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/celex/12016E249</VALUE>
                        <IDENTIFIER>12016E249</IDENTIFIER>
                        <TYPE>celex</TYPE>
                     </URI>
                  </SAMEAS>
               </BASED_ON>
               <WORK_IS_ABOUT_CONCEPT_EUROVOC type="concept_facet">
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_CONCEPT type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/5181</VALUE>
                        <IDENTIFIER>5181</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>5181</IDENTIFIER>
                     <PREFLABEL>data protection</PREFLABEL>
                     <ALTLABEL>data security</ALTLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_CONCEPT>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_TT type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/4488</VALUE>
                        <IDENTIFIER>4488</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>4488</IDENTIFIER>
                     <PREFLABEL>data processing</PREFLABEL>
                     <ALTLABEL>electronic data processing</ALTLABEL>
                     <ALTLABEL>automatic data processing</ALTLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_TT>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_DOM type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/100150</VALUE>
                        <IDENTIFIER>100150</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>32</IDENTIFIER>
                     <PREFLABEL>32 EDUCATION AND COMMUNICATIONS</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_DOM>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_MTH type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/100223</VALUE>
                        <IDENTIFIER>100223</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>3236</IDENTIFIER>
                     <PREFLABEL>3236 information technology and data processing</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_MTH>
               </WORK_IS_ABOUT_CONCEPT_EUROVOC>
               <IS_ABOUT type="concept">
                  <URI>
                     <VALUE>http://eurovoc.europa.eu/2832</VALUE>
                     <IDENTIFIER>2832</IDENTIFIER>
                     <TYPE>EUROVOC</TYPE>
                  </URI>
                  <IDENTIFIER>2832</IDENTIFIER>
                  <PREFLABEL>protection of communications</PREFLABEL>
                  <ALTLABEL>data espionage</ALTLABEL>
                  <ALTLABEL>telephone tapping</ALTLABEL>
                  <ALTLABEL>wiretapping</ALTLABEL>
                  <ALTLABEL>eavesdropping</ALTLABEL>
                  <ALTLABEL>interception of communications</ALTLABEL>
               </IS_ABOUT>
               <CREATED_BY type="concept">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/authority/corporate-body/HR</VALUE>
                     <IDENTIFIER>HR</IDENTIFIER>
                     <TYPE>corporate-body</TYPE>
                  </URI>
                  <OP-CODE>HR</OP-CODE>
                  <IDENTIFIER>HR</IDENTIFIER>
                  <PREFLABEL>Directorate-General for Human Resources and Security</PREFLABEL>
                  <ALTLABEL>Personnel and Administration DG</ALTLABEL>
                  <ALTLABEL>DG Human Resources and Security</ALTLABEL>
                  <ALTLABEL>DG IX – Personnel and Administration</ALTLABEL>
                  <ALTLABEL>Directorate-General for Personnel and Administration</ALTLABEL>
               </CREATED_BY>
               <WORK_CREATED_BY_AGENT type="concept">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/authority/corporate-body/COM</VALUE>
                     <IDENTIFIER>COM</IDENTIFIER>
                     <TYPE>corporate-body</TYPE>
                  </URI>
                  <OP-CODE>COM</OP-CODE>
                  <IDENTIFIER>COM</IDENTIFIER>
                  <PREFLABEL>European Commission</PREFLABEL>
                  <ALTLABEL>Commission of the European Communities</ALTLABEL>
                  <ALTLABEL>European Commission</ALTLABEL>
                  <ALTLABEL>Commission</ALTLABEL>
               </WORK_CREATED_BY_AGENT>
               <IS_ABOUT type="concept">
                  <URI>
                     <VALUE>http://eurovoc.europa.eu/4038</VALUE>
                     <IDENTIFIER>4038</IDENTIFIER>
                     <TYPE>EUROVOC</TYPE>
                  </URI>
                  <IDENTIFIER>4038</IDENTIFIER>
                  <PREFLABEL>European Commission</PREFLABEL>
                  <ALTLABEL>EC Commission</ALTLABEL>
                  <ALTLABEL>Commission of the European Communities</ALTLABEL>
                  <ALTLABEL>EU Commission</ALTLABEL>
                  <ALTLABEL>CEC</ALTLABEL>
               </IS_ABOUT>
               <IDENTIFIER type="data">
                  <VALUE>oj:JOL_2018_093_R_0003</VALUE>
               </IDENTIFIER>
               <SERVICE_RESPONSIBLE type="data">
                  <VALUE>HR</VALUE>
               </SERVICE_RESPONSIBLE>
               <DATE_DOCUMENT type="date">
                  <VALUE>2018-04-06</VALUE>
                  <YEAR>2018</YEAR>
                  <MONTH>04</MONTH>
                  <DAY>06</DAY>
               </DATE_DOCUMENT>
               <RESOURCE_LEGAL_IS_ABOUT_SUBJECT-MATTER type="concept_level">
                  <RESOURCE_LEGAL_IS_ABOUT_SUBJECT-MATTER_1 type="concept">
                     <URI>
                        <VALUE>http://publications.europa.eu/resource/authority/fd_070/TELE</VALUE>
                        <IDENTIFIER>TELE</IDENTIFIER>
                        <TYPE>fd_070</TYPE>
                     </URI>
                     <OP-CODE>TELE</OP-CODE>
                     <IDENTIFIER>TELE</IDENTIFIER>
                     <PREFLABEL>Telecommunications</PREFLABEL>
                  </RESOURCE_LEGAL_IS_ABOUT_SUBJECT-MATTER_1>
               </RESOURCE_LEGAL_IS_ABOUT_SUBJECT-MATTER>
               <RESOURCE_LEGAL_NUMBER_NATURAL_CELEX type="data">
                  <VALUE>0559</VALUE>
               </RESOURCE_LEGAL_NUMBER_NATURAL_CELEX>
               <VERSION type="data">
                  <VALUE>1.44</VALUE>
               </VERSION>
               <WORK_IS_ABOUT_CONCEPT_EUROVOC type="concept_facet">
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_CONCEPT type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/5188</VALUE>
                        <IDENTIFIER>5188</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>5188</IDENTIFIER>
                     <PREFLABEL>information technology</PREFLABEL>
                     <ALTLABEL>communications technology</ALTLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_CONCEPT>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_TT type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/1370</VALUE>
                        <IDENTIFIER>1370</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>1370</IDENTIFIER>
                     <PREFLABEL>communications industry</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_TT>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_DOM type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/100150</VALUE>
                        <IDENTIFIER>100150</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>32</IDENTIFIER>
                     <PREFLABEL>32 EDUCATION AND COMMUNICATIONS</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_DOM>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_MTH type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/100221</VALUE>
                        <IDENTIFIER>100221</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>3226</IDENTIFIER>
                     <PREFLABEL>3226 communications</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_MTH>
               </WORK_IS_ABOUT_CONCEPT_EUROVOC>
               <WORK_ID_DOCUMENT type="data">
                  <VALUE>immc:C(2018)1726/965078</VALUE>
               </WORK_ID_DOCUMENT>
               <WORK_IS_ABOUT_CONCEPT_EUROVOC type="concept_facet">
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_CONCEPT type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/1426</VALUE>
                        <IDENTIFIER>1426</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>1426</IDENTIFIER>
                     <PREFLABEL>computer systems</PREFLABEL>
                     <ALTLABEL>informatics</ALTLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_CONCEPT>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_TT type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/1426</VALUE>
                        <IDENTIFIER>1426</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>1426</IDENTIFIER>
                     <PREFLABEL>computer systems</PREFLABEL>
                     <ALTLABEL>informatics</ALTLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_TT>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_DOM type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/100150</VALUE>
                        <IDENTIFIER>100150</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>32</IDENTIFIER>
                     <PREFLABEL>32 EDUCATION AND COMMUNICATIONS</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_DOM>
                  <WORK_IS_ABOUT_CONCEPT_EUROVOC_MTH type="concept">
                     <URI>
                        <VALUE>http://eurovoc.europa.eu/100223</VALUE>
                        <IDENTIFIER>100223</IDENTIFIER>
                        <TYPE>EUROVOC</TYPE>
                     </URI>
                     <IDENTIFIER>3236</IDENTIFIER>
                     <PREFLABEL>3236 information technology and data processing</PREFLABEL>
                  </WORK_IS_ABOUT_CONCEPT_EUROVOC_MTH>
               </WORK_IS_ABOUT_CONCEPT_EUROVOC>
               <RESOURCE_LEGAL_HAS_TYPE_ACT_CONCEPT_TYPE_ACT type="concept">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/authority/resource-type/DEC</VALUE>
                     <IDENTIFIER>DEC</IDENTIFIER>
                     <TYPE>resource-type</TYPE>
                  </URI>
                  <OP-CODE>DEC</OP-CODE>
                  <IDENTIFIER>DEC</IDENTIFIER>
                  <PREFLABEL>Decision</PREFLABEL>
                  <ALTLABEL>Decisions</ALTLABEL>
               </RESOURCE_LEGAL_HAS_TYPE_ACT_CONCEPT_TYPE_ACT>
               <ELI type="data">
                  <VALUE>http://data.europa.eu/eli/dec/2018/559/oj</VALUE>
               </ELI>
               <IS_ABOUT type="concept">
                  <URI>
                     <VALUE>http://eurovoc.europa.eu/4361</VALUE>
                     <IDENTIFIER>4361</IDENTIFIER>
                     <TYPE>EUROVOC</TYPE>
                  </URI>
                  <IDENTIFIER>4361</IDENTIFIER>
                  <PREFLABEL>communications systems</PREFLABEL>
               </IS_ABOUT>
               <TYPE>D</TYPE>
               <TYPE>cdm:work</TYPE>
               <TYPE>cdm:legislation_secondary</TYPE>
               <TYPE>cdm:resource_legal</TYPE>
            </WORK>
            <EXPRESSION xmlns="">
               <URI>
                  <VALUE>http://publications.europa.eu/resource/cellar/7ec299cb-3d15-11e8-b5fe-01aa75ed71a1.0006</VALUE>
                  <IDENTIFIER>7ec299cb-3d15-11e8-b5fe-01aa75ed71a1.0006</IDENTIFIER>
                  <TYPE>cellar</TYPE>
               </URI>
               <SAMEAS>
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/oj/JOL_2018_093_R_0003.ENG</VALUE>
                     <IDENTIFIER>JOL_2018_093_R_0003.ENG</IDENTIFIER>
                     <TYPE>oj</TYPE>
                  </URI>
               </SAMEAS>
               <SAMEAS>
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/uriserv/OJ.L_.2018.093.01.0004.01.ENG</VALUE>
                     <IDENTIFIER>OJ.L_.2018.093.01.0004.01.ENG</IDENTIFIER>
                     <TYPE>uriserv</TYPE>
                  </URI>
               </SAMEAS>
               <SAMEAS>
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/celex/32018D0559.ENG</VALUE>
                     <IDENTIFIER>32018D0559.ENG</IDENTIFIER>
                     <TYPE>celex</TYPE>
                  </URI>
               </SAMEAS>
               <EXPRESSION_TITLE type="data">
                  <VALUE>Commission Decision (EU, Euratom) 2018/559 of 6 April 2018 laying down implementing rules for Article 6 of Decision (EU, Euratom) 2017/46 on the security of communication and information systems in the European Commission</VALUE>
               </EXPRESSION_TITLE>
               <TITLE type="data">
                  <VALUE>C/2018/1726</VALUE>
               </TITLE>
               <LANG type="data">
                  <VALUE>eng</VALUE>
               </LANG>
               <LASTMODIFICATIONDATE type="date">
                  <VALUE>2018-04-11T01:51:10.301+02:00</VALUE>
                  <YEAR>2018</YEAR>
                  <MONTH>04</MONTH>
                  <DAY>11</DAY>
               </LASTMODIFICATIONDATE>
               <TITLE type="data">
                  <VALUE>Commission Decision (EU, Euratom) 2018/559 of 6 April 2018 laying down implementing rules for Article 6 of Decision (EU, Euratom) 2017/46 on the security of communication and information systems in the European Commission</VALUE>
               </TITLE>
               <EXPRESSION_USES_LANGUAGE type="concept">
                  <URI>
                     <VALUE>http://publications.europa.eu/resource/authority/language/ENG</VALUE>
                     <IDENTIFIER>ENG</IDENTIFIER>
                     <TYPE>language</TYPE>
                  </URI>
                  <OP-CODE>ENG</OP-CODE>
                  <IDENTIFIER>ENG</IDENTIFIER>
                  <PREFLABEL>English</PREFLABEL>
                  <ALTLABEL>English</ALTLABEL>
               </EXPRESSION_USES_LANGUAGE>
               <LANG type="data">
                  <VALUE>en</VALUE>
               </LANG>
               <EXPRESSION_SUBTITLE type="data">
                  <VALUE>C/2018/1726</VALUE>
               </EXPRESSION_SUBTITLE>
            </EXPRESSION>
         </ukm:EURLexMetadata><ukm:DocumentCurrentStatus><ukm:UKAmended Value="false"/></ukm:DocumentCurrentStatus></ukm:EUMetadata>
					

                    
									 
					<ukm:Alternatives><ukm:Alternative URI="http://www.legislation.gov.uk/eudn/2018/559/pdfs/eudn_20180559_adopted_en.pdf" Date="2018-04-11" Size="405130"/> </ukm:Alternatives>
					
					<ukm:Statistics>
									<ukm:TotalParagraphs Value="13"/>
									<ukm:BodyParagraphs Value="11"/>
									<ukm:ScheduleParagraphs Value="2"/>
									<ukm:AttachmentParagraphs Value="0"/>
									<ukm:TotalImages Value="0"/>
								</ukm:Statistics>
				</ukm:Metadata><EURetained>
      <EUPrelims DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/introduction" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/introduction" RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
         <MultilineTitle>
            <Text>
               <Uppercase>Commission Decision</Uppercase> (EU, Euratom) 2018/559</Text>
            <Text>of 6 April 2018</Text>
            <Text>laying down implementing rules for Article 6 of Decision (EU, Euratom) 2017/46 on the security of communication and information systems in the European Commission</Text>
         </MultilineTitle>
         <EUPreamble>
            <P>
               <Text>THE EUROPEAN COMMISSION,</Text>
            </P>
            <P>
               <Text>Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249 thereof,</Text>
            </P>
            <P>
               <Text>Having regard to the Treaty establishing the European Atomic Energy Community,</Text>
            </P>
            <P>
               <Text>Having regard to Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission<FootnoteRef Ref="f00001"/>, and in particular Article 6 thereof,</Text>
            </P>
            <P>
               <Text>Whereas:</Text>
            </P>
            <Division>
               <Number>(1)</Number>
               <P>
                  <Text>With the adoption of Decision (EU, Euratom) 2017/46, there is a need for the Commission to review, update and consolidate the implementing rules linked to the repealed Commission Decision C(2006) 3602 on the security of communication and information systems used by the Commission.</Text>
               </P>
            </Division>
            <Division>
               <Number>(2)</Number>
               <P>
                  <Text>The member of the Commission responsible for security, in full compliance with the internal rules of procedures, has been empowered to establish implementing rules in line with Article 13 of Decision (EU, Euratom) 2017/46<FootnoteRef Ref="f00002"/>.</Text>
               </P>
            </Division>
            <Division>
               <Number>(3)</Number>
               <P>
                  <Text>The implementing rules of Decision C(2006) 3602 should therefore be repealed,</Text>
               </P>
            </Division>
            <P>
               <Text>HAS ADOPTED THIS DECISION:</Text>
            </P>
         </EUPreamble>
      </EUPrelims>
      <EUBody DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/body" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/body" NumberOfProvisions="11" RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
         <EUChapter DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/chapter/1" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/chapter/1" NumberOfProvisions="2" id="chapter-1" RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
            <Number>CHAPTER 1</Number>
            <Title>
               <Strong>GENERAL PROVISIONS</Strong>
            </Title>
            <P1group RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
               <Title>Subject matter and scope</Title>
               <P1 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/1" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/1" id="article-1">
                  <Pnumber>Article 1</Pnumber>
                  <P1para>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/1/1" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/1/1" id="article-1-1">
                        <Pnumber PuncBefore="" PuncAfter=".">1</Pnumber>
                        <P2para>
                           <Text>The subject matter and scope of this Decision are provided in Article 1 of Decision (EU, Euratom) 2017/46.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/1/2" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/1/2" id="article-1-2">
                        <Pnumber PuncBefore="" PuncAfter=".">2</Pnumber>
                        <P2para>
                           <Text>The provisions in this Decision apply to all communication and information systems (CISs). However, the responsibilities defined in this Decision shall not apply to CISs handling EU classified information. The relevant responsibilities for these systems shall be determined by the system owner and the Commission Security Authority in line with Commission Decision (EU, Euratom) 2015/444<FootnoteRef Ref="f00003"/>.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/1/3" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/1/3" id="article-1-3">
                        <Pnumber PuncBefore="" PuncAfter=".">3</Pnumber>
                        <P2para>
                           <Text>Chapter 2 of this Decision presents an overview of the practical implementation of the organisation and responsibilities relating to IT security. Chapter 3 of this Decision presents an overview of the processes relating to Article 6 of Decision (EU, Euratom) 2017/46.</Text>
                        </P2para>
                     </P2>
                  </P1para>
               </P1>
            </P1group>
            <P1group RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
               <Title>Definitions</Title>
               <P1 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/2" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/2" id="article-2">
                  <Pnumber>Article 2</Pnumber>
                  <P1para>
                     <Text>The definitions in Article 2 of Decision (EU, Euratom) 2017/46 apply to this Decision. For the purposes of this Decision the following definitions shall also apply:</Text>
                  </P1para>
                  <P1para>
                     <OrderedList Type="arabic" Decoration="period">
                        <ListItem NumberOverride="1.">
                           <Para>
                              <Text>‘Crypto Approval Authority’ (CAA) is a function assumed by the Commission Security Authority that falls under the authority of the Director-General for Human Resources and Security;</Text>
                           </Para>
                        </ListItem>
                        <ListItem NumberOverride="2.">
                           <Para>
                              <Text>‘External network connection’ means any electronic communications connection between the Commission's internal network and any other network, including the internet. This definition excludes third party networks that are provided under contract to be part of the Commission's internal network.</Text>
                           </Para>
                        </ListItem>
                        <ListItem NumberOverride="3.">
                           <Para>
                              <Text>‘Key escrow’ means a procedure for storing copies of cryptographic keys with one or more separate parties, ensuring the segregation of duties, to enable their recovery in case the operational copy is lost. Keys may be split into two or more parts, each of which is lodged with a different party to ensure that no single party possesses the entire key.</Text>
                           </Para>
                        </ListItem>
                        <ListItem NumberOverride="4.">
                           <Para>
                              <Text>‘RASCI’ is an abbreviation for a responsibility assignment based on the following attribution indicators:</Text>
                           </Para>
                           <Para>
                              <OrderedList Type="alpha" Decoration="parens">
                                 <ListItem NumberOverride="(a)">
                                    <Para>
                                       <Text>‘responsible’ (R) means having the obligation to act and take decisions to achieve required outcomes;</Text>
                                    </Para>
                                 </ListItem>
                                 <ListItem NumberOverride="(b)">
                                    <Para>
                                       <Text>‘accountable’ (A) means being answerable for actions, decisions and performance;</Text>
                                    </Para>
                                 </ListItem>
                                 <ListItem NumberOverride="(c)">
                                    <Para>
                                       <Text>‘supports’ (S) means having the obligation to work with the person responsible to complete the task;</Text>
                                    </Para>
                                 </ListItem>
                                 <ListItem NumberOverride="(d)">
                                    <Para>
                                       <Text>‘consulted’ (C) means being sought for advice or opinion;</Text>
                                    </Para>
                                 </ListItem>
                                 <ListItem NumberOverride="(e)">
                                    <Para>
                                       <Text>‘informed’ (I) means being kept up to date with relevant information.</Text>
                                    </Para>
                                 </ListItem>
                              </OrderedList>
                           </Para>
                        </ListItem>
                     </OrderedList>
                  </P1para>
               </P1>
            </P1group>
         </EUChapter>
         <EUChapter DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/chapter/2" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/chapter/2" NumberOfProvisions="2" id="chapter-2" RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
            <Number>CHAPTER 2</Number>
            <Title>
               <Strong>ORGANISATION AND RESPONSIBILITIES</Strong>
            </Title>
            <P1group RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
               <Title>Roles and responsibilities</Title>
               <P1 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/3" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/3" id="article-3">
                  <Pnumber>Article 3</Pnumber>
                  <P1para>
                     <Text>The roles and responsibilities relating to Articles 4 to 8 of this Decision are defined in the Annex in accordance with the RASCI model.</Text>
                  </P1para>
               </P1>
            </P1group>
            <P1group RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
               <Title>Alignment with the Commission's information security policy</Title>
               <P1 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/4" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/4" id="article-4">
                  <Pnumber>Article 4</Pnumber>
                  <P1para>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/4/1" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/4/1" id="article-4-1">
                        <Pnumber PuncBefore="" PuncAfter=".">1</Pnumber>
                        <P2para>
                           <Text>The Directorate-General for Human Resources and Security shall review the Commission's IT security policy and related standards and guidelines to ensure that they are in line with the Commission's general security policies, in particular Commission Decision (EU, Euratom) 2015/443<FootnoteRef Ref="f00004"/> and Decision (EU, Euratom) 2015/444.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/4/2" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/4/2" id="article-4-2">
                        <Pnumber PuncBefore="" PuncAfter=".">2</Pnumber>
                        <P2para>
                           <Text>Upon request by other Commission departments, the Directorate-General for Human Resources and Security may review their IT security policies or other IT security documentation to ensure their consistency with the Commission's information security policy. The head of the Commission department concerned shall ensure that any inconsistencies are addressed.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/4/3" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/4/3" id="article-4-3">
                        <Pnumber PuncBefore="" PuncAfter=".">3</Pnumber>
                        <P2para>
                           <Text>Under its responsibility for the security of information, the Directorate-General for Human Resources and Security shall cooperate with the Directorate-General for Informatics to ensure that the IT security processes take full account of the classification and principles of security laid down in Decision (EU, Euratom) 2015/443, in particular Articles 3 and 9.</Text>
                        </P2para>
                     </P2>
                  </P1para>
               </P1>
            </P1group>
         </EUChapter>
         <EUChapter DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/chapter/3" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/chapter/3" NumberOfProvisions="4" id="chapter-3" RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
            <Number>CHAPTER 3</Number>
            <Title>
               <Strong>IT SECURITY PROCESSES</Strong>
            </Title>
            <P1group RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
               <Title>Encrypting technologies</Title>
               <P1 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/5" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/5" id="article-5">
                  <Pnumber>Article 5</Pnumber>
                  <P1para>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/5/1" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/5/1" id="article-5-1">
                        <Pnumber PuncBefore="" PuncAfter=".">1</Pnumber>
                        <P2para>
                           <Text>The use of encrypting technologies for the protection of EU classified information (EUCI) shall comply with Decision (EU, Euratom) 2015/444.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/5/2" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/5/2" id="article-5-2">
                        <Pnumber PuncBefore="" PuncAfter=".">2</Pnumber>
                        <P2para>
                           <Text>The decisions on the use of encrypting technologies for the protection of non-EUCI data shall be taken by the system owner of each CIS, taking into account both the risks that are intended to be mitigated through encryption and the risks that it introduces.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/5/3" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/5/3" id="article-5-3">
                        <Pnumber PuncBefore="" PuncAfter=".">3</Pnumber>
                        <P2para>
                           <Text>Prior approval from the CAA is required for all uses of encrypting technologies, unless the encryption is used only to protect the confidentiality of non-EUCI data in transit and uses standard network communications protocols.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/5/4" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/5/4" id="article-5-4">
                        <Pnumber PuncBefore="" PuncAfter=".">4</Pnumber>
                        <P2para>
                           <Text>With the exception noted in paragraph 3 of this Article, Commission departments shall ensure that back-ups of any decryption keys are stored in key escrow for the purpose of recovering stored data in the event that the decryption key is not available. The recovery of encrypted data using back-ups of decryption keys shall be carried out only when authorised in line with the standard defined by the CAA.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/5/5" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/5/5" id="article-5-5">
                        <Pnumber PuncBefore="" PuncAfter=".">5</Pnumber>
                        <P2para>
                           <Text>Requests for approval for the use of encrypting technologies shall be formally documented and shall include details of the CIS and data to be protected, the technologies to be used and the related security operating procedures. These requests for approval shall be signed by the system owner.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/5/6" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/5/6" id="article-5-6">
                        <Pnumber PuncBefore="" PuncAfter=".">6</Pnumber>
                        <P2para>
                           <Text>Requests for approval for the use of encrypting technologies shall be evaluated by the CAA in line with the published standards and requirements.</Text>
                        </P2para>
                     </P2>
                  </P1para>
               </P1>
            </P1group>
            <P1group RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
               <Title>IT security inspections</Title>
               <P1 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/6" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/6" id="article-6">
                  <Pnumber>Article 6</Pnumber>
                  <P1para>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/6/1" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/6/1" id="article-6-1">
                        <Pnumber PuncBefore="" PuncAfter=".">1</Pnumber>
                        <P2para>
                           <Text>The Directorate-General for Human Resources and Security shall undertake IT security inspections in order to verify whether IT security measures comply with the Commission's IT security policies and to check the integrity of these control measures.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/6/2" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/6/2" id="article-6-2">
                        <Pnumber PuncBefore="" PuncAfter=".">2</Pnumber>
                        <P2para>
                           <Text>The Directorate-General for Human Resources and Security may perform an IT security inspection:</Text>
                           <P3>
                              <Pnumber PuncBefore="(" PuncAfter=")">a</Pnumber>
                              <P3para>
                                 <Text>on its own initiative;</Text>
                              </P3para>
                           </P3>
                           <P3>
                              <Pnumber PuncBefore="(" PuncAfter=")">b</Pnumber>
                              <P3para>
                                 <Text>on request from the Information Security Steering Board (ISSB);</Text>
                              </P3para>
                           </P3>
                           <P3>
                              <Pnumber PuncBefore="(" PuncAfter=")">c</Pnumber>
                              <P3para>
                                 <Text>on a request received from a system owner;</Text>
                              </P3para>
                           </P3>
                           <P3>
                              <Pnumber PuncBefore="(" PuncAfter=")">d</Pnumber>
                              <P3para>
                                 <Text>further to a security incident; or</Text>
                              </P3para>
                           </P3>
                           <P3>
                              <Pnumber PuncBefore="(" PuncAfter=")">e</Pnumber>
                              <P3para>
                                 <Text>further to the identification of a high risk to a particular system.</Text>
                              </P3para>
                           </P3>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/6/3" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/6/3" id="article-6-3">
                        <Pnumber PuncBefore="" PuncAfter=".">3</Pnumber>
                        <P2para>
                           <Text>Data owners may request an IT security inspection before storing their information in a CIS.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/6/4" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/6/4" id="article-6-4">
                        <Pnumber PuncBefore="" PuncAfter=".">4</Pnumber>
                        <P2para>
                           <Text>The results of an inspection shall be documented in a formal report to the system owner, and copied to the LISO, that includes findings and recommendations for improving the CIS's compliance with the IT security policy. The Directorate-General for Human Resources and Security shall report significant issues and recommendations to the ISSB.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/6/5" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/6/5" id="article-6-5">
                        <Pnumber PuncBefore="" PuncAfter=".">5</Pnumber>
                        <P2para>
                           <Text>The Directorate-General for Human Resources and Security shall monitor the implementation of the recommendations.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/6/6" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/6/6" id="article-6-6">
                        <Pnumber PuncBefore="" PuncAfter=".">6</Pnumber>
                        <P2para>
                           <Text>Where appropriate, IT security inspections shall include the inspection of services, premises and equipment provided to the system owner, including both internal and external service providers.</Text>
                        </P2para>
                     </P2>
                  </P1para>
               </P1>
            </P1group>
            <P1group RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
               <Title>Access from external networks</Title>
               <P1 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/7" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/7" id="article-7">
                  <Pnumber>Article 7</Pnumber>
                  <P1para>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/7/1" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/7/1" id="article-7-1">
                        <Pnumber PuncBefore="" PuncAfter=".">1</Pnumber>
                        <P2para>
                           <Text>The Directorate-General for Human Resources and Security shall lay down the rules in a standard on authorising access between Commission CISs and external networks.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/7/2" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/7/2" id="article-7-2">
                        <Pnumber PuncBefore="" PuncAfter=".">2</Pnumber>
                        <P2para>
                           <Text>The rules shall distinguish different types of external network connections and lay down appropriate security rules for each type of connection, including whether a prior authorisation for the connection is required from the relevant authority as noted in paragraph 4 of this Article.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/7/3" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/7/3" id="article-7-3">
                        <Pnumber PuncBefore="" PuncAfter=".">3</Pnumber>
                        <P2para>
                           <Text>If required, authorisation shall be granted on the basis of a formal request and approval process. The approval shall be valid for a specified duration and shall be obtained before the connection is activated.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/7/4" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/7/4" id="article-7-4">
                        <Pnumber PuncBefore="" PuncAfter=".">4</Pnumber>
                        <P2para>
                           <Text>The Directorate-General for Human Resources and Security shall have the overall responsibility for authorising requests, but may delegate the responsibility for authorising some types of connection at its own discretion in line with Article 17(3) of Decision (EU, Euratom) 2015/443 and subject to the conditions laid down under (8).</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/7/5" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/7/5" id="article-7-5">
                        <Pnumber PuncBefore="" PuncAfter=".">5</Pnumber>
                        <P2para>
                           <Text>The authorising entity may impose additional security requirements as a prerequisite for approval, in order to protect the Commission's CIS and networks from the risks of unauthorised access or other security breaches.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/7/6" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/7/6" id="article-7-6">
                        <Pnumber PuncBefore="" PuncAfter=".">6</Pnumber>
                        <P2para>
                           <Text>The Directorate-General for Informatics is the standard provider of network services for the Commission. Any other Commission department operating a network that is not provided by the Directorate-General for Informatics shall first obtain the agreement of the ISSB. The Commission department shall document the business justification for the request and demonstrate that the network controls are sufficient to meet the requirements for controlling incoming and outgoing flows of information.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/7/7" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/7/7" id="article-7-7">
                        <Pnumber PuncBefore="" PuncAfter=".">7</Pnumber>
                        <P2para>
                           <Text>The system owner of a CIS shall determine the security requirements for external access to that CIS and shall ensure the implementation of appropriate measures to protect its security, with the support of the LISO.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/7/8" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/7/8" id="article-7-8">
                        <Pnumber PuncBefore="" PuncAfter=".">8</Pnumber>
                        <P2para>
                           <Text>The security measures implemented for external network connections shall be based on the principles of need-to-know and least privilege, which ensure that individuals only receive the information and access rights that they need to perform their official duties for the Commission.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/7/9" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/7/9" id="article-7-9">
                        <Pnumber PuncBefore="" PuncAfter=".">9</Pnumber>
                        <P2para>
                           <Text>All external network connections shall be filtered and monitored to detect potential security breaches.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/7/10" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/7/10" id="article-7-10">
                        <Pnumber PuncBefore="" PuncAfter=".">10</Pnumber>
                        <P2para>
                           <Text>Where connections are established to allow the outsourcing of a CIS, the authorisation shall be conditional on the successful completion of the procedure described in Article 8.</Text>
                        </P2para>
                     </P2>
                  </P1para>
               </P1>
            </P1group>
            <P1group RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
               <Title>Outsourcing of CISs</Title>
               <P1 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/8" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/8" id="article-8">
                  <Pnumber>Article 8</Pnumber>
                  <P1para>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/8/1" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/8/1" id="article-8-1">
                        <Pnumber PuncBefore="" PuncAfter=".">1</Pnumber>
                        <P2para>
                           <Text>For the purposes of this Decision, a CIS is considered to be outsourced when it is provided on the basis of a contract with a third party contractor, under which the CIS is housed on non-Commission premises. This includes the outsourcing of individual or multiple CISs or other IT services, data centres on non-Commission premises, and the handling of Commission data sets by external services.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/8/2" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/8/2" id="article-8-2">
                        <Pnumber PuncBefore="" PuncAfter=".">2</Pnumber>
                        <P2para>
                           <Text>The outsourcing of a CIS shall take into account the sensitivity or classification of the information handled as follows:</Text>
                           <P3>
                              <Pnumber PuncBefore="(" PuncAfter=")">a</Pnumber>
                              <P3para>
                                 <Text>CISs handling EUCI shall be accredited in accordance with Decision (EU, Euratom) 2015/444, and the Commission Security Accreditation Authority (SAA) shall be consulted in advance. Systems handling EUCI shall not be outsourced.</Text>
                              </P3para>
                           </P3>
                           <P3>
                              <Pnumber PuncBefore="(" PuncAfter=")">b</Pnumber>
                              <P3para>
                                 <Text>The system owner of a CIS handling non-EUCI information shall implement proportionate measures to address the security needs in line with the relevant legal obligations or the sensitivity of the information, taking into account the risks of outsourcing. The Directorate-General for Human Resources and Security may impose additional requirements.</Text>
                              </P3para>
                           </P3>
                           <P3>
                              <Pnumber PuncBefore="(" PuncAfter=")">c</Pnumber>
                              <P3para>
                                 <Text>Outsourced development projects shall take into account the sensitivity of the developed code and any test data used during development.</Text>
                              </P3para>
                           </P3>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/8/3" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/8/3" id="article-8-3">
                        <Pnumber PuncBefore="" PuncAfter=".">3</Pnumber>
                        <P2para>
                           <Text>The following principles shall apply to outsourced CIS in addition to those laid down in Article 3 of Decision (EU, Euratom) 2017/46:</Text>
                           <P3>
                              <Pnumber PuncBefore="(" PuncAfter=")">a</Pnumber>
                              <P3para>
                                 <Text>outsourcing arrangements shall be designed to avoid dependency on specific suppliers;</Text>
                              </P3para>
                           </P3>
                           <P3>
                              <Pnumber PuncBefore="(" PuncAfter=")">b</Pnumber>
                              <P3para>
                                 <Text>outsourcing security arrangements shall minimise the possibilities for third party staff to access or modify Commission information;</Text>
                              </P3para>
                           </P3>
                           <P3>
                              <Pnumber PuncBefore="(" PuncAfter=")">c</Pnumber>
                              <P3para>
                                 <Text>third party staff that have access to an outsourced CIS shall provide confidentiality agreements;</Text>
                              </P3para>
                           </P3>
                           <P3>
                              <Pnumber PuncBefore="(" PuncAfter=")">d</Pnumber>
                              <P3para>
                                 <Text>the outsourcing of a CIS shall be indicated in the inventory of CISs.</Text>
                              </P3para>
                           </P3>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/8/4" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/8/4" id="article-8-4">
                        <Pnumber PuncBefore="" PuncAfter=".">4</Pnumber>
                        <P2para>
                           <Text>The system owner with the participation of the data owner shall:</Text>
                           <P3>
                              <Pnumber PuncBefore="(" PuncAfter=")">a</Pnumber>
                              <P3para>
                                 <Text>assess and document the risks relating to outsourcing;</Text>
                              </P3para>
                           </P3>
                           <P3>
                              <Pnumber PuncBefore="(" PuncAfter=")">b</Pnumber>
                              <P3para>
                                 <Text>lay down relevant security requirements;</Text>
                              </P3para>
                           </P3>
                           <P3>
                              <Pnumber PuncBefore="(" PuncAfter=")">c</Pnumber>
                              <P3para>
                                 <Text>consult with the system owners of all other connected CISs to ensure that their security requirements are included;</Text>
                              </P3para>
                           </P3>
                           <P3>
                              <Pnumber PuncBefore="(" PuncAfter=")">d</Pnumber>
                              <P3para>
                                 <Text>ensure that appropriate security requirements and rights are included in the outsourcing contract;</Text>
                              </P3para>
                           </P3>
                           <P3>
                              <Pnumber PuncBefore="(" PuncAfter=")">e</Pnumber>
                              <P3para>
                                 <Text>fulfil any other requirements laid down in the detailed procedure as noted in paragraph 8 of this Article.</Text>
                              </P3para>
                           </P3>
                        </P2para>
                        <P2para>
                           <Text>These actions shall be completed before the contract or other agreement is signed for the outsourcing of one or more CISs.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/8/5" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/8/5" id="article-8-5">
                        <Pnumber PuncBefore="" PuncAfter=".">5</Pnumber>
                        <P2para>
                           <Text>System owners shall manage the risks relating to outsourcing during the lifetime of the CIS in order to meet the defined security requirements.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/8/6" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/8/6" id="article-8-6">
                        <Pnumber PuncBefore="" PuncAfter=".">6</Pnumber>
                        <P2para>
                           <Text>System owners shall ensure that third party contractors are obliged to immediately notify the Commission of all IT security incidents affecting an outsourced Commission CIS.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/8/7" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/8/7" id="article-8-7">
                        <Pnumber PuncBefore="" PuncAfter=".">7</Pnumber>
                        <P2para>
                           <Text>The system owner is responsible for ensuring the compliance of the CIS, the outsourcing contract and the security arrangements with the Commission's rules on information security and IT security.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/8/8" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/8/8" id="article-8-8">
                        <Pnumber PuncBefore="" PuncAfter=".">8</Pnumber>
                        <P2para>
                           <Text>The Directorate-General for Human Resources and Security shall lay down the detailed standard related to the responsibilities and activities set out in points (1) to (7) in accordance with Article 10 below.</Text>
                        </P2para>
                     </P2>
                  </P1para>
               </P1>
            </P1group>
         </EUChapter>
         <EUChapter DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/chapter/4" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/chapter/4" NumberOfProvisions="3" id="chapter-4" RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
            <Number>CHAPTER 4</Number>
            <Title>
               <Strong>MISCELLANEOUS AND FINAL PROVISIONS</Strong>
            </Title>
            <P1group RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
               <Title>Transparency</Title>
               <P1 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/9" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/9" id="article-9">
                  <Pnumber>Article 9</Pnumber>
                  <P1para>
                     <Text>This Decision shall be brought to the attention of Commission staff and to all individuals to whom it applies, and published in the <Emphasis>Official Journal of the European Union</Emphasis>.</Text>
                  </P1para>
               </P1>
            </P1group>
            <P1group RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
               <Title>Standards</Title>
               <P1 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/10" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/10" id="article-10">
                  <Pnumber>Article 10</Pnumber>
                  <P1para>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/10/1" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/10/1" id="article-10-1">
                        <Pnumber PuncBefore="" PuncAfter=".">1</Pnumber>
                        <P2para>
                           <Text>The provisions of this Decision shall, where necessary, be further detailed in standards and/or guidelines to be adopted in line with Decision (EU, Euratom) 2017/46 and with Decision C(2017) 7428. IT security standards and guidelines shall provide further details on these implementing rules and Decision (EU, Euratom) 2017/46 for specific security domains according to ISO 27001:2013 Annex A. These standards and guidelines are based on industry best practices and are selected to suit the Commission's IT environment.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/10/2" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/10/2" id="article-10-2">
                        <Pnumber PuncBefore="" PuncAfter=".">2</Pnumber>
                        <P2para>
                           <Text>Standards shall, where necessary, be developed according to ISO 27001:2013 Annex A in the following domains:</Text>
                        </P2para>
                        <P2para>
                           <OrderedList Type="arabic" Decoration="parens">
                              <ListItem NumberOverride="(1)">
                                 <Para>
                                    <Text>organisation of information security;</Text>
                                 </Para>
                              </ListItem>
                              <ListItem NumberOverride="(2)">
                                 <Para>
                                    <Text>human resources security;</Text>
                                 </Para>
                              </ListItem>
                              <ListItem NumberOverride="(3)">
                                 <Para>
                                    <Text>asset management;</Text>
                                 </Para>
                              </ListItem>
                              <ListItem NumberOverride="(4)">
                                 <Para>
                                    <Text>access control;</Text>
                                 </Para>
                              </ListItem>
                              <ListItem NumberOverride="(5)">
                                 <Para>
                                    <Text>cryptography;</Text>
                                 </Para>
                              </ListItem>
                              <ListItem NumberOverride="(6)">
                                 <Para>
                                    <Text>physical and environmental security;</Text>
                                 </Para>
                              </ListItem>
                              <ListItem NumberOverride="(7)">
                                 <Para>
                                    <Text>operational security;</Text>
                                 </Para>
                              </ListItem>
                              <ListItem NumberOverride="(8)">
                                 <Para>
                                    <Text>communications security;</Text>
                                 </Para>
                              </ListItem>
                              <ListItem NumberOverride="(9)">
                                 <Para>
                                    <Text>system acquisition, development and maintenance;</Text>
                                 </Para>
                              </ListItem>
                              <ListItem NumberOverride="(10)">
                                 <Para>
                                    <Text>supplier relationships;</Text>
                                 </Para>
                              </ListItem>
                              <ListItem NumberOverride="(11)">
                                 <Para>
                                    <Text>information security incident management;</Text>
                                 </Para>
                              </ListItem>
                              <ListItem NumberOverride="(12)">
                                 <Para>
                                    <Text>information security aspects of business continuity management;</Text>
                                 </Para>
                              </ListItem>
                              <ListItem NumberOverride="(13)">
                                 <Para>
                                    <Text>compliance.</Text>
                                 </Para>
                              </ListItem>
                           </OrderedList>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/10/3" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/10/3" id="article-10-3">
                        <Pnumber PuncBefore="" PuncAfter=".">3</Pnumber>
                        <P2para>
                           <Text>The ISSB shall approve the standards mentioned under paragraph 1 and 2 of this Article before their adoption.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/10/4" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/10/4" id="article-10-4">
                        <Pnumber PuncBefore="" PuncAfter=".">4</Pnumber>
                        <P2para>
                           <Text>The implementing rules to Decision C(2006) 3602 related to the scope of this Decision are hereby repealed.</Text>
                        </P2para>
                     </P2>
                     <P2 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/10/5" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/10/5" id="article-10-5">
                        <Pnumber PuncBefore="" PuncAfter=".">5</Pnumber>
                        <P2para>
                           <Text>The standards and guidelines adopted under Decision C(2006) 3602 of 16 August 2006 shall remain in effect, insofar as they do not conflict with these implementing rules, until they are repealed or replaced by standards or guidelines to be adopted under Article 13 of Decision (EU, Euratom) 2017/46.</Text>
                        </P2para>
                     </P2>
                  </P1para>
               </P1>
            </P1group>
            <P1group RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
               <Title>Entry into force</Title>
               <P1 DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/article/11" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/article/11" id="article-11">
                  <Pnumber>Article 11</Pnumber>
                  <P1para>
                     <Text>This Decision shall enter into force on the twentieth day following that of its publication in the <Emphasis>Official Journal of the European Union</Emphasis>.</Text>
                  </P1para>
               </P1>
            </P1group>
         </EUChapter>
         <SignedSection DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/signature" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/signature" RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
            <Signatory>
               <Para>
                  <Text>Done at Brussels, 6 April 2018.</Text>
               </Para>
               <Signee>
                  <Para>
                     <Text>
                        <Emphasis>For the Commission,</Emphasis>
                     </Text>
                  </Para>
                  <Para>
                     <Text>
                        <Emphasis>On behalf of the President,</Emphasis>
                     </Text>
                  </Para>
                  <Para>
                     <Text>Günther <Uppercase>Oettinger</Uppercase>
                     </Text>
                  </Para>
                  <Para>
                     <Text>
                        <Emphasis>Member of the Commission</Emphasis>
                     </Text>
                  </Para>
               </Signee>
            </Signatory>
         </SignedSection>
      </EUBody>
      <Schedules RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
         <Schedule DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/annex" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/annex" id="annex" RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
            <Number>ANNEX</Number>
            <TitleBlock>
               <Title>
                  <Strong>ROLES AND RESPONSIBILITIES (RASCI)</Strong>
               </Title>
            </TitleBlock>
            <ScheduleBody>
               <P DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/annex/paragraph/1" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/annex/paragraph/1" id="annex-paragraph-1" RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
                  <Text>The RASCI model assigns roles to entities using the following abbreviations:</Text>
               </P>
               <P DocumentURI="http://www.legislation.gov.uk/eudn/2018/559/annex/paragraph/2" IdURI="http://www.legislation.gov.uk/id/eudn/2018/559/annex/paragraph/2" id="annex-paragraph-2" RestrictStartDate="2018-04-06" RestrictExtent="E+W+S+N.I.">
                  <KeyList Separator="—">
                     <KeyListItem>
                        <Key>(a) R</Key>
                        <ListItem>
                           <Para>
                              <Text>Responsible;</Text>
                           </Para>
                        </ListItem>
                     </KeyListItem>
                     <KeyListItem>
                        <Key>(b) A</Key>
                        <ListItem>
                           <Para>
                              <Text>Accountable;</Text>
                           </Para>
                        </ListItem>
                     </KeyListItem>
                     <KeyListItem>
                        <Key>(c) S</Key>
                        <ListItem>
                           <Para>
                              <Text>Supporting;</Text>
                           </Para>
                        </ListItem>
                     </KeyListItem>
                     <KeyListItem>
                        <Key>(d) C</Key>
                        <ListItem>
                           <Para>
                              <Text>Consulted;</Text>
                           </Para>
                        </ListItem>
                     </KeyListItem>
                     <KeyListItem>
                        <Key>(e) I</Key>
                        <ListItem>
                           <Para>
                              <Text>Informed.</Text>
                           </Para>
                        </ListItem>
                     </KeyListItem>
                  </KeyList>
               </P>
               <Tabular Orientation="portrait">
                  <table xmlns="http://www.w3.org/1999/xhtml" cols="9">
                     <tfoot><tr><td colspan="9">
                              <Footnote xmlns="http://www.legislation.gov.uk/namespaces/legislation" id="f00005">
                                 <FootnoteText>
                                    <Para>
                                       <Text>The ISSB is consulted in relation to the operation of internal networks by any Commission department other than the Directorate-General for Informatics.</Text>
                                    </Para>
                                 </FootnoteText>
                              </Footnote>
                           </td></tr><tr><td colspan="9">
                              <Footnote xmlns="http://www.legislation.gov.uk/namespaces/legislation" id="f00006">
                                 <FootnoteText>
                                    <Para>
                                       <Text>The system owner of a CIS being outsourced shall be responsible, and the system owner of any other CIS with which an outsourced CIS interconnects shall be consulted.</Text>
                                    </Para>
                                 </FootnoteText>
                              </Footnote>
                           </td></tr></tfoot>
                     <tbody><tr><th>RoleProcess</th><th>ISSB</th><th>HR (DS)</th><th>Commission Departments</th><th>System Owner</th><th>Data Owner</th><th>LISO</th><th>DIGIT</th><th>Contractors</th></tr><tr><th>Alignment with the Commission's information security policy</th><td/><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">R/A</Strong>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">S</Strong>
                           </td><td/><td/><td/><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">S</Strong>
                           </td><td/></tr><tr><th>Encrypting technologies</th><td/><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">C</Strong>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">A</Strong>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">R</Strong>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">I</Strong>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">C</Strong>
                           </td><td/><td/></tr><tr><th>IT Security Inspections</th><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">I</Strong>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">A/R</Strong>
                           </td><td/><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">S</Strong>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">I</Strong>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">I</Strong>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">S</Strong>
                           </td><td/></tr><tr><th>Access from external networks</th><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">C</Strong>
                              <FootnoteRef xmlns="http://www.legislation.gov.uk/namespaces/legislation" Ref="f00005"/>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">C</Strong>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">A</Strong>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">R</Strong>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">I</Strong>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">S</Strong>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">S</Strong>
                           </td><td/></tr><tr><th>Outsourcing of CISs</th><td/><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">S/C</Strong>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">A</Strong>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">R/C</Strong>
                              <FootnoteRef xmlns="http://www.legislation.gov.uk/namespaces/legislation" Ref="f00006"/>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">S</Strong>
                           </td><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">C</Strong>
                           </td><td/><td>
                              <Strong xmlns="http://www.legislation.gov.uk/namespaces/legislation">S</Strong>
                           </td></tr></tbody>
                  </table>
               </Tabular>
            </ScheduleBody>
         </Schedule>
      </Schedules>
   </EURetained><Footnotes><Footnote id="f00001">
         <FootnoteText>
            <Para>
               <Text>
                  <Citation id="c00001" Class="EuropeanUnionOfficialJournal" Year="2017" URI="https://webarchive.nationalarchives.gov.uk/eu-exit/https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2017.006.01.0040.01.ENG" Date="2017-01-11">OJ L 6, 11.1.2017, p. 40</Citation>.</Text>
            </Para>
         </FootnoteText>
      </Footnote><Footnote id="f00002">
         <FootnoteText>
            <Para>
               <Text>Commission Decision C(2017) 7428 final of 8 November 2017 granting an empowerment to adopt implementing rules, standards and guidelines relating to the security of communication and information systems in the European Commission.</Text>
            </Para>
         </FootnoteText>
      </Footnote><Footnote id="f00003">
         <FootnoteText>
            <Para>
               <Text>Commission Decision (EU, Euratom) 2015/444 of 13 March 2015 on the security rules for protecting EU classified information (<Citation id="c00002" Class="EuropeanUnionOfficialJournal" Year="2015" URI="https://webarchive.nationalarchives.gov.uk/eu-exit/https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2015.072.01.0053.01.ENG" Date="2015-03-17">OJ L 72, 17.3.2015, p. 53</Citation>).</Text>
            </Para>
         </FootnoteText>
      </Footnote><Footnote id="f00004">
         <FootnoteText>
            <Para>
               <Text>Commission Decision (EU, Euratom) 2015/443 of 13 March 2015 on Security in the Commission (<Citation id="c00003" Class="EuropeanUnionOfficialJournal" Year="2015" URI="https://webarchive.nationalarchives.gov.uk/eu-exit/https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2015.072.01.0041.01.ENG" Date="2015-03-17">OJ L 72, 17.3.2015, p. 41</Citation>).</Text>
            </Para>
         </FootnoteText>
      </Footnote></Footnotes></Legislation>