# Official Journal L 93/2018

| | ISSN 1977-0677 |
| --- | --- |
| Official Journal
  of the European Union | L 93 |
| | |
| English edition | Legislation | Volume 6111 April 2018 |

ISSN 1977-0677

Official Journal

of the European Union

L 93

English edition

Legislation

Volume 6111 April 2018

---

| Contents | | II   Non-legislative acts | page |
| --- | --- | --- | --- |
| | | REGULATIONS |
| | * | Commission Implementing Regulation (EU) 2018/557 of 9 April 2018 amending Implementing Regulation (EU) No 641/2014 as regards notification on the increase of the single area payment scheme ceiling as referred to in Article 36(4) of Regulation (EU) No 1307/2013 of the European Parliament and of the Council | 1 |
| | | DECISIONS |
| | * | Political and Security Committee Decision (CFSP) 2018/558 of 20 March 2018 extending the mandate of the Head of the European Union Integrated Border Management Assistance Mission in Libya (EUBAM Libya) (EUBAM Libya/1/2018) | 3 |
| | * | Commission Decision (EU, Euratom) 2018/559 of 6 April 2018 laying down implementing rules for Article 6 of Decision (EU, Euratom) 2017/46 on the security of communication and information systems in the European Commission | 4 |
| | * | Commission Implementing Decision (EU) 2018/560 of 10 April 2018 amending the Annex to Implementing Decision (EU) 2017/247 on protective measures in relation to outbreaks of highly pathogenic avian influenza in certain Member States
  (notified under document C(2018) 2191)

   (
  1
  ) | 11 |

Contents

II   Non-legislative acts

page

REGULATIONS

*

Commission Implementing Regulation (EU) 2018/557 of 9 April 2018 amending Implementing Regulation (EU) No 641/2014 as regards notification on the increase of the single area payment scheme ceiling as referred to in Article 36(4) of Regulation (EU) No 1307/2013 of the European Parliament and of the Council

1

DECISIONS

*

Political and Security Committee Decision (CFSP) 2018/558 of 20 March 2018 extending the mandate of the Head of the European Union Integrated Border Management Assistance Mission in Libya (EUBAM Libya) (EUBAM Libya/1/2018)

3

*

Commission Decision (EU, Euratom) 2018/559 of 6 April 2018 laying down implementing rules for Article 6 of Decision (EU, Euratom) 2017/46 on the security of communication and information systems in the European Commission

4

*

Commission Implementing Decision (EU) 2018/560 of 10 April 2018 amending the Annex to Implementing Decision (EU) 2017/247 on protective measures in relation to outbreaks of highly pathogenic avian influenza in certain Member States
  (notified under document C(2018) 2191)

   (
  1
  )

(notified under document C(2018) 2191)

1

11

| | |
| --- | --- |
| | (1)   Text with EEA relevance. |

---

(1)   Text with EEA relevance.

1

| EN | Acts whose titles are printed in light type are those relating to day-to-day management of agricultural matters, and are generally valid for a limited period.
  The titles of all other Acts are printed in bold type and preceded by an asterisk. |
| --- | --- |

EN

Acts whose titles are printed in light type are those relating to day-to-day management of agricultural matters, and are generally valid for a limited period.

The titles of all other Acts are printed in bold type and preceded by an asterisk.

---

II Non-legislative acts

REGULATIONS

| 11.4.2018 | EN | Official Journal of the European Union | L 93/1 |
| --- | --- | --- | --- |

11.4.2018

EN

Official Journal of the European Union

L 93/1

---

COMMISSION IMPLEMENTING REGULATION (EU) 2018/557

of 9 April 2018

amending Implementing Regulation (EU) No 641/2014 as regards notification on the increase of the single area payment scheme ceiling as referred to in Article 36(4) of Regulation (EU) No 1307/2013 of the European Parliament and of the Council

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 1307/2013 of the European Parliament and of the Council of 17 December 2013 establishing rules for direct payments to farmers under support schemes within the framework of the common agricultural policy and repealing Council Regulation (EC) No 637/2008 and Council Regulation (EC) No 73/2009 (1), and in particular Article 36(4) thereof,

Whereas:

| (1) | Commission Implementing Regulation (EU) No 641/2014 (2) lays down rules for the application of Regulation (EU) No 1307/2013 establishing rules for direct payments to farmers under support schemes within the framework of the common agricultural policy. |
| --- | --- |

(1)

Commission Implementing Regulation (EU) No 641/2014 (2) lays down rules for the application of Regulation (EU) No 1307/2013 establishing rules for direct payments to farmers under support schemes within the framework of the common agricultural policy.

| (2) | Regulation (EU) No 1307/2013 was amended by Regulation (EU) 2017/2393 of the European Parliament and of the Council (3), which among other added in Article 36(4) of Regulation (EU) No 1307/2013 the possibility for Member States applying the single area payment scheme to increase their single area payment scheme ceiling. |
| --- | --- |

(2)

Regulation (EU) No 1307/2013 was amended by Regulation (EU) 2017/2393 of the European Parliament and of the Council (3), which among other added in Article 36(4) of Regulation (EU) No 1307/2013 the possibility for Member States applying the single area payment scheme to increase their single area payment scheme ceiling.

| (3) | In the light of the changes made in Article 36(4) of Regulation (EU) No 1307/2013, it is necessary to lay down rules on the notification of the increase of the single area payment scheme ceiling. |
| --- | --- |

(3)

In the light of the changes made in Article 36(4) of Regulation (EU) No 1307/2013, it is necessary to lay down rules on the notification of the increase of the single area payment scheme ceiling.

| (4) | Implementing Regulation (EU) No 641/2014 should therefore be amended accordingly. |
| --- | --- |

(4)

Implementing Regulation (EU) No 641/2014 should therefore be amended accordingly.

| (5) | The measures provided for in this Regulation are in accordance with the opinion of the Committee for Direct Payments, |
| --- | --- |

(5)

The measures provided for in this Regulation are in accordance with the opinion of the Committee for Direct Payments,

HAS ADOPTED THIS REGULATION:

Article 1

Amendment of Implementing Regulation (EU) No 641/2014

In Implementing Regulation (EU) No 641/2014 the following Article 16a is inserted:

‘Article 16a

Notification on the increase of the single area payment scheme ceiling as referred to in Article 36(4) of Regulation (EU) No 1307/2013

Where a Member State notifies the Commission of its decisions pursuant to Article 36(4) of Regulation (EU) No 1307/2013, the information to be submitted to the Commission shall consist in percentages of the annual national ceilings set out in Annex II to that Regulation after deduction of the amount resulting from the application of Article 47(1) of that Regulation for each calendar year from 2018 until 2020.’.

Article 2

Entry into force

This Regulation shall enter into force on the seventh day following that of its publication in the Official Journal of the European Union.

Official Journal of the European Union

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 9 April 2018.

For the Commission

The President

Jean-Claude JUNCKER

---

(1)  
  OJ L 347, 20.12.2013, p. 608.

1

(2)  Commission Implementing Regulation (EU) No 641/2014 of 16 June 2014 laying down rules for the application of Regulation (EU) No 1307/2013 of the European Parliament and of the Council establishing rules for direct payments to farmers under support schemes within the framework of the common agricultural policy (OJ L 181, 20.6.2014, p. 74).

2

(3)  Regulation (EU) 2017/2393 of the European Parliament and of the Council of 13 December 2017 amending Regulations (EU) No 1305/2013 on support for rural development by the European Agricultural Fund for Rural Development (EAFRD), (EU) No 1306/2013 on the financing, management and monitoring of the common agricultural policy, (EU) No 1307/2013 establishing rules for direct payments to farmers under support schemes within the framework of the common agricultural policy, (EU) No 1308/2013 establishing a common organisation of the markets in agricultural products and (EU) No 652/2014 laying down provisions for the management of expenditure relating to the food chain, animal health and animal welfare, and relating to plant health and plant reproductive material (OJ L 350, 29.12.2017, p. 15).

3

---

DECISIONS

| 11.4.2018 | EN | Official Journal of the European Union | L 93/3 |
| --- | --- | --- | --- |

11.4.2018

EN

Official Journal of the European Union

L 93/3

---

POLITICAL AND SECURITY COMMITTEE DECISION (CFSP) 2018/558

of 20 March 2018

extending the mandate of the Head of the European Union Integrated Border Management Assistance Mission in Libya (EUBAM Libya) (EUBAM Libya/1/2018)

THE POLITICAL AND SECURITY COMMITTEE,

Having regard to the Treaty on European Union, and in particular the third paragraph of Article 38 thereof,

Having regard to Council Decision 2013/233/CFSP of 22 May 2013 on the European Union Integrated Border Management Assistance Mission in Libya (EUBAM Libya) (1), and in particular Article 9(1) thereof,

Having regard to the proposal from the High Representative of the Union for Foreign Affairs and Security Policy,

Whereas:

| (1) | Pursuant to Article 9(1) of Decision 2013/233/CFSP, the Political and Security Committee (PSC) is authorised, in accordance with Article 38 of the Treaty, to take the relevant decisions for the purpose of exercising the political control and strategic direction of the European Union Integrated Border Management Assistance Mission in Libya (EUBAM Libya), including the decision to appoint a Head of Mission. |
| --- | --- |

(1)

Pursuant to Article 9(1) of Decision 2013/233/CFSP, the Political and Security Committee (PSC) is authorised, in accordance with Article 38 of the Treaty, to take the relevant decisions for the purpose of exercising the political control and strategic direction of the European Union Integrated Border Management Assistance Mission in Libya (EUBAM Libya), including the decision to appoint a Head of Mission.

| (2) | On 18 July 2017, the PSC adopted Decision (CFSP) 2017/1401 (2), extending the mandate of Mr Vincenzo TAGLIAFERRI as Head of Mission of EUBAM Libya from 22 August 2017 to 21 August 2018. |
| --- | --- |

(2)

On 18 July 2017, the PSC adopted Decision (CFSP) 2017/1401 (2), extending the mandate of Mr Vincenzo TAGLIAFERRI as Head of Mission of EUBAM Libya from 22 August 2017 to 21 August 2018.

| (3) | On 17 July 2017, the Council adopted Decision (CFSP) 2017/1342 (3), amending Decision 2013/233/CFSP and extending the application of that Decision until 31 December 2018. |
| --- | --- |

(3)

On 17 July 2017, the Council adopted Decision (CFSP) 2017/1342 (3), amending Decision 2013/233/CFSP and extending the application of that Decision until 31 December 2018.

| (4) | On 26 February 2018, the High Representative of the Union for Foreign Affairs and Security Policy proposed to extend the mandate of Mr Vincenzo TAGLIAFERRI as Head of Mission of EUBAM Libya from 22 August 2018 to 31 December 2018, |
| --- | --- |

(4)

On 26 February 2018, the High Representative of the Union for Foreign Affairs and Security Policy proposed to extend the mandate of Mr Vincenzo TAGLIAFERRI as Head of Mission of EUBAM Libya from 22 August 2018 to 31 December 2018,

HAS ADOPTED THIS DECISION:

Article 1

The mandate of Mr Vincenzo TAGLIAFERRI as Head of Mission of EUBAM Libya is hereby extended from 22 August 2018 to 31 December 2018.

Article 2

This Decision shall enter into force on 21 August 2018.

Done at Brussels, 20 March 2018.

For the Political and Security Committee

The Chairperson

W. STEVENS

---

(1)  
  OJ L 138, 24.5.2013, p. 15.

1

(2)  Political and Security Committee Decision (CFSP) 2017/1401 of 18 July 2017 extending the mandate of the Head of Mission of the European Union Integrated Border Management Assistance Mission in Libya (EUBAM Libya) (EUBAM Libya/1/2017) (OJ L 199, 29.7.2017, p. 13).

2

(3)  Council Decision (CFSP) 2017/1342 of 17 July 2017 amending and extending Decision 2013/233/CFSP on the European Union Integrated Border Assistance Mission for Libya (EUBAM Libya) (OJ L 185, 18.7.2017, p. 60).

3

---

| 11.4.2018 | EN | Official Journal of the European Union | L 93/4 |
| --- | --- | --- | --- |

11.4.2018

EN

Official Journal of the European Union

L 93/4

---

COMMISSION DECISION (EU, Euratom) 2018/559

of 6 April 2018

laying down implementing rules for Article 6 of Decision (EU, Euratom) 2017/46 on the security of communication and information systems in the European Commission

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249 thereof,

Having regard to the Treaty establishing the European Atomic Energy Community,

Having regard to Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission (1), and in particular Article 6 thereof,

Whereas:

| (1) | With the adoption of Decision (EU, Euratom) 2017/46, there is a need for the Commission to review, update and consolidate the implementing rules linked to the repealed Commission Decision C(2006) 3602 on the security of communication and information systems used by the Commission. |
| --- | --- |

(1)

With the adoption of Decision (EU, Euratom) 2017/46, there is a need for the Commission to review, update and consolidate the implementing rules linked to the repealed Commission Decision C(2006) 3602 on the security of communication and information systems used by the Commission.

| (2) | The member of the Commission responsible for security, in full compliance with the internal rules of procedures, has been empowered to establish implementing rules in line with Article 13 of Decision (EU, Euratom) 2017/46 (2). |
| --- | --- |

(2)

The member of the Commission responsible for security, in full compliance with the internal rules of procedures, has been empowered to establish implementing rules in line with Article 13 of Decision (EU, Euratom) 2017/46 (2).

| (3) | The implementing rules of Decision C(2006) 3602 should therefore be repealed, |
| --- | --- |

(3)

The implementing rules of Decision C(2006) 3602 should therefore be repealed,

HAS ADOPTED THIS DECISION:

CHAPTER 1

GENERAL PROVISIONS

Article 1

Subject matter and scope

1.   The subject matter and scope of this Decision are provided in Article 1 of Decision (EU, Euratom) 2017/46.

2.   The provisions in this Decision apply to all communication and information systems (CISs). However, the responsibilities defined in this Decision shall not apply to CISs handling EU classified information. The relevant responsibilities for these systems shall be determined by the system owner and the Commission Security Authority in line with Commission Decision (EU, Euratom) 2015/444 (3).

3.   Chapter 2 of this Decision presents an overview of the practical implementation of the organisation and responsibilities relating to IT security. Chapter 3 of this Decision presents an overview of the processes relating to Article 6 of Decision (EU, Euratom) 2017/46.

Article 2

Definitions

The definitions in Article 2 of Decision (EU, Euratom) 2017/46 apply to this Decision. For the purposes of this Decision the following definitions shall also apply:

| 1. | ‘Crypto Approval Authority’ (CAA) is a function assumed by the Commission Security Authority that falls under the authority of the Director-General for Human Resources and Security; |
| --- | --- |

1.

‘Crypto Approval Authority’ (CAA) is a function assumed by the Commission Security Authority that falls under the authority of the Director-General for Human Resources and Security;

| 2. | ‘External network connection’ means any electronic communications connection between the Commission's internal network and any other network, including the internet. This definition excludes third party networks that are provided under contract to be part of the Commission's internal network. |
| --- | --- |

2.

‘External network connection’ means any electronic communications connection between the Commission's internal network and any other network, including the internet. This definition excludes third party networks that are provided under contract to be part of the Commission's internal network.

| 3. | ‘Key escrow’ means a procedure for storing copies of cryptographic keys with one or more separate parties, ensuring the segregation of duties, to enable their recovery in case the operational copy is lost. Keys may be split into two or more parts, each of which is lodged with a different party to ensure that no single party possesses the entire key. |
| --- | --- |

3.

‘Key escrow’ means a procedure for storing copies of cryptographic keys with one or more separate parties, ensuring the segregation of duties, to enable their recovery in case the operational copy is lost. Keys may be split into two or more parts, each of which is lodged with a different party to ensure that no single party possesses the entire key.

| 4. | ‘RASCI’ is an abbreviation for a responsibility assignment based on the following attribution indicators:






  (a) | ‘responsible’ (R) means having the obligation to act and take decisions to achieve required outcomes; |
| --- | --- | --- |

4.

‘RASCI’ is an abbreviation for a responsibility assignment based on the following attribution indicators:

(a)

‘responsible’ (R) means having the obligation to act and take decisions to achieve required outcomes;

| (b) | ‘accountable’ (A) means being answerable for actions, decisions and performance; |
| --- | --- |

(b)

‘accountable’ (A) means being answerable for actions, decisions and performance;

| (c) | ‘supports’ (S) means having the obligation to work with the person responsible to complete the task; |
| --- | --- |

(c)

‘supports’ (S) means having the obligation to work with the person responsible to complete the task;

| (d) | ‘consulted’ (C) means being sought for advice or opinion; |
| --- | --- |

(d)

‘consulted’ (C) means being sought for advice or opinion;

| (e) | ‘informed’ (I) means being kept up to date with relevant information. |
| --- | --- |

(e)

‘informed’ (I) means being kept up to date with relevant information.

CHAPTER 2

ORGANISATION AND RESPONSIBILITIES

Article 3

Roles and responsibilities

The roles and responsibilities relating to Articles 4 to 8 of this Decision are defined in the Annex in accordance with the RASCI model.

Article 4

Alignment with the Commission's information security policy

1.   The Directorate-General for Human Resources and Security shall review the Commission's IT security policy and related standards and guidelines to ensure that they are in line with the Commission's general security policies, in particular Commission Decision (EU, Euratom) 2015/443 (4) and Decision (EU, Euratom) 2015/444.

2.   Upon request by other Commission departments, the Directorate-General for Human Resources and Security may review their IT security policies or other IT security documentation to ensure their consistency with the Commission's information security policy. The head of the Commission department concerned shall ensure that any inconsistencies are addressed.

3.   Under its responsibility for the security of information, the Directorate-General for Human Resources and Security shall cooperate with the Directorate-General for Informatics to ensure that the IT security processes take full account of the classification and principles of security laid down in Decision (EU, Euratom) 2015/443, in particular Articles 3 and 9.

CHAPTER 3

IT SECURITY PROCESSES

Article 5

Encrypting technologies

1.   The use of encrypting technologies for the protection of EU classified information (EUCI) shall comply with Decision (EU, Euratom) 2015/444.

2.   The decisions on the use of encrypting technologies for the protection of non-EUCI data shall be taken by the system owner of each CIS, taking into account both the risks that are intended to be mitigated through encryption and the risks that it introduces.

3.   Prior approval from the CAA is required for all uses of encrypting technologies, unless the encryption is used only to protect the confidentiality of non-EUCI data in transit and uses standard network communications protocols.

4.   With the exception noted in paragraph 3 of this Article, Commission departments shall ensure that back-ups of any decryption keys are stored in key escrow for the purpose of recovering stored data in the event that the decryption key is not available. The recovery of encrypted data using back-ups of decryption keys shall be carried out only when authorised in line with the standard defined by the CAA.

5.   Requests for approval for the use of encrypting technologies shall be formally documented and shall include details of the CIS and data to be protected, the technologies to be used and the related security operating procedures. These requests for approval shall be signed by the system owner.

6.   Requests for approval for the use of encrypting technologies shall be evaluated by the CAA in line with the published standards and requirements.

Article 6

IT security inspections

1.   The Directorate-General for Human Resources and Security shall undertake IT security inspections in order to verify whether IT security measures comply with the Commission's IT security policies and to check the integrity of these control measures.

2.   The Directorate-General for Human Resources and Security may perform an IT security inspection:

| (a) | on its own initiative; |
| --- | --- |

(a)

on its own initiative;

| (b) | on request from the Information Security Steering Board (ISSB); |
| --- | --- |

(b)

on request from the Information Security Steering Board (ISSB);

| (c) | on a request received from a system owner; |
| --- | --- |

(c)

on a request received from a system owner;

| (d) | further to a security incident; or |
| --- | --- |

(d)

further to a security incident; or

| (e) | further to the identification of a high risk to a particular system. |
| --- | --- |

(e)

further to the identification of a high risk to a particular system.

3.   Data owners may request an IT security inspection before storing their information in a CIS.

4.   The results of an inspection shall be documented in a formal report to the system owner, and copied to the LISO, that includes findings and recommendations for improving the CIS's compliance with the IT security policy. The Directorate-General for Human Resources and Security shall report significant issues and recommendations to the ISSB.

5.   The Directorate-General for Human Resources and Security shall monitor the implementation of the recommendations.

6.   Where appropriate, IT security inspections shall include the inspection of services, premises and equipment provided to the system owner, including both internal and external service providers.

Article 7

Access from external networks

1.   The Directorate-General for Human Resources and Security shall lay down the rules in a standard on authorising access between Commission CISs and external networks.

2.   The rules shall distinguish different types of external network connections and lay down appropriate security rules for each type of connection, including whether a prior authorisation for the connection is required from the relevant authority as noted in paragraph 4 of this Article.

3.   If required, authorisation shall be granted on the basis of a formal request and approval process. The approval shall be valid for a specified duration and shall be obtained before the connection is activated.

4.   The Directorate-General for Human Resources and Security shall have the overall responsibility for authorising requests, but may delegate the responsibility for authorising some types of connection at its own discretion in line with Article 17(3) of Decision (EU, Euratom) 2015/443 and subject to the conditions laid down under (8).

5.   The authorising entity may impose additional security requirements as a prerequisite for approval, in order to protect the Commission's CIS and networks from the risks of unauthorised access or other security breaches.

6.   The Directorate-General for Informatics is the standard provider of network services for the Commission. Any other Commission department operating a network that is not provided by the Directorate-General for Informatics shall first obtain the agreement of the ISSB. The Commission department shall document the business justification for the request and demonstrate that the network controls are sufficient to meet the requirements for controlling incoming and outgoing flows of information.

7.   The system owner of a CIS shall determine the security requirements for external access to that CIS and shall ensure the implementation of appropriate measures to protect its security, with the support of the LISO.

8.   The security measures implemented for external network connections shall be based on the principles of need-to-know and least privilege, which ensure that individuals only receive the information and access rights that they need to perform their official duties for the Commission.

9.   All external network connections shall be filtered and monitored to detect potential security breaches.

10.   Where connections are established to allow the outsourcing of a CIS, the authorisation shall be conditional on the successful completion of the procedure described in Article 8.

Article 8

Outsourcing of CISs

1.   For the purposes of this Decision, a CIS is considered to be outsourced when it is provided on the basis of a contract with a third party contractor, under which the CIS is housed on non-Commission premises. This includes the outsourcing of individual or multiple CISs or other IT services, data centres on non-Commission premises, and the handling of Commission data sets by external services.

2.   The outsourcing of a CIS shall take into account the sensitivity or classification of the information handled as follows:

| (a) | CISs handling EUCI shall be accredited in accordance with Decision (EU, Euratom) 2015/444, and the Commission Security Accreditation Authority (SAA) shall be consulted in advance. Systems handling EUCI shall not be outsourced. |
| --- | --- |

(a)

CISs handling EUCI shall be accredited in accordance with Decision (EU, Euratom) 2015/444, and the Commission Security Accreditation Authority (SAA) shall be consulted in advance. Systems handling EUCI shall not be outsourced.

| (b) | The system owner of a CIS handling non-EUCI information shall implement proportionate measures to address the security needs in line with the relevant legal obligations or the sensitivity of the information, taking into account the risks of outsourcing. The Directorate-General for Human Resources and Security may impose additional requirements. |
| --- | --- |

(b)

The system owner of a CIS handling non-EUCI information shall implement proportionate measures to address the security needs in line with the relevant legal obligations or the sensitivity of the information, taking into account the risks of outsourcing. The Directorate-General for Human Resources and Security may impose additional requirements.

| (c) | Outsourced development projects shall take into account the sensitivity of the developed code and any test data used during development. |
| --- | --- |

(c)

Outsourced development projects shall take into account the sensitivity of the developed code and any test data used during development.

3.   The following principles shall apply to outsourced CIS in addition to those laid down in Article 3 of Decision (EU, Euratom) 2017/46:

| (a) | outsourcing arrangements shall be designed to avoid dependency on specific suppliers; |
| --- | --- |

(a)

outsourcing arrangements shall be designed to avoid dependency on specific suppliers;

| (b) | outsourcing security arrangements shall minimise the possibilities for third party staff to access or modify Commission information; |
| --- | --- |

(b)

outsourcing security arrangements shall minimise the possibilities for third party staff to access or modify Commission information;

| (c) | third party staff that have access to an outsourced CIS shall provide confidentiality agreements; |
| --- | --- |

(c)

third party staff that have access to an outsourced CIS shall provide confidentiality agreements;

| (d) | the outsourcing of a CIS shall be indicated in the inventory of CISs. |
| --- | --- |

(d)

the outsourcing of a CIS shall be indicated in the inventory of CISs.

4.   The system owner with the participation of the data owner shall:

| (a) | assess and document the risks relating to outsourcing; |
| --- | --- |

(a)

assess and document the risks relating to outsourcing;

| (b) | lay down relevant security requirements; |
| --- | --- |

(b)

lay down relevant security requirements;

| (c) | consult with the system owners of all other connected CISs to ensure that their security requirements are included; |
| --- | --- |

(c)

consult with the system owners of all other connected CISs to ensure that their security requirements are included;

| (d) | ensure that appropriate security requirements and rights are included in the outsourcing contract; |
| --- | --- |

(d)

ensure that appropriate security requirements and rights are included in the outsourcing contract;

| (e) | fulfil any other requirements laid down in the detailed procedure as noted in paragraph 8 of this Article. |
| --- | --- |

(e)

fulfil any other requirements laid down in the detailed procedure as noted in paragraph 8 of this Article.

These actions shall be completed before the contract or other agreement is signed for the outsourcing of one or more CISs.

5.   System owners shall manage the risks relating to outsourcing during the lifetime of the CIS in order to meet the defined security requirements.

6.   System owners shall ensure that third party contractors are obliged to immediately notify the Commission of all IT security incidents affecting an outsourced Commission CIS.

7.   The system owner is responsible for ensuring the compliance of the CIS, the outsourcing contract and the security arrangements with the Commission's rules on information security and IT security.

8.   The Directorate-General for Human Resources and Security shall lay down the detailed standard related to the responsibilities and activities set out in points (1) to (7) in accordance with Article 10 below.

CHAPTER 4

MISCELLANEOUS AND FINAL PROVISIONS

Article 9

Transparency

This Decision shall be brought to the attention of Commission staff and to all individuals to whom it applies, and published in the Official Journal of the European Union.

Official Journal of the European Union

Article 10

Standards

1.   The provisions of this Decision shall, where necessary, be further detailed in standards and/or guidelines to be adopted in line with Decision (EU, Euratom) 2017/46 and with Decision C(2017) 7428. IT security standards and guidelines shall provide further details on these implementing rules and Decision (EU, Euratom) 2017/46 for specific security domains according to ISO 27001:2013 Annex A. These standards and guidelines are based on industry best practices and are selected to suit the Commission's IT environment.

2.   Standards shall, where necessary, be developed according to ISO 27001:2013 Annex A in the following domains:

| (1) | organisation of information security; |
| --- | --- |

(1)

organisation of information security;

| (2) | human resources security; |
| --- | --- |

(2)

human resources security;

| (3) | asset management; |
| --- | --- |

(3)

asset management;

| (4) | access control; |
| --- | --- |

(4)

access control;

| (5) | cryptography; |
| --- | --- |

(5)

cryptography;

| (6) | physical and environmental security; |
| --- | --- |

(6)

physical and environmental security;

| (7) | operational security; |
| --- | --- |

(7)

operational security;

| (8) | communications security; |
| --- | --- |

(8)

communications security;

| (9) | system acquisition, development and maintenance; |
| --- | --- |

(9)

system acquisition, development and maintenance;

| (10) | supplier relationships; |
| --- | --- |

(10)

supplier relationships;

| (11) | information security incident management; |
| --- | --- |

(11)

information security incident management;

| (12) | information security aspects of business continuity management; |
| --- | --- |

(12)

information security aspects of business continuity management;

| (13) | compliance. |
| --- | --- |

(13)

compliance.

3.   The ISSB shall approve the standards mentioned under paragraph 1 and 2 of this Article before their adoption.

4.   The implementing rules to Decision C(2006) 3602 related to the scope of this Decision are hereby repealed.

5.   The standards and guidelines adopted under Decision C(2006) 3602 of 16 August 2006 shall remain in effect, insofar as they do not conflict with these implementing rules, until they are repealed or replaced by standards or guidelines to be adopted under Article 13 of Decision (EU, Euratom) 2017/46.

Article 11

Entry into force

This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Official Journal of the European Union

Done at Brussels, 6 April 2018.

For the Commission,

On behalf of the President,

Günther OETTINGER

Member of the Commission

---

(1)  
  OJ L 6, 11.1.2017, p. 40.

1

(2)  Commission Decision C(2017) 7428 final of 8 November 2017 granting an empowerment to adopt implementing rules, standards and guidelines relating to the security of communication and information systems in the European Commission.

2

(3)  Commission Decision (EU, Euratom) 2015/444 of 13 March 2015 on the security rules for protecting EU classified information (OJ L 72, 17.3.2015, p. 53).

3

(4)  Commission Decision (EU, Euratom) 2015/443 of 13 March 2015 on Security in the Commission (OJ L 72, 17.3.2015, p. 41).

4

---

ANNEX

ROLES AND RESPONSIBILITIES (RASCI)

The RASCI model assigns roles to entities using the following abbreviations:

(a)   R— Responsible;

(b)   A— Accountable;

(c)   S— Supporting;

(d)   C— Consulted;

(e)   I— Informed.

| Role
  Process | ISSB | HR (DS) | Commission Departments | System Owner | Data Owner | LISO | DIGIT | Contractors |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Alignment with the Commission's information security policy | | R/A | S | | | | S | |
| Encrypting technologies | | C | A | R | I | C | | |
| IT Security Inspections | I | A/R | | S | I | I | S | |
| Access from external networks | C
   (1) | C | A | R | I | S | S | |
| Outsourcing of CISs | | S/C | A | R/C
   (2) | S | C | | S |

Role

Process

ISSB

HR (DS)

Commission Departments

System Owner

Data Owner

LISO

DIGIT

Contractors

Alignment with the Commission's information security policy

R/A

S

S

Encrypting technologies

C

A

R

I

C

IT Security Inspections

I

A/R

S

I

I

S

Access from external networks

C
   (1)

C

A

R

I

S

S

Outsourcing of CISs

S/C

A

R/C
   (2)

S

C

S

---

(1)  The ISSB is consulted in relation to the operation of internal networks by any Commission department other than the Directorate-General for Informatics.

(2)  The system owner of a CIS being outsourced shall be responsible, and the system owner of any other CIS with which an outsourced CIS interconnects shall be consulted.

---

| 11.4.2018 | EN | Official Journal of the European Union | L 93/11 |
| --- | --- | --- | --- |

11.4.2018

EN

Official Journal of the European Union

L 93/11

---

COMMISSION IMPLEMENTING DECISION (EU) 2018/560

of 10 April 2018

amending the Annex to Implementing Decision (EU) 2017/247 on protective measures in relation to outbreaks of highly pathogenic avian influenza in certain Member States

(notified under document C(2018) 2191)

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Council Directive 89/662/EEC of 11 December 1989 concerning veterinary checks in intra-Community trade with a view to the completion of the internal market (1), and in particular Article 9(4) thereof,

Having regard to Council Directive 90/425/EEC of 26 June 1990 concerning veterinary and zootechnical checks applicable in intra-Community trade in certain live animals and products with a view to the completion of the internal market (2), and in particular Article 10(4) thereof,

Whereas:

| (1) | Commission Implementing Decision (EU) 2017/247 (3) was adopted following outbreaks of highly pathogenic avian influenza of subtype H5 in a number of Member States (‘the concerned Member States’), and the establishment of protection and surveillance zones by the competent authority of the concerned Member States in accordance with Article 16(1) of Council Directive 2005/94/EC (4). |
| --- | --- |

(1)

Commission Implementing Decision (EU) 2017/247 (3) was adopted following outbreaks of highly pathogenic avian influenza of subtype H5 in a number of Member States (‘the concerned Member States’), and the establishment of protection and surveillance zones by the competent authority of the concerned Member States in accordance with Article 16(1) of Council Directive 2005/94/EC (4).

| (2) | Implementing Decision (EU) 2017/247 provides that the protection and surveillance zones established by the competent authorities of the concerned Member States in accordance with Directive 2005/94/EC are to comprise at least the areas listed as protection and surveillance zones in the Annex to that Implementing Decision. Implementing Decision (EU) 2017/247 also lays down that the measures to be applied in the protection and surveillance zones, as provided for in Article 29(1) and Article 31 of Directive 2005/94/EC, are to be maintained until at least the dates for those zones set out in the Annex to that Implementing Decision. |
| --- | --- |

(2)

Implementing Decision (EU) 2017/247 provides that the protection and surveillance zones established by the competent authorities of the concerned Member States in accordance with Directive 2005/94/EC are to comprise at least the areas listed as protection and surveillance zones in the Annex to that Implementing Decision. Implementing Decision (EU) 2017/247 also lays down that the measures to be applied in the protection and surveillance zones, as provided for in Article 29(1) and Article 31 of Directive 2005/94/EC, are to be maintained until at least the dates for those zones set out in the Annex to that Implementing Decision.

| (3) | Since the date of its adoption, Implementing Decision (EU) 2017/247 has been amended several times to take account of developments in the epidemiological situation in the Union as regards avian influenza. In particular, Implementing Decision (EU) 2017/247 was amended by Commission Implementing Decision (EU) 2017/696 (5) in order to lay down rules regarding the dispatch of consignments of day-old chicks from the areas listed in the Annex to Implementing Decision (EU) 2017/247. That amendment took into account the fact that day-old chicks pose a very low risk for the spread of highly pathogenic avian influenza compared to other poultry commodities. |
| --- | --- |

(3)

Since the date of its adoption, Implementing Decision (EU) 2017/247 has been amended several times to take account of developments in the epidemiological situation in the Union as regards avian influenza. In particular, Implementing Decision (EU) 2017/247 was amended by Commission Implementing Decision (EU) 2017/696 (5) in order to lay down rules regarding the dispatch of consignments of day-old chicks from the areas listed in the Annex to Implementing Decision (EU) 2017/247. That amendment took into account the fact that day-old chicks pose a very low risk for the spread of highly pathogenic avian influenza compared to other poultry commodities.

| (4) | Implementing Decision (EU) 2017/247 was also subsequently amended by Commission Implementing Decision (EU) 2017/1841 (6) in order to strengthen the disease control measures applicable where there is an increased risk for the spread of highly pathogenic avian influenza. Consequently, Implementing Decision (EU) 2017/247 now provides for the establishment at Union level of further restricted zones in the concerned Member States, as referred to in Article 16(4) of Directive 2005/94/EC, following an outbreak or outbreaks of highly pathogenic avian influenza, and the duration of the measures to be applied therein. Implementing Decision (EU) 2017/247 now also lays down rules for the dispatch of live poultry, day-old chicks and hatching eggs from the further restricted zones to other Member States, subject to certain conditions. |
| --- | --- |

(4)

Implementing Decision (EU) 2017/247 was also subsequently amended by Commission Implementing Decision (EU) 2017/1841 (6) in order to strengthen the disease control measures applicable where there is an increased risk for the spread of highly pathogenic avian influenza. Consequently, Implementing Decision (EU) 2017/247 now provides for the establishment at Union level of further restricted zones in the concerned Member States, as referred to in Article 16(4) of Directive 2005/94/EC, following an outbreak or outbreaks of highly pathogenic avian influenza, and the duration of the measures to be applied therein. Implementing Decision (EU) 2017/247 now also lays down rules for the dispatch of live poultry, day-old chicks and hatching eggs from the further restricted zones to other Member States, subject to certain conditions.

| (5) | In addition, the Annex to Implementing Decision (EU) 2017/247 has been amended numerous times, mainly to take account of changes in the boundaries of the protection and surveillance zones established by the concerned Member States in accordance with Directive 2005/94/EC. |
| --- | --- |

(5)

In addition, the Annex to Implementing Decision (EU) 2017/247 has been amended numerous times, mainly to take account of changes in the boundaries of the protection and surveillance zones established by the concerned Member States in accordance with Directive 2005/94/EC.

| (6) | The Annex to Implementing Decision (EU) 2017/247 was last amended by Commission Implementing Decision (EU) 2018/510 (7), following the notification by Germany of a new outbreak of highly pathogenic avian influenza of subtype H5N6 in a poultry holding in Nordfriesland in the Land of Schleswig-Holstein in that Member State. Germany also notified the Commission that it had duly taken the necessary measures required in accordance with Directive 2005/94/EC following that outbreak, including the establishment of protection and surveillance zones around the infected poultry holding. |
| --- | --- |

(6)

The Annex to Implementing Decision (EU) 2017/247 was last amended by Commission Implementing Decision (EU) 2018/510 (7), following the notification by Germany of a new outbreak of highly pathogenic avian influenza of subtype H5N6 in a poultry holding in Nordfriesland in the Land of Schleswig-Holstein in that Member State. Germany also notified the Commission that it had duly taken the necessary measures required in accordance with Directive 2005/94/EC following that outbreak, including the establishment of protection and surveillance zones around the infected poultry holding.

| (7) | Since the date of the last amendment made to Implementing Decision (EU) 2017/247 by Implementing Decision (EU) 2018/510, Bulgaria has notified the Commission of a recent outbreak of highly pathogenic avian influenza of subtype H5N8 in a poultry holding in the Yambol region of that Member State. |
| --- | --- |

(7)

Since the date of the last amendment made to Implementing Decision (EU) 2017/247 by Implementing Decision (EU) 2018/510, Bulgaria has notified the Commission of a recent outbreak of highly pathogenic avian influenza of subtype H5N8 in a poultry holding in the Yambol region of that Member State.

| (8) | Bulgaria has also notified the Commission that it has taken the necessary measures required in accordance with Directive 2005/94/EC following that recent outbreak, including the establishment of protection and surveillance zones around the infected poultry holding in that Member State. |
| --- | --- |

(8)

Bulgaria has also notified the Commission that it has taken the necessary measures required in accordance with Directive 2005/94/EC following that recent outbreak, including the establishment of protection and surveillance zones around the infected poultry holding in that Member State.

| (9) | The Commission has examined those measures in collaboration with Bulgaria, and the Commission is satisfied that the boundaries of the protection and surveillance zones, established by the competent authority of Bulgaria, are at a sufficient distance to the poultry holding where the new outbreak was confirmed. |
| --- | --- |

(9)

The Commission has examined those measures in collaboration with Bulgaria, and the Commission is satisfied that the boundaries of the protection and surveillance zones, established by the competent authority of Bulgaria, are at a sufficient distance to the poultry holding where the new outbreak was confirmed.

| (10) | In order to prevent any unnecessary disturbance to trade within the Union, and to avoid unjustified barriers to trade being imposed by third countries, it is necessary to rapidly describe at Union level, in collaboration with Bulgaria, the protection and surveillance zones established in Bulgaria, in accordance with Directive 2005/94/EC, following the recent outbreak of highly pathogenic avian influenza in that Member State. |
| --- | --- |

(10)

In order to prevent any unnecessary disturbance to trade within the Union, and to avoid unjustified barriers to trade being imposed by third countries, it is necessary to rapidly describe at Union level, in collaboration with Bulgaria, the protection and surveillance zones established in Bulgaria, in accordance with Directive 2005/94/EC, following the recent outbreak of highly pathogenic avian influenza in that Member State.

| (11) | Implementing Decision (EU) 2017/247 should therefore be updated to take account of the up-to-date epidemiological situation in Bulgaria, as regards highly pathogenic avian influenza. In particular, the newly established protection and surveillance zones in Bulgaria, now subject to restrictions in accordance with Directive 2005/94/EC, should be listed in the Annex to Implementing Decision (EU) 2017/247. |
| --- | --- |

(11)

Implementing Decision (EU) 2017/247 should therefore be updated to take account of the up-to-date epidemiological situation in Bulgaria, as regards highly pathogenic avian influenza. In particular, the newly established protection and surveillance zones in Bulgaria, now subject to restrictions in accordance with Directive 2005/94/EC, should be listed in the Annex to Implementing Decision (EU) 2017/247.

| (12) | The Annex to Implementing Decision (EU) 2017/247 should therefore be amended to update regionalization at Union level in order to include the protection and surveillance zones established in Bulgaria, in accordance with Directive 2005/94/EC, following the recent outbreak of highly pathogenic avian influenza in that Member State, and the duration of the restrictions applicable therein. |
| --- | --- |

(12)

The Annex to Implementing Decision (EU) 2017/247 should therefore be amended to update regionalization at Union level in order to include the protection and surveillance zones established in Bulgaria, in accordance with Directive 2005/94/EC, following the recent outbreak of highly pathogenic avian influenza in that Member State, and the duration of the restrictions applicable therein.

| (13) | Implementing Decision (EU) 2017/247 should therefore be amended accordingly. |
| --- | --- |

(13)

Implementing Decision (EU) 2017/247 should therefore be amended accordingly.

| (14) | The measures provided for in this Decision are in accordance with the opinion of the Standing Committee on Plants, Animals, Food and Feed, |
| --- | --- |

(14)

The measures provided for in this Decision are in accordance with the opinion of the Standing Committee on Plants, Animals, Food and Feed,

HAS ADOPTED THIS DECISION:

Article 1

The Annex to Implementing Decision (EU) 2017/247 is amended in accordance with the Annex to this Decision.

Article 2

This Decision is addressed to the Member States.

Done at Brussels, 10 April 2018.

For the Commission

Vytenis ANDRIUKAITIS

Member of the Commission

---

(1)  
  OJ L 395, 30.12.1989, p. 13.

1

(2)  
  OJ L 224, 18.8.1990, p. 29.

2

(3)  Commission Implementing Decision (EU) 2017/247 of 9 February 2017 on protective measures in relation to outbreaks of the highly pathogenic avian influenza in certain Member States (OJ L 36, 11.2.2017, p. 62).

3

(4)  Council Directive 2005/94/EC of 20 December 2005 on Community measures for the control of avian influenza and repealing Directive 92/40/EEC (OJ L 10, 14.1.2006, p. 16).

4

(5)  Commission Implementing Decision (EU) 2017/696 of 11 April 2017 amending Implementing Decision (EU) 2017/247 on protective measures in relation to outbreaks of the highly pathogenic avian influenza in certain Member States (OJ L 101, 13.4.2017, p. 80).

5

(6)  Commission Implementing Decision (EU) 2017/1841 of 10 October 2017 amending Implementing Decision (EU) 2017/247 on protective measures in relation to outbreaks of the highly pathogenic avian influenza in certain Member States (OJ L 261, 11.10.2017, p. 26).

6

(7)  Commission Implementing Decision (EU) 2018/510 of 26 March 2018 amending the Annex to Implementing Decision (EU) 2017/247 on protective measures in relation to outbreaks of highly pathogenic avian influenza in certain Member States (OJ L 83, 27.3.2018, p. 16).

7

---

ANNEX

The Annex to Implementing Decision (EU) 2017/247 is amended as follows:

| (1) | in Part A, the entry for Bulgaria is replaced by the following:

  ‘
  Member State: Bulgaria







  Area comprising: | Date until applicable in accordance with Article 29(1) of Directive 2005/94/EC |
| --- | --- | --- |
| Yambol region, Municipality of Straldzha |
| Zimnitsa | 26.4.2018’ |

(1)

in Part A, the entry for Bulgaria is replaced by the following:

‘
  Member State: Bulgaria

Area comprising:

Date until applicable in accordance with Article 29(1) of Directive 2005/94/EC

Yambol region, Municipality of Straldzha

Zimnitsa

26.4.2018’

| (2) | in Part B, the entry for Bulgaria is replaced by the following:

  ‘
  Member State: Bulgaria







  Area comprising: | Date until applicable in accordance with Article 31 of Directive 2005/94/EC |
| --- | --- | --- |
| Yambol region: | |
| Municipality of Straldzha






  — | Zimnitsa |

(2)

in Part B, the entry for Bulgaria is replaced by the following:

‘
  Member State: Bulgaria

Area comprising:

Date until applicable in accordance with Article 31 of Directive 2005/94/EC

Yambol region:

Municipality of Straldzha

—

Zimnitsa

From 27.4.2018 to 6.5.2018

Municipality of Yambol

| — | Yambol |
| --- | --- |

—

Yambol

6.5.2018’

Municipality of Straldzha

| — | Straldzha |
| --- | --- |

—

Straldzha

| — | Vodenichene |
| --- | --- |

—

Vodenichene

| — | Dzhinot |
| --- | --- |

—

Dzhinot

Municipality of Tundzha

| — | Mogila |
| --- | --- |

—

Mogila

| — | Veselinovo |
| --- | --- |

—

Veselinovo

| — | Kabile |
| --- | --- |

—

Kabile

Sliven region:

Municipality of Sliven

| — | Zhelyu Voivoda |
| --- | --- |

—

Zhelyu Voivoda

| — | Blatets |
| --- | --- |

—

Blatets

| — | Dragodanovo |
| --- | --- |

—

Dragodanovo

| — | Gorno Aleksandrovo |
| --- | --- |

—

Gorno Aleksandrovo

---