2001D0264 — EN — 26.06.2007 — 004.001

This document is meant purely as a documentation tool and the institutions do not assume any liability for its contents

►B COUNCIL DECISION of 19 March 2001 adopting the Council's security regulations (2001/264/EC) (OJ L 101, 11.4.2001, p.1)

Amended by:









▼B

COUNCIL DECISION

of 19 March 2001

adopting the Council's security regulations

(2001/264/EC)







THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty establishing the European Community and in particular Article 207(3) thereof, Having regard to Council Decision 2000/396/EC, ECSC, Euratom of 5 June 2000 adopting the Councils Rules of Procedure ( 1 ), and in particular Article 24 thereof, Whereas: (1) In order to develop Council activities in areas which require a degree of confidentiality, it is appropriate to establish a comprehensive security system covering the Council, its General Secretariat and the Member States. (2) Such system should combine in a single text the subject matter covered by all previous decisions and provisions in the same field. (3) In practice, the major part of EU information classified CONFIDENTIEL UE and above will concern the Common Security and Defence Policy. (4) In order to safeguard the effectiveness of the security system thus established, Member States should be associated with its functioning by taking national measures necessary to respect the provisions of this Decision where their competent authorities and servants handle EU classified information. (5) The Council welcomes the intention of the Commission to introduce, by the date of application of this Decision, a comprehensive system that is in line with the Annexes thereto, with a view to ensuring a smooth functioning of the decision-making process of the Union. (6) The Council underlines the importance of associating, where appropriate, the European Parliament and the Commission with the rules and standards of confidentiality which are necessary in order to protect the interests of the Union and its Member States. (7) This Decision is taken without prejudice to Article 255 of the Treaty and to instruments implementing it. (8) This Decision is taken without prejudice to existing practices in Member States with regard to informing their national Parliaments on the activities of the Union, Whereas: HAS DECIDED AS FOLLOWS:







Article 1

The Council's security regulations contained in the Annex are hereby approved.

Article 2

1. The Secretary-General/High Representative shall take appropriate measures to ensure that, when handling EU classified information, the regulations referred to in Article 1 are respected within the General Secretariat of the Council (hereinafter referred to as ‘GSC’) by GSC officials and other servants, by GSC external contractors, and by personnel seconded to the GSC, as well as within Council premises and EU decentralised agencies ( 2 ).

2. Members States shall take appropriate measures, in accordance with national arrangements, to ensure that, when EU classified information is handled, the regulations referred to in Article 1 are respected, within their services and premises by:

(a) members of Member States' permanent representations to the European Union as well as by members of national delegations attending meetings of the Council or of its bodies, or participating in other Council activities;

(b) other members of the Member States' national administrations handling EU classified information, whether they serve in the territory of the Member States or abroad; and

(c) Member States' external contractors and seconded personnel, handling EU classified information.

Member States shall forthwith inform the GSC of the measures taken.

3. The measures referred to in paragraphs 1 and 2 shall be taken before 30 November 2001.

Article 3

In keeping with the basic principles and minimum standards of security contained in part I of the Annex, the Secretary-General/High Representative may take measures in accordance with part II, Section I(1) and (2), of the Annex.

Article 4

As from the day of its application, this Decision shall replace:

(a) Council Decision 98/319/EC of 27 April 1998 relating to the procedures whereby officials and employees of the General Secretariat of the Council may be allowed access to classified information held by the Council ( 3 );

(b) Decision of the Secretary-General/High Representative of 27 July 2000 on measures for the protection of classified information applicable to the General Secretariat of the Council ( 4 );

(c) Decision 433/97 of the Secretary-General of the Council of 22 May 1997 on the Security Clearance procedure of the officials responsible for the functioning of the Cortesy network.

Article 5

1. This Decision shall take effect on the day of its publication.

2. It shall apply from 1 December 2001.









ANNEX

SECURITY REGULATIONS OF THE COUNCIL OF THE EUROPEAN UNION

CONTENTS

PART I

Basic principles and minimum standards of security…

PART II…

SECTION I

The organisation of security in the Council of the European Union…

SECTION II

Classifications and markings…

SECTION III

Classification management…

SECTION IV

Physical security…

SECTION V

General rules on the need-to-know principle and security clearance…

SECTION VI

Security clearance procedure for GSC officials and other servants…

SECTION VII

Preparation, distribution, transmission, storage and destruction of EU classified material…

SECTION VIII

Très secret UE/EU top secret registries…

SECTION IX

Security measures to be applied at the time of specific meetings held outside the Council premises and involving high sensitivity issues…

SECTION X

Breaches of security and compromise of EU classified information…

SECTION XI

Protection of information handled in information technology and communication systems…

SECTION XII

Release of EU classified information to third States or international organisations…

Appendices

Appendix 1

List of national security authorities…

Appendix 2

Comparison of national security classifications…

Appendix 3

Practical classification guide…

Appendix 4

Guidelines for release of EU classified information to third States or international organisations…

— Level 1 cooperation

Appendix 5…

Guidelines for release of EU classified information to third States or international organisations

— Level 2 cooperation…

Appendix 6

Guidelines for release of EU classified information to third States or international organisations…

— Level 3 cooperation

PART I

BASIC PRINCIPLES AND MINIMUM STANDARDS OF SECURITY

INTRODUCTION

1. These provisions lay down the basic principles and minimum standards of security to be respected in an appropriate manner by the Council, by the General Secretariat of the Council (hereinafter called ‘GSC’), by the Member States and by the decentralised agencies of the European Union (hereinafter called ‘EU decentralised agencies’), so that security is safeguarded and each may be assured that a common standard of protection is established.

2. The term ‘EU classified information’ means any information and material, an unauthorised disclosure of which could cause varying degrees of prejudice to the EU interests, or to one or more of its Member States, whether such information originates within the EU or is received from Member States, third States or international organisations.

3. Throughout these regulations: (a) by ‘document’ is meant any letter, note, minute, report, memorandum, signal/message, sketch, photograph, slide, film, map, chart, plan, notebook, stencil, carbon, typewriter or printer ribbon, tape, cassette, computer disk, CD ROM, or other physical medium on which information has been recorded; (b) by ‘material’ is meant ‘document’ as defined in (a) above and also any item of equipment or weapons, either manufactured or in the process of manufacture.

4. Security has the following principal objectives: (a) to safeguard EU classified information from espionage, compromise or unauthorised disclosure; (b) to safeguard EU information handled in communications and information systems and networks, against threats to its integrity and availability; (c) to safeguard installations housing EU information from sabotage and malicious wilful damage; (d) in the event of failure, to assess the damage caused, limit its consequences and adopt the necessary remedial measures.

5. The foundations of sound security are: (a) within each Member State, a national security organisation responsible for: (i) the collection and recording of intelligence on espionage, sabotage, terrorism and other subversive activities, and (ii) information and advice to its government, and through it, to the Council, on the nature of the threats to security and the means of protection against them; (b) within each Member State, and within the GSC, a technical INFOSEC authority responsible for working with the security authority concerned to provide information and advice on technical threats to security and the means for protection against them; (c) regular collaboration among government departments, agencies and the appropriate GSC services, in order to establish, and recommend, as appropriate: (i) what information, resources and installations need to be protected, and (ii) common standards of protection.

6. Where confidentiality is concerned, care and experience are needed in the selection of information and material to be protected and the assessment of the degree of protection it requires. It is fundamental that the degree of protection should correspond with the security criticality of the individual piece of information and material to be protected. In order to ensure the smooth flow of information, steps shall be taken in order to avoid over classification. The classification system is the instrument for giving effect to these principles; a similar system of classification should be followed in planning and organising ways to counter espionage, sabotage, terrorism and other threats so that the greatest measure of protection is given to the most important premises housing classified information and to the most sensitive points within them.

BASIC PRINCIPLES

7. The security measures shall: (a) extend to all persons having access to classified information, classified information-carrying media, all premises containing such information and important installations; (b) be designed to detect persons whose position might endanger the security of classified information and important installations housing classified information and provide for their exclusion or removal; (c) prevent any unauthorised person from having access to classified information or to installations which contain it; (d) ensure that classified information is disseminated solely on the basis of the need-to-know principle which is fundamental to all aspects of security; (e) ensure the integrity (i.e. prevention of corruption or unauthorised alteration or unauthorised deletion) and the availability (i.e. access is not denied to those needing and authorised to have access) of all information, either classified or not classified, and especially of such information stored, processed or transmitted in electromagnetic form.

ORGANISATION OF SECURITY

Common minimum standards

8. The Council and each Member State shall ensure that common minimum standards of security are observed in all administrative and/or government departments, other EU institutions, agencies and contractors so that EU classified information can be passed in the confidence that it will be handled with equal care. Such minimum standards shall include criteria for the clearance of personnel, and procedures for the protection of EU classified information. ►M3 Such minimum standards shall also include minimum standards to be applied when the GSC entrusts by contract tasks involving, entailing and/or containing EU classified information to industrial or other entities: these common minimum standards are contained in Section XIII of Part II. ◄

SECURITY OF PERSONNEL

Clearance of personnel

9. All persons who require access to information classified CONFIDENTIEL UE or above shall be appropriately cleared before such access is authorised. Similar clearance shall be required in the case of persons whose duties involve the technical operation or maintenance of communication and information systems containing classified information. This clearance shall be designed to determine whether such individuals: (a) are of unquestioned loyalty; (b) are of such character and discretion as to cast no doubt upon their integrity in the handling of classified information; or (c) may be vulnerable to pressure from foreign or other sources, e.g. due to former residence or past associations which might constitute a risk to security. Particularly close scrutiny in the clearance procedures shall be given to persons: (d) to be granted access to TRÈS SECRET UE/EU TOP SECRET information; (e) occupying positions involving regular access to a considerable volume of SECRET UE information; (f) whose duties give them special access to mission-critical communication or information systems and thus the opportunity to gain unauthorised access to large amounts of EU classified information or to inflict serious damage upon the mission through acts of technical sabotage. In the circumstances outlined in subparagraphs (d), (e) and (f), the fullest practicable use shall be made of the technique of background investigation.

10. When persons not having an established ‘need to know’ are to be employed in circumstances in which they may have access to EU classified information (e.g. messengers, security agents, maintenance personnel and cleaners, etc.), they shall first be appropriately security-cleared.

Records of personnel clearances

11. All services, bodies or establishments handling EU classified information or housing mission-critical communication or information systems shall maintain a record of the clearances granted to the personnel assigned thereto. Each clearance shall be verified as the occasion demands to ensure that it is adequate for that person's current assignment; it shall be re-examined as a matter of priority whenever new information is received indicating that continued assignment on classified work is no longer consistent with the interests of security. The record of clearances shall be held by the head of security for the service, body or establishment concerned.

Security instruction of personnel

12. All personnel employed in positions where they could have access to classified information shall be thoroughly instructed on taking up assignment and at regular intervals in the need for security and the procedures for accomplishing it. It is a useful procedure to require that all such personnel should certify in writing that they fully understand the security regulations relevant to their assignment.

Management responsibilities

13. Managers shall have the duty of knowing those of their staff who are engaged in classified work or who have access to mission-critical communication or information systems and of recording and reporting any incidents or apparent vulnerabilities, likely to have a bearing on security.

Security status of personnel

14. Procedures shall be established to ensure that, when adverse information becomes known concerning an individual, it is determined whether the individual is employed on classified work or has access to mission-critical communication or information systems, and the authority concerned informed. If it is established that such an individual constitutes a security risk, he or she shall be barred or removed from assignments where he or she might endanger security.

PHYSICAL SECURITY

Need for protection

15. The degree of physical security measures to be applied to ensure the protection of EU classified information shall be proportional to the classification, volume of and threat to the information and material held. Therefore care shall be taken to avoid both over- and under-classification, and classification shall be subject to regular review. All holders of EU classified information shall follow uniform practices regarding classification of that information and meet common standards of protection regarding custody, transmission and disposal of information and material requiring protection.

Checking

16. Before leaving areas containing EU classified information unattended, persons having custody thereof shall ensure that it is securely stored and that all security devices have been activated (locks, alarms, etc.). Further independent checks shall be carried out after working hours.

Security of buildings

17. Buildings housing EU classified information or mission-critical communication and information systems shall be protected against unauthorised access. The nature of the protection afforded to EU classified information, e.g. barring of windows, locks for doors, guards at entrances, automated access control systems, security checks and patrols, alarm systems, intrusion detection systems and guard dogs, shall depend on: (a) the classification, volume and location within the building of the information and material to be protected; (b) the quality of the security containers for this information and material; (c) the physical nature and location of the building.

18. The nature of the protection afforded to communication and information systems shall similarly depend upon an assessment of the value of the assets at stake and of the potential damage if security were compromised, upon the physical nature and location of the building in which the system is housed, and upon the location of the system within the building.

Contingency plans

19. Detailed plans shall be prepared in advance for the protection of classified information during a local or national emergency.

SECURITY OF INFORMATION (INFOSEC)

20. INFOSEC relates to the identification and application of security measures to protect information processed, stored or transmitted in communication, information and other electronic systems against loss of confidentiality, integrity or availability, whether accidental or intentional. Adequate countermeasures shall be taken in order to prevent access to EU information by unauthorised users, to prevent the denial of access to EU information to authorised users, and to prevent corruption or unauthorised modification or deletion of EU information.

COUNTER-SABOTAGE AND OTHER FORMS OF MALICIOUS WILFUL DAMAGE

21. Physical precautions for the protection of important installations housing classified information are the best protective security safeguards against sabotage and malicious wilful damage, and clearance of personnel alone is not an effective substitute. The competent national body shall collect intelligence regarding espionage, sabotage, terrorism and other subversive activities.

RELEASE OF CLASSIFIED INFORMATION TO THIRD STATES OR INTERNATIONAL ORGANISATIONS

22. The decision to release EU classified information originating in the Council to a third State or international organisation shall be taken by the Council. If the originator of the information for which release is desired is not the Council, the Council shall first seek the originator's consent to release. If the originator cannot be established, the Council will assume the former's responsibility.

23. If the Council receives classified information from third States, from international organisations or from other third parties, that information shall be given protection appropriate to its classification and equivalent to the standards established in these regulations for EU classified information, or such higher standards as may be required by the third party releasing the information. Mutual checks may be arranged.

24. The above principles shall be implemented in accordance with the detailed provisions set out in part II.

PART II

SECTION I

THE ORGANISATION OF SECURITY IN THE COUNCIL OF THE EUROPEAN UNION

The Secretary-General/High Representative

1. The Secretary-General/High Representative shall: (a) implement the Council's security policy; (b) consider security problems referred to him by the Council or its competent bodies; (c) examine questions involving changes in the Council security policy, in close liaison with the National Security (or other appropriate) Authorities of the Member States (hereinafter ‘NSA’). Appendix 1 contains a list of those authorities.

2. In particular, the Secretary-General/High Representative shall be responsible for: (a) coordinating all matters of security relating to Council activities; (b) requesting that each Member State set up a central TRÈS SECRET UE/EU TOP SECRET registry and requiring such a registry to be set up in the EU decentralised agencies, where appropriate; (c) addressing to the designated authorities of the Member States requests for the NSA to provide security clearances for personnel employed in the GSC in accordance with Section VI; (d) investigating or ordering an investigation into any leakage of EU classified information which, on prima facie evidence, has occurred in the GSC or any of the EU decentralised agencies; (e) requesting the appropriate security authorities to initiate investigations when a leakage of EU classified information appears to have occurred outside the GSC or the EU decentralised agencies, and coordinating the enquiries when more than one security authority is involved; (f) carrying out jointly and in agreement with the NSA concerned, periodic examinations of the security arrangements for the protection of EU classified information in the Member States; (g) maintaining close liaison with all security authorities concerned in order to achieve overall coordination of security; (h) keeping the Council security policy and procedures constantly under review and, as required, preparing appropriate recommendations. In this regard, he shall present to the Council the annual inspection plan prepared by the GSC Security Office.

The Security Committee of the Council

3. A Security Committee shall be set up. It shall consist of representatives of the NSA of each Member State. It shall be chaired by the Secretary-General/High Representative or by his/her delegate. Representatives of EU decentralised agencies may also be invited to attend when questions concerning them are discussed.

4. The Security Committee shall meet as instructed by the Council, at the request of the Secretary-General/High Representative or of an NSA. The Committee shall have the power to examine and assess all issues of security relating to the proceedings of the Council, and to present recommendations to the Council as appropriate. As regards the activity of the GSC, the Committee shall have the power to make recommendations on security issues to the Secretary-General/High Representative.

The Security Office of the General Secretariat of the Council

5. In order to fulfil the responsibilities mentioned in paragraphs 1 and 2, the Secretary-General/High Representative shall have the GSC Security Office at his disposal for coordinating, supervising and implementing security measures.

6. The Head of the GSC Security Office shall be the principal adviser to the Secretary-General/High Representative on security matters and shall act as secretary to the Security Committee. In this regard he shall direct the updating of the security regulations and coordinate security measures with the competent authorities of the Member States and, as appropriate, with international organisations linked to the Council by security agreements. To that effect, he/she shall act as a liaison officer.

7. The Head of the GSC Security Office shall be responsible for the accreditation of IT systems and networks within the GSC. The Head of the GSC Security Office and the relevant NSA shall jointly decide, where appropriate, on the accreditation of IT systems and networks involving the GSC, the Member States, EU decentralised agencies and/or third parties (States or international organisations).

EU decentralised agencies

8. Each director of an EU decentralised agency shall be responsible for the implementation of security within his or her establishment. He or she will normally nominate a member of his or her staff as being responsible to him or her in this field. This staff member is designated as a security official.

Member States

9. Each Member State should designate an NSA responsible for the security of EU classified information ( 5 ).

10. In the framework of each Member State administration, the corresponding NSA should be responsible for: (a) the maintenance of the security of EU classified information held by any national department, body or agency, public or private, at home or abroad; (b) authorising the establishment of TRÈS SECRET UE/EU TOP SECRET registries (this authority may be delegated to the TRÈS SECRET UE/EU TOP SECRET Control Officer of a Central Registry); (c) the periodic inspection of the security arrangements for the protection of EU classified information; (d) ensuring that all nationals as well as foreigners employed within a national department, body or agency who may have access to EU information classified TRÈS SECRET UE/EU TOP SECRET, SECRET UE and CONFIDENTIEL UE have been security cleared; (e) devising such security plans as are considered necessary to prevent EU classified information from falling into unauthorised hands.

Mutual security inspections

11. Periodic inspections of the security arrangements for the protection of EU classified information in the GSC and in the Permanent Representations of the Member States to the European Union, as well as to the Member States premises in the Council buildings shall be carried out by the GSC Security Office and by the NSA concerned, jointly and in mutual agreement ( 6 ).

12. Periodic inspections of the security arrangements for the protection of EU classified information in the EU decentralised agencies, shall be carried out by the GSC Security Office or, at the Secretary-General's request, by the NSA of the host Member State.

SECTION II

CLASSIFICATIONS AND MARKINGS

LEVELS OF CLASSIFICATION ( 7 )

Information is classified at the following levels:

1. TRÈS SECRET UE/EU TOP SECRET: this classification shall be applied only to information and material the unauthorised disclosure of which could cause exceptionally grave prejudice to the essential interests of the European Union or of one or more of its Member States.

2. SECRET UE: this classification shall be applied only to information and material the unauthorised disclosure of which could seriously harm the essential interests of the European Union or of one or more of its Member States.

3. CONFIDENTIEL UE: this classification shall be applied to information and material the unauthorised disclosure of which could harm the essential interests of the European Union or of one or more of its Member States.

4. RESTREINT UE: this classification shall be applied to information and material the unauthorised disclosure of which could be disadvantageous to the interests of the European Union or of one or more of its Member States.

MARKINGS

5. A caveat marking may be used for specifying the field covered by the document or a particular distribution on a need-to-know basis.

6. The ESDP/PESD marking shall be applied to documents and copies thereof concerning the security and defence of the Union or of one or more of its Member States, or concerning military or non-military crisis management.

7. Certain documents, namely related to Information Technology (IT) Systems may bear an additional marking entailing supplementary security measures as defined in the appropriate regulations.

AFFIXING OF CLASSIFICATION AND MARKINGS

8. Classification and markings shall be applied as follows: (a) on RESTREINT UE documents, by mechanical or electronic means, (b) on CONFIDENTIEL UE documents, by mechanical means and by hand or by printing on pre-stamped, registered paper, (c) on SECRET UE and TRÈS SECRET UE/EU TOP SECRET documents, by mechanical means and by hand.

SECTION III

CLASSIFICATION MANAGEMENT

1. Information shall be classified only when necessary. The classification shall be clearly and correctly indicated, and shall be maintained only as long as the information requires protection.

2. The responsibility for classifying information and for any subsequent downgrading or declassification ( 8 ) rests solely with the originator. Officials and other servants of the GSC shall classify, downgrade or declassify information on instruction from or with the agreement of their Director-General.

3. The detailed procedures for the treatment of classified documents have been so framed as to ensure that they are subject to protection appropriate to the information they contain.

4. The number of persons authorised to originate TRÈS SECRET UE/EU TOP SECRET documents shall be kept to a minimum, and their names kept on a list drawn up by the GSC, each Member State, and, where appropriate, by each EU decentralised agency.

5. The classification of a document shall be determined by the level of sensitivity of its contents in accordance with the definition at Section II, paragraphs 1 to 4. It is important that classification is correctly and sparingly used. This applies especially to TRÈS SECRET UE/EU TOP SECRET classification. 6. The originator of a document which is to be given a classification shall bear in mind the regulations set out above and curb any tendency to over- or under-classify. Although a high classification may, at first sight, appear to guarantee more protection to a document, routine over-classification can result in a loss of confidence in the validity of the classification system. On the other hand, documents shall not be underclassified with a view to avoiding the constraints connected with protection. A practical guide for the classification is contained in Appendix 3. 7. Individual pages, paragraphs, sections, annexes, appendices, attachments and enclosures of a given document may require different classifications and shall be marked accordingly. The classification of the document as a whole shall be that of its most highly classified part. 8. The classification of a letter or note covering enclosures shall be as high as the highest classification of its enclosures. The originator should indicate clearly at which level it should be classified when detached from its enclosures.

9. EU classified documents may be downgraded or declassified only with the permission of the originator, and, if necessary, after discussion with other interested parties. Downgrading or declassification shall be confirmed in writing. The originating Institution, Member State, office, successor organisation or higher authority shall be responsible for informing its addressees of the change, and they in turn shall be responsible for informing any subsequent addressees, to whom they have sent or copied the document, of the change. 10. If possible, originators shall specify on classified documents a date or period when the contents may be downgraded or declassified. Otherwise, they shall keep the documents under review every five years, at the latest, in order to ensure that the original classification is necessary.

SECTION IV

PHYSICAL SECURITY

GENERAL

1. The main objective of physical security measures is to prevent an unauthorised person from gaining access to EU classified information and/or material.

SECURITY REQUIREMENTS

2. All premises, areas, buildings, offices, rooms, communication and information systems, etc. in which EU classified information and material is stored and/or handled shall be protected by appropriate physical security measures.

3. In deciding what degree of physical security protection is necessary, account shall be taken of all relevant factors such as: (a) the classification of information and/or material; (b) the amount and form (for example hard copy, computer storage media) of the information held; (c) the locally assessed threat from intelligence services which target the EU, the Member States, and/or other institutions or third parties holding EU classified information from, namely, sabotage, terrorism and other subversive and/or criminal activities.

4. The physical security measures applied shall be designed to: (a) deny surreptitious or forced entry by an intruder; (b) deter, impede and detect actions by disloyal personnel (the spy within); (c) prevent those officials and other servants of the GSC, of government departments of the Member States and/or other institutions or third parties who do not have a need to know from having access to EU classified information.

PHYSICAL SECURITY MEASURES

Security areas

5. Areas where information classified CONFIDENTIEL UE or higher is handled and stored shall be so organised and structured as to correspond to one of the following: (a) Class I security area: an area where CONFIDENTIEL UE or above is handled and stored in such a way that entry into the area constitutes, for all practical purposes, access to classified information. Such an area requires: (i) a clearly defined and protected perimeter through which all entry and exit is controlled; (ii) an entry control system, which admits only those duly cleared and specially authorised to enter the area; (iii) specification of the classification of the information normally held in the area, i.e. the information to which entry gives access. (b) Class II security area: an area where CONFIDENTIEL UE or above is handled and stored in such a way that it can be protected from access by unauthorised persons by means of internally established controls, e.g. premises containing offices in which CONFIDENTIEL UE or above is regularly handled and stored. Such an area requires: (i) a clearly defined and protected perimeter through which all entry and exit is controlled; (ii) an entry control system which admits unescorted only those duly cleared and specially authorised to enter the area. For all other persons, provision shall be made for escorts or equivalent controls, to prevent unauthorised access to EU classified information and uncontrolled entry to areas subject to technical security inspections. Those areas not occupied by duty personnel on a 24-hour basis shall be inspected immediately after normal working hours to ensure that EU classified information is properly secured.

Administrative area

6. Around or leading up to Class I or Class II security areas, an administrative area of lesser security may be established. Such an area requires a visibly defined perimeter allowing personnel and vehicles to be checked. Only RESTREINT UE information shall be handled and stored in administrative areas.

Entry and exit controls

7. Entry into Class I and Class II security areas shall be controlled by a pass or personal recognition system applicable to the permanent staff. A system of visitor checks designed to deny unauthorised access to EU classified information shall also be established. Pass systems may be supported by automated identification, which shall be regarded as a supplement to, but not a total replacement for guards. A change in the threat assessment may entail a strengthening of the entry and exit control measures, for example during the visit of prominent persons.

Guard patrols

8. Patrols of Class I and Class II security areas are to take place outside normal working hours to protect EU assets against compromise, damage or loss. The frequency of patrols will be determined by local circumstances but, as a guide, are to be conducted once every two hours.

Security containers and strong rooms

9. Three classes of containers shall be used for the storage of EU classified information: — Class A : containers nationally approved for storage of TRÈS SECRET UE/EU TOP SECRET information within a Class I or a Class II security area; — Class B : containers nationally approved for storage of SECRET UE and CONFIDENTIEL UE information within a Class I or a Class II security area; — Class C : office furniture suitable for storage of RESTREINT UE information only.

10. For strong rooms constructed within a Class I or a Class II security area, and for all Class I security areas where information classified CONFIDENTIEL UE and higher is stored on open shelves or displayed on charts, maps, etc., the walls, floors and ceilings, door(s) with lock(s) shall be certified by an NSA as offering equivalent protection to the class of security container approved for the storage of information of the same classification.

Locks

11. Locks used with security containers and strong rooms in which EU classified information is stored shall meet the following standards: — Group A : nationally approved for Class A containers; — Group B : nationally approved for Class B containers; — Group C : suitable for Class C office furniture only.

Control of keys and combinations

12. Keys of security containers shall not be taken out of the office building. Combination settings of security containers shall be committed to memory by persons needing to know them. For use in an emergency, the Security Officer of the establishment concerned shall be responsible for holding spare keys and a written record of each combination setting; the latter shall be held in separate sealed opaque envelopes. Working keys, spare security keys and combination settings shall be kept in separate security containers. These keys and combination settings should be given security protection no less stringent than the material to which they give access.

13. Knowledge of the combination settings of security containers shall be restricted to as few people as practicable. Combinations shall be reset: (a) on receipt of a new container; (b) whenever a change of personnel occurs; (c) whenever a compromise has occurred or is suspected; (d) at intervals of preferably six months and at least every 12 months.

Intrusion detection devices

14. When alarm systems, closed circuit television and other electrical devices are used to protect EU classified information, an emergency electrical supply shall be available to ensure the continuous operation of the system if the main power supply is interrupted. Another basic requirement is that a malfunction in or tampering with such systems shall result in an alarm or other reliable warning to the surveillance personnel.

Approved equipment

15. NSAs shall maintain, from their own or from bilateral resources, up-to-date lists by type and model of the security equipment which they have approved for the direct or indirect protection of classified information under various specified circumstances and conditions. The GSC Security Office shall maintain a similar list, based, inter alia, on information from NSAs. EU decentralised agencies shall consult with the GSC Security Office and, as appropriate, with the NSA of their host Member State before purchasing such equipment.

Physical protection of copying and telefax machines

16. Copying and telefax machines shall be physically protected to the extent necessary to ensure that only authorised persons can use them and that all classified products are subject to proper controls.

PROTECTION AGAINST OVERLOOKING AND EAVESDROPPING

Overlooking

17. All appropriate measures shall be taken by day and by night to ensure that EU classified information is not seen, even accidentally, by any unauthorised person.

Eavesdropping

18. Offices or areas in which information classified SECRET UE and above is regularly discussed shall be protected against passive and active eavesdropping attacks where the risk demands it. The assessment of the risk of such attacks shall be the responsibility of the competent security authority after consultation, as necessary, with NSAs.

19. To determine the protective measures to be taken in premises sensitive to passive eavesdropping (e.g. insulation of walls, doors, floors and ceilings, measurement of compromising emanations) and to active eavesdropping (e.g. search for microphones), the GSC Security Office may request assistance from experts from NSAs. Security officers of EU decentralised agencies may request technical inspections to be carried out by the GSC Security Office and/or the assistance from experts from NSAs.

20. Likewise, when circumstances require, the telecommunications equipment and the electrical or electronic office equipment of any kind used during meetings at SECRET UE level and above may be checked by technical security specialists of NSAs at the request of the competent Security Officer.

TECHNICALLY SECURE AREAS

21. Certain areas may be designated as technically secure areas. A special entry check shall be carried out. Such areas shall be kept locked by an approved method when not occupied and all keys treated as security keys. Such areas shall be subject to regular physical inspections, which will also be undertaken following any unauthorised entry or suspicion of such an entry.

22. A detailed inventory of equipment and furniture shall be kept in order to monitor their movements. No item of furniture or equipment shall be brought into such an area until it has undergone a careful inspection by specially trained security personnel, designed to detect any listening devices. As a general rule, the installation of communication lines in technically secure areas should be avoided.

SECTION V

GENERAL RULES ON THE NEED-TO-KNOW PRINCIPLE AND SECURITY CLEARANCE

1. Access to EU classified information will be authorised only for persons having a ‘need-to-know’ for carrying out their duties or missions. Access to TRÈS SECRET UE/EU TOP SECRET, SECRET UE and CONFIDENTIEL UE information will be authorised only for persons in possession of the appropriate security clearance.

2. The responsibility for determining ‘need-to-know’ will rest within the GSC, the EU decentralised agencies and with the Member State's service or department in which the person concerned is to be employed, according to the requirements of the task.

3. The clearance of personnel will be the responsibility of the official's employer based on relevant applicable procedures. As regards GSC officials and other servants, the security clearance procedure is provided for in Section VI. This will result in the issue of a ‘security certificate’ showing the level of classified information to which the cleared person may have access and the date of expiry. A security certificate for a given classification may give the holder access to information with a lower classification.

4. Persons other than officials or other servants of the GSC or of Member States, for example members, officials or servants of EU institutions, with whom it may be necessary to discuss, or to whom it may be necessary to show, EU classified information, must have a security clearance as regards EU classified information and be briefed as to their responsibility for security. The same rule shall apply, in similar circumstances, to external contractors, experts or consultants.

5. All persons who are to have access to TRÈS SECRET UE/EU TOP SECRET information shall first be screened for access to such information. 6. All persons who are required to have access to TRÈS SECRET UE/EU TOP SECRET information shall be designated by the Head of their department and their names kept in the appropriate TRÈS SECRET UE/EU TOP SECRET registry. 7. Before having access to TRÈS SECRET UE/EU TOP SECRET information, all persons shall sign a certificate to the effect that they have been briefed on Council security procedures and that they fully understand their special responsibility for safeguarding TRÈS SECRET UE/EU TOP SECRET information, and the consequences which the EU rules and national law or administrative rules provide when classified information passes into unauthorised hands, either by intent or through negligence. 8. In the case of persons having access to TRÈS SECRET UE/EU TOP SECRET information at meetings, etc., the competent Control Officer of the service or body in which that person is employed shall notify the body organising the meeting that the persons concerned have such authorisation. 9. The names of all persons ceasing to be employed on duties requiring access to TRÈS SECRET UE/EU TOP SECRET information shall be removed from the TRÈS SECRET UE/EU TOP SECRET list. In addition, the attention of all such persons shall be drawn again to their special responsibility for the safeguarding of TRÈS SECRET UE/EU TOP SECRET information. They shall also sign a declaration stating that they will neither use nor pass on TRÈS SECRET UE/EU TOP SECRET information in their possession.

10. All persons who are to have access to SECRET UE or CONFIDENTIEL UE information shall first be screened to the appropriate grading. 11. All persons who are to have access to SECRET UE or CONFIDENTIEL UE information shall be acquainted with the appropriate security regulations and shall be aware of the consequences of negligence. 12. In the case of persons having access to SECRET UE or CONFIDENTIEL UE information at meetings, etc., the Security Officer of the body in which that person is employed shall notify the body organising the meeting that the persons concerned have such authorisation.

13. Persons with access to RESTREINT UE information will be made aware of these security regulations and of the consequences of negligence.

14. When a member of staff is transferred from a post which involves the handling of EU classified material, the Registry will oversee the proper transfer of that material from the outgoing to the incoming official.

15. Persons who are required to handle EU classified information should, on first taking up their duties and periodically thereafter, be made aware of: (a) the dangers to security arising from indiscreet conversation; (b) precautions to take in their relations with the press; (c) the threat presented by the activities of intelligence services which target the EU and Member States as regards EU classified information and activities; (d) the obligation to report immediately to the appropriate security authorities any approach or manoeuvre giving rise to suspicions of espionage activity or any unusual circumstances relating to security. 16. All persons normally exposed to frequent contact with representatives of countries whose intelligence services target the EU and Member States as regards EU classified information and activities shall be given a briefing on the techniques known to be employed by various intelligence services. 17. There are no Council security regulations concerning private travel to any destination by personnel cleared for access to EU classified information. The competent security authorities will, however, acquaint the officials and other servants falling within their responsibility with travel regulations to which they may be subject. It will be the responsibility of the security officers to arrange refresher meetings for staff members on these special instructions.

SECTION VI

SECURITY CLEARANCE PROCEDURE FOR GSC OFFICIALS AND OTHER SERVANTS

1. Only officials and other servants of the GSC or persons working within the GSC who, by reason of their duties and for the requirements of the service, need to have knowledge of, or to use, classified information held by the Council, shall have access to such information.

2. In order to have access to information classified as ‘TRÈS SECRET UE/EU TOP SECRET’, ‘SECRET UE’ and ‘CONFIDENTIEL UE’, the persons referred to in paragraph 1 must have been authorised, in accordance with the procedure referred to in paragraphs 4 and 5.

3. Authorisation shall be granted only to persons who have undergone security screening by the competent national authorities of the Member States (NSA) in accordance with the procedure referred to in paragraphs 6 to 10.

4. The appointing authority within the meaning of Article 2, first subparagraph of the Staff Regulations shall be responsible for granting the authorisations referred to in paragraphs 1, 2 and 3. The appointing authority shall grant authorisation after obtaining the opinion of the competent national authorities of the Member States on the basis of security screening carried out in accordance with paragraphs 6 to 12.

5. Authorisation, which shall be valid for a period of five years, may not exceed the duration of the tasks on the basis of which it was granted. It may be renewed by the appointing authority in accordance with the procedure referred to in paragraph 4. Authorisation shall be withdrawn by the appointing authority where it considers there are justifiable grounds for doing so. Any decision to withdraw authorisation shall be notified to the person concerned, who may ask to be heard by the appointing authority, and to the competent national authority.

6. The aim of security screening shall be to establish that there are no objections to allowing the person to have access to classified information held by the Council.

7. Security screening shall be carried out with the assistance of the person concerned and at the request of the appointing authority by the competent national authorities of the Member State of which the person subject to authorisation is a national. Should the person concerned reside in the territory of another Member State, the national authorities concerned may secure the cooperation of the authorities of the State of residence.

8. As part of the screening procedure, the person concerned shall be required to complete a personal information form.

9. The appointing authority shall specify in its request the type and level of classified information to be made available to the person concerned, so that the competent national authorities can carry out the screening process and give their opinion as to the level of authorisation it would be appropriate to grant to that person.

10. The whole security-screening process together with the results obtained shall be subject to the relevant rules and regulations in force in the Member State concerned, including those concerning appeals.

11. Where the competent national authorities of the Member State give a positive opinion, the appointing authority may grant the person concerned authorisation.

12. A negative opinion by the competent national authorities shall be notified to the person concerned, who may ask to be heard by the appointing authority. Should it consider it necessary, the appointing authority may ask the competent national authorities for any further clarification they can provide. If the negative opinion is confirmed, authorisation shall not be granted.

13. All persons granted authorisation within the meaning of paragraphs 4 and 5 shall, at the time the authorisation is granted and at regular intervals thereafter, receive any necessary instructions concerning the protection of classified information and the means of ensuring such protection. Such persons shall sign a declaration acknowledging receipt of the instructions and give an undertaking to obey them.

14. The appointing authority shall take any measure necessary in order to implement this section, in particular as regards the rules governing access to the list of authorised persons.

15. Exceptionally, if required by the service, the appointing authority may, after giving the national competent authorities notification and provided there is no reaction from them within a month, grant temporary authorisation for a period not exceeding six months, pending the outcome of the screening referred to in paragraph 7.

16. The provisional and temporary authorisations thus granted shall not give access to TRÈS SECRET UE/EU TOP SECRET information; such access shall be limited to officials who have effectively undergone a screening with positive results, in accordance with paragraph 7. Pending the outcome of the screening, the officials requested to be cleared at TRÈS SECRET UE/EU TOP SECRET level, may be authorised temporarily and provisionally, to access information classified up to, and including SECRET UE.

SECTION VII

PREPARATION, DISTRIBUTION, TRANSMISSION, STORAGE AND DESTRUCTION OF EU CLASSIFIED MATERIAL







Contents General provisions Chapter I Preparation and distribution of EU classified documents… Chapter II Transmission of EU classified documents… Chapter III Electrical and other means of technical transmission… Chapter IV Extra copies and translations of, and extracts from, EU classified documents… Chapter V Musters and checks, storage and destruction of EU classified documents… Chapter VI Specific rules applicable to documents intended for the Council…

General provisions

This section details measures for the preparation, distribution, transmission, storage and destruction of EU classified documents as defined in paragraph 3(a) of the Basic Principles and Minimum Standards of Security set out in part I of this Annex. It shall be used as a reference for the adaptation of those measures for other EU classified material, according to its type and on a case-by-case basis.

Chapter I

Preparation and distribution of EU classified documents

1. The EU classifications and markings shall be applied as established in Section II and appear at the top and bottom centre of each page, and each page shall be numbered. Each EU classified document shall bear a reference number and a date. In the case of TRÈS SECRET UE/EU TOP SECRET and SECRET UE documents, this reference number shall appear on each page. If they are to be distributed in several copies, each one shall bear a copy number, which will appear on the first page, together with the total number of pages. All annexes and enclosures shall be listed on the first page of a document classified CONFIDENTIEL UE and above.

2. Documents classified CONFIDENTIEL UE and above shall be typed, translated, stored, photocopied, reproduced magnetically or microfilmed only by persons who have been cleared for access to EU classified information up to at least the appropriate security classification of the document in question, except in the special case described in paragraph 27 of this section. The provisions regulating the computerised production of classified documents are set out in Section XI.

3. EU classified information shall be distributed only to persons with a need to know and having the appropriate security clearance. The initial distribution shall be specified by the originator.

4. TRÈS SECRET UE/EU TOP SECRET documents shall be circulated through TRÈS SECRET UE/EU TOP SECRET registries (see Section VIII). In the case of TRÈS SECRET UE/EU TOP SECRET messages, the competent registry may authorise the Head of the communications centre to produce the number of copies specified in the list of addressees.

5. Documents classified SECRET UE and below may be redistributed by the original addressee to other addressees based on a need to know. The originating authorities shall, however, clearly state any caveats they wish to impose. Whenever such caveats are imposed, the addressees may redistribute the documents only with the originating authorities' authorisation.

6. Every document classified CONFIDENTIEL UE and above shall, on arriving at or leaving an establishment, be recorded by the establishment's registry. The particulars to be entered (references, date and where applicable the copy number) shall be such as to identify the documents and be entered into a logbook or in special protected computer media.

Chapter II

Transmission of EU classified documents

7. Documents classified CONFIDENTIEL UE and above shall be transmitted in heavy duty, opaque double envelopes. The inner envelope shall be marked with the appropriate EU security classification as well as, if possible, full particulars of the recipient's job title and address.

8. Only a Registry Control Officer, or his substitute, may open the inner envelope and acknowledge receipt of the documents enclosed, unless that envelope is addressed to an individual. In such a case, the appropriate Registry shall log the arrival of the envelope, and only the individual to whom it is addressed may open the inner envelope and acknowledge receipt of the documents it contains.

9. A receipt form shall be placed in the inner envelope. The receipt, which will not be classified, should quote the reference number, date and copy number of the document, but never its subject.

10. The inner envelope shall be enclosed in an outer envelope bearing a package number for receipting purposes. Under no circumstances shall the security classification appear on the outer envelope.

11. For documents classified CONFIDENTIEL UE and above, couriers and messengers shall obtain receipts against the package numbers.

12. Within a given building or group of buildings, classified documents may be carried in a sealed envelope bearing only the addressee's name, on condition that it is carried by a person cleared to the level of classification of the documents.

13. Within a country, TRÈS SECRET UE/EU TOP SECRET documents should be sent only by means of official messenger service or by persons authorised to have access to TRÈS SECRET UE/EU TOP SECRET information.

14. Whenever a messenger service is used for the transmission of a TRÈS SECRET UE/EU TOP SECRET document outside the confines of a building or group of buildings, the packaging and receipting provisions contained in this Chapter shall be complied with. Delivery services shall be so staffed as to ensure that packages containing TRÈS SECRET UE/EU TOP SECRET documents remain under the direct supervision of a responsible official at all times.

15. Exceptionally, TRÈS SECRET UE/EU TOP SECRET documents may be taken by officials, other than messengers, outside the confines of a building or group of buildings for local use at meetings and discussions, provided that: (a) the bearer is authorised to have access to those TRÈS SECRET UE/EU TOP SECRET documents; (b) the mode of transportation complies with national rules governing the transmission of national TOP SECRET documents; (c) under no circumstances does the official leave the TRÈS SECRET UE/EU TOP SECRET documents unattended; (d) arrangements are made for the list of documents so carried to be held in the TRÈS SECRET UE/EU TOP SECRET Registry holding the documents and recorded in a log, and checked against this record on their return.

16. Within a given country, SECRET UE and CONFIDENTIEL UE documents may be sent either by post, if such transmission is permitted under national regulations and is in accordance with the provisions of those regulations, or by messenger service or by persons cleared for access to EU classified information.

17. Each Member State or, EU decentralised agency, should prepare instructions on the personal carrying of EU classified documents based on these regulations. The bearer should be required to read and sign these instructions. In particular, the instructions should make it clear that, under no circumstances, may documents: (a) leave the bearer's possession unless they are in safe custody in accordance with the provisions contained in Section IV; (b) be left unattended in public transport or private vehicles, or in places such as restaurants or hotels. They may not be stored in hotel safes or left unattended in hotel rooms; (c) be read in public places such as aircraft or trains.

18. Material classified CONFIDENTIEL UE and above should be conveyed from one Member State to another by diplomatic or military courier services.

19. However, the personal carriage of material classified SECRET UE and CONFIDENTIEL UE may be permitted if provisions for the carriage are such as to ensure that they cannot fall into any unauthorised person's hands.

20. NSAs may authorise personal carriage when diplomatic and military couriers are not available or the use of such couriers would result in a delay that would be detrimental to EU operations and the material is urgently required by the intended recipient. Each Member State should prepare instructions covering the personal carriage of material classified up to and including SECRET UE internationally by persons other than diplomatic and military couriers. The instructions should require that: (a) the bearer has the appropriate security clearance granted by Member States; (b) a record is held in the appropriate office or registry of all material so carried; (c) packages or bags containing EU material bear an official seal to prevent or discourage inspection by customs, and labels with identification and instructions to the finder; (d) the bearer carries a courier certificate and/or mission order recognised by all EU States authorising him to carry the package as identified; (e) no EU non-Member State or its frontier is crossed when travelling overland unless the shipping State has a specific guarantee from that State; (f) the bearer's travel arrangements with regard to destinations, routes to be taken and means of transportation to be used will be in accordance with EU Regulations or — if national regulations with respect to such matters are more stringent — in accordance with such regulations; (g) the material must not leave the possession of the bearer unless it is housed in accordance with the provisions for safe custody contained in Section IV; (h) the material must not be left unattended in public or private vehicles, or in places such as restaurants or hotels. It must not be stored in hotel safes or left unattended in hotel rooms; (i) if the material being carried contains documents, these must not be read in public places (for example in aircraft, trains, etc.). The person designated to carry the classified material must read and sign a security briefing that contains, as a minimum, the instructions listed above and procedures to be followed in an emergency or in case the package containing the classified material is challenged by customs or airport security officials.

21. No special provisions are laid down for the conveyance of RESTREINT UE documents, except that they should be such as to ensure that they cannot fall into any unauthorised person's hands.

22. All couriers and messengers employed to carry SECRET UE and CONFIDENTIEL UE documents shall be appropriately security cleared.

Chapter III

Electrical and other means of technical transmission

23. Communications security measures are designed to ensure the secure transmission of EU classified information. The detailed rules applicable to the transmission of such EU classified information are dealt with in Section XI.

24. Only accredited communications centres and networks and/or terminals and systems may transmit information classified CONFIDENTIEL UE and SECRET UE.

Chapter IV

Extra copies and translations of and extracts from EU classified documents

25. Only the originator may authorise the copy or translation of TRÈS SECRET UE/EU TOP SECRET documents.

26. If persons without TRÈS SECRET UE/EU TOP SECRET clearance require information which, although contained in a TRÈS SECRET UE/EU TOP SECRET document, does not have that classification, the Head of the TRÈS SECRET UE/EU TOP SECRET Registry may be authorised to produce the necessary number of extracts from that document. He/she shall, at the same time, take the necessary steps to ensure that these extracts are given the appropriate security classification.

27. Documents classified SECRET UE and lower may be reproduced and translated by the addressee, within the framework of the national security regulations and on condition that it complies strictly with the need-to-know principle. The security measures applicable to the original document shall also be applicable to reproductions and/or translations thereof. EU decentralised agencies shall follow these security regulations.

Chapter V

Musters and checks, storage and destruction of EU classified documents

28. Every year, each TRÈS SECRET UE/EU TOP SECRET Registry as referred to in Section VIII shall carry out an itemised muster of TRÈS SECRET UE/EU TOP SECRET documents in accordance with the regulations set out in Section VIII, (9) to (11). EU classified documents below the level of TRÈS SECRET UE/EU TOP SECRET shall be subject to internal checks in accordance with national guidelines, and, in the case of the GSC or EU decentralised agencies, according to instructions from the Secretary General/High Representative. These operations shall afford the opportunity to secure holders' views as to: (a) the possibility of downgrading or declassifying certain documents; (b) documents to be destroyed.

29. To minimise storage problems, the control officers of all registries shall be authorised to have TRÈS SECRET UE/EU TOP SECRET, SECRET UE and CONFIDENTIEL UE documents microfilmed or otherwise stored in magnetic or optical media for archive purposes, providing that: (a) the microfilming/storage process is undertaken by personnel with current clearance for the corresponding appropriate classification level; (b) the microfilm/storage medium is afforded the same security as the original documents; (c) the microfilming/storing of any TRÈS SECRET UE/EU TOP SECRET document is reported to the originator; (d) rolls of film, or other type of support, contain only documents of the same TRÈS SECRET UE/EU TOP SECRET, SECRET UE or CONFIDENTIEL UE classification; (e) the microfilming/storing of a TRÈS SECRET UE/EU TOP SECRET or SECRET UE document is clearly indicated in the record used for the annual inventory; (f) original documents which have been microfilmed or otherwise stored are destroyed, in accordance with the regulations set out in paragraphs 31 to 36.

30. These rules also apply to any other form of storage authorised by the NSA, such as electromagnetic media and optical disk.

31. To prevent the unnecessary accumulation of EU classified documents, those regarded by the Head of the establishment holding them as out of date and surplus in number shall be destroyed as soon as practicable, in the following manner: (a) TRÈS SECRET UE/EU TOP SECRET documents shall be destroyed only by the Central Registry responsible for them. Each document destroyed shall be listed in a destruction certificate, signed by the TRÈS SECRET UE/EU TOP SECRET control officer and by the officer witnessing the destruction, who shall be TRÈS SECRET UE/EU TOP SECRET cleared. A note to this effect shall be made in the logbook; (b) the registry shall keep the destruction certificates, together with the distribution sheets, for a period of ten years. Copies shall be forwarded to the originator or to the appropriate central registry only when explicitly requested; (c) TRÈS SECRET UE/EU TOP SECRET documents, including all classified waste resulting from the preparation of TRÈS SECRET UE/EU TOP SECRET documents such as spoiled copies, working drafts, typed notes and carbon paper, shall be destroyed, under the supervision of a TRÈS SECRET UE/EU TOP SECRET officer, by burning, pulping, shredding or otherwise reducing into an unrecognisable and non-reconstitutable form.

32. SECRET UE documents shall be destroyed by the registry responsible for those documents, under the supervision of a security cleared person, using one of the processes indicated in paragraph 31(c). SECRET UE documents that are destroyed shall be listed on signed destruction certificates to be retained by the Registry, together with the distribution forms, for at least three years.

33. CONFIDENTIEL UE documents shall be destroyed by the registry responsible for those documents, under the supervision of a security cleared person, by one of the processes indicated in paragraph 31(c). Their destruction shall be recorded in accordance with national regulations and, in the case of GSC or EU decentralised agencies, according to instructions from the Secretary-General/High Representative.

34. RESTREINT UE documents shall be destroyed by the registry responsible for those documents or by the user, in accordance with national regulations and, in the case of GSC or EU decentralised agencies, according to instructions from the Secretary-General/High Representative.

35. The GSC, the Member States and the EU decentralised agencies shall prepare plans based on local conditions for the safeguarding of EU classified material in a crisis including if necessary emergency destruction and evacuation plans; they shall promulgate, within their respective organisations, instructions deemed necessary to prevent EU classified information from falling into unauthorised hands.

36. The arrangements for the safeguarding and/or destruction of SECRET UE and CONFIDENTIEL UE material in a crisis shall under no circumstances adversely affect the safeguarding or destruction of TRÈS SECRET UE/EU TOP SECRET material, including the enciphering equipment, whose treatment shall take priority over all other tasks. The measures to be adopted for the safeguarding and destruction of enciphering equipment in an emergency shall be covered by ad hoc instructions.

CHAPTER VI

Specific rules applicable to documents intended for the Council

37. Within the GSC, a ‘Classified Information Office’ shall monitor information classified as SECRET UE or CONFIDENTIEL UE contained in documents for the Council. Under the authority of the Director-General for Personnel and Administration it shall: (a) manage operations relating to the registration, reproduction, translation, transmission dispatch and destruction of such information; (b) update the list of particulars on classified information; (c) periodically question issues on the need to maintain the classification of information; (d) lay down, in collaboration with the Security Office, the practical arrangements for classifying and declassifying information.

38. The Classified Information Office shall keep a register of the following particulars: (a) the date of preparation of the classified information; (b) the level of classification; (c) the expiry date of the classification; (d) the name and department of the issuer; (e) the recipient or recipients, with serial number; (f) the subject; (g) the number; (h) the number of copies circulated; (i) the preparation of inventories of the classified information submitted to the Council; (j) the register of declassification and downgrading of classified information.

39. The general rules provided for in Chapters I to V of this Section shall apply to the Classified Information Office of the GSC, unless modified by the specific rules laid down in this Chapter.

SECTION VIII

TRÈS SECRET UE/EU TOP SECRET REGISTRIES

1. The purpose of TRÈS SECRET UE/EU TOP SECRET registries is to ensure the recording, handling and distribution of TRÈS SECRET UE/EU TOP SECRET documents in accordance with security regulations. The head of the TRÈS SECRET UE/EU TOP SECRET registry, respectively in each Member State, in the GSC and, as appropriate in EU decentralised agencies, will be the TRÈS SECRET UE/EU TOP SECRET control officer.

2. Central registries will act as the main receiving and despatching authority in Member States, in the GSC and EU decentralised agencies, in which such registries have been set up, as well as, if appropriate, in other EU institutions, international organisations and third States with which the Council has agreements on security procedures for the exchange of classified information.

3. When necessary, subregistries shall be established, to be responsible for the internal management of TRÈS SECRET UE/EU TOP SECRET documents; they shall keep up-to-date records of the circulation of each document held on the Subregistry's charge.

4. TRÈS SECRET UE/EU TOP SECRET sub-registries shall be set up as specified in Section I in response to long term needs and shall be attached to a central TRÈS SECRET UE/EU TOP SECRET registry. If there is a need to consult TRÈS SECRET UE/EU TOP SECRET documents only temporarily and occasionally, these documents may be released without setting up a TRÈS SECRET UE/EU TOP SECRET subregistry provided rules are laid down to ensure that they remain under the control of the appropriate TRÈS SECRET UE/EU TOP SECRET registry and that all physical and personnel security measures are observed.

5. Subregistries may not transmit TRÈS SECRET UE/EU TOP SECRET documents direct to other subregistries of the same central TRÈS SECRET UE/EU TOP SECRET registry without express approval by the latter.

6. All exchanges of TRÈS SECRET UE/EU TOP SECRET documents between subregistries not attached to the same central registry shall be routed through the central TRÈS SECRET UE/EU TOP SECRET registries.

7. As the control officer, the head of a central TRÈS SECRET UE/EU TOP SECRET registry shall be responsible for: (a) the transmission of TRÈS SECRET UE/EU TOP SECRET documents in accordance with the regulations defined in Section VII; (b) maintaining a list of all its dependent TRÈS SECRET UE/EU TOP SECRET sub-registries together with names and signatures of the appointed control officers and their authorised deputies; (c) holding receipts from registries for all TRÈS SECRET UE/EU TOP SECRET documents distributed by the central registry; (d) maintaining a record of TRÈS SECRET UE/EU TOP SECRET documents held and distributed; (e) maintaining an up-to-date list of all central TRÈS SECRET UE/EU TOP SECRET registries with which he/she normally corresponds, together with the names and signatures of their appointed control officers and their authorised deputies; (f) the physical safeguarding of all TRÈS SECRET UE/EU TOP SECRET documents held within the registry in accordance with regulations contained in Section IV.

8. As the control officer, the head of a TRÈS SECRET UE/EU TOP SECRET subregistry shall be responsible for: (a) the transmission of TRÈS SECRET UE/EU TOP SECRET documents in accordance with regulations contained in Section VII and paragraphs 5 and 6 of Section VIII; (b) maintaining an up-to-date list of all persons authorised to have access to the TRÈS SECRET UE/EU TOP SECRET information under his control; (c) the distribution of TRÈS SECRET UE/EU TOP SECRET documents in accordance with the instructions of the originator or on a need-to-know basis, having first checked that the addressee has the requisite security clearance; (d) maintaining an up-to-date record of all TRÈS SECRET UE/EU TOP SECRET documents held or circulating under his control or which have been passed to other TRÈS SECRET UE/EU TOP SECRET registries and holding all corresponding receipts; (e) maintaining an up-to-date list of TRÈS SECRET UE/EU TOP SECRET registries with whom he is authorised to exchange TRÈS SECRET UE/EU TOP SECRET documents, together with the names and signatures of their control officers and authorised deputies; (f) the physical safeguarding of all TRÈS SECRET UE/EU TOP SECRET documents held within the subregistry in accordance with the regulations laid down in Section IV.

9. Every twelve months, each TRÈS SECRET UE/EU TOP SECRET registry shall carry out an itemised inventory of all TRÈS SECRET UE/EU TOP SECRET documents for which it is accountable. A document is deemed to have been accounted for if the registry physically musters the document, or holds a receipt from the TRÈS SECRET UE/EU TOP SECRET registry to which the document has been transferred, a destruction certificate for the document or an instruction to downgrade or declassify that document. 10. Subregistries shall forward the findings of their annual inventory to the central registry to which they are answerable, on a date specified by the latter. 11. NSAs, as well as those EU institutions, international organisations and EU decentralised agencies in which a central TRÈS SECRET UE/EU TOP SECRET registry has been set up, shall forward the findings of the annual inventories conducted in central TRÈS SECRET UE/EU TOP SECRET registries to the Secretary-General/High Representative, by 1 April each year at the latest.

SECTION IX

SECURITY MEASURES TO BE APPLIED AT THE TIME OF SPECIFIC MEETINGS HELD OUTSIDE THE COUNCIL PREMISES AND INVOLVING HIGH SENSITIVITY ISSUES

GENERAL

1. When European Council, Council, Ministerial or other important meetings are held outside the Council premises in Brussels and Luxembourg, and where justified by the particular security requirements relating to the high sensitivity of the issues or information dealt with, the security measures described below should be taken. These measures concern only the protection of EU classified information; other security measures may have to be planned.

RESPONSIBILITIES

Host Member States

2. The Member State on whose territory the meeting is being held (the host Member State) should be responsible, in cooperation with the GSC security office, for the security of the European Council, Council, Ministerial or other important meetings and for the physical security of the principal delegates and their staff. As regards the protection of security, it should specifically ensure that: (a) plans are drawn up to deal with security threats and security-related incidents, the measures in question covering in particular the safe custody of EU classified documents in offices; (b) measures are taken to provide possible access to Council's communications system for the receipt and transmission of EU classified messages. The host Member State will also provide access if required to secure telephone systems.

Member States

3. The Member States' authorities should take the necessary steps to ensure that: (a) appropriate security clearance certification is provided for their national delegates, if necessary by signal or fax, either directly to the meeting security officer or via the GSC Security Office; (b) any specific threat is made known to the host Member State's authorities and, as appropriate, to the GSC Security Office so that appropriate action can be taken.

Meeting Security Officer

4. A security officer should be appointed and be responsible for the general preparation and control of general internal security measures and for coordination with the other security authorities concerned. The measures taken by him/her should in general relate to: (i) protective measures at the meeting place to ensure that the meeting is conducted without any incident that might compromise the security of any EU classified information that may be used there; (ii) checking the personnel whose access to the place of the meeting, delegations' areas and conference rooms is permitted, and checking any equipment; (iii) constant coordination with the competent authorities of the host Member State and with the GSC Security Office. (a) (b) the inclusion of security instructions in the meeting dossier with due regard for the requirements set out in these security regulations and any other security instructions considered necessary.

GSC Security Office

5. The GSC Security Office should act as an adviser on security for the preparation of the meeting; it should be represented there to help and advise the meeting security officer and delegations as necessary.

6. Each delegation to a meeting should designate a security officer, who will be responsible for dealing with security matters within his/her delegation and for maintaining liaison with the meeting security officer, as well as with the GSC Security Office representative as required.

SECURITY MEASURES

Security areas

7. The following security areas should be established: (a) a Class II security area, consisting of a drafting room, the GSC offices and reprographic equipment, as well as delegations' offices as appropriate; (b) a Class I security area, consisting of the conference room and interpreters' and sound engineers' booths; (c) administrative areas, consisting of the press area and those parts of the meeting place that are used for administration, catering and accommodation, as well as the area immediately adjacent to the Press Centre and the meeting place.

Passes

8. The meeting security officer should issue appropriate badges as requested by the delegations, according to their needs. Where required, a distinction may be made as regards access to different security areas.

9. The security instructions for the meeting should require all persons concerned to wear and display their badges prominently at all times within the place of the meeting, so that they can be checked as needed by security personnel.

10. Apart from badge-holding participants, as few people as possible should be admitted to the meeting place. National delegations wishing to receive visitors during the meeting should notify the meeting security officer. Visitors should be given a visitor's badge. A visitor's pass form bearing his/her name and the name of the person being visited should be filled in. Visitors should be accompanied at all times by a security guard or by the person being visited. The visitor's pass form should be carried by the accompanying person, who shall return it, together with the visitor's badge, to the security personnel when the visitor leaves the meeting place.

Control of photographic and audio equipment

11. No camera or recording equipment may be brought into a Class I security area, with the exception of equipment brought by photographers and by sound engineers duly authorised by the meeting security officer.

Checking of briefcases, portable computers and packages

12. Pass-holders allowed access to a security area may normally bring in their briefcases and portable computers (with own power supply only) without a check being made. In the case of packages for delegations, delegations may take delivery of the packages, which will either be inspected by the delegation security officer, screened by special equipment or opened by security personnel for inspection. If the meeting security officer considers it necessary, more stringent measures for the inspection of briefcases and packages may be laid down.

Technical security

13. The meeting room may be made technically secure by a technical security team, which may also conduct electronic surveillance during the meeting.

Delegations' documents

14. Delegations should be responsible for taking EU classified documents to and from meetings. They should also be responsible for the verification and security of those documents during their use in the premises assigned to them. The host Member States' help may be requested for the transportation of classified documents to and from the place of the meeting.

Safe custody of documents

15. If the GSC, the Commission or delegations are unable to store their classified documents in accordance with approved standards, they may lodge those documents in a sealed envelope with the meeting security officer, against receipt, so that the latter can store the documents in accordance with approved standards.

Inspection of offices

16. The meeting security officer should arrange for the GSC and delegations' offices to be inspected at the end of each working day to ensure that all EU classified documents are being kept in a safe place; if not, he should take the requisite measures.

Disposal of EU classified waste

17. All waste should be treated as EU classified, and waste-paper baskets or bags should be given to the GSC and delegations for its disposal. Before leaving the premises they have been assigned, the GSC and delegations should take their waste to the meeting security officer, who should arrange for its destruction according to the regulations.

18. At the end of the meeting, all documents held but no longer wanted by the GSC or delegations should be treated as waste. A thorough search of GSC and delegations' premises should be made before the security measures adopted for the meeting are lifted. Documents for which a receipt was signed should, as far as applicable, be destroyed as prescribed in Section VII.

SECTION X

BREACHES OF SECURITY AND COMPROMISE OF EU CLASSIFIED INFORMATION

1. A breach of security occurs as the result of an act or omission contrary to a Council or national security regulation which might endanger or compromise EU classified information.

2. Compromise of EU classified information occurs when it has wholly or in part fallen into the hands of unauthorised persons, i.e. who do not have either the appropriate security clearance or the necessary need-to-know or if there is the likelihood of such an event having occurred.

3. EU classified information may be compromised as a result of carelessness, negligence or indiscretion as well as by the activities of services which target the EU or its Member States, as regards EU classified information and activities, or by subversive organisations.

4. It is important that all persons who are required to handle EU classified information are thoroughly briefed on security procedures, the dangers of indiscreet conversation and their relationships with the press. They should be aware of the importance of reporting any breach of security which may come to their notice at once to the security authority of the Member State, Institution or Agency in which they are employed.

5. When a security authority discovers or is informed of a breach of security relating to EU classified information or of the loss or disappearance of EU classified material, it shall take timely action in order to: (a) establish the facts; (b) assess and minimise the damage done; (c) prevent a recurrence; (d) notify the appropriate authorities of the effects of the breach of security. In this context, the following information shall be provided: (i) a description of the information involved, including its classification, reference and copy number, date, originator, subject and scope; (ii) a brief description of the circumstances of the breach of security, including the date and the period during which the information was exposed to compromise; (iii) a statement of whether the originator has been informed.

6. It shall be the duty of each security authority, as soon as it is notified that such a breach of security may have occurred, to report the fact immediately, using the following procedure: the EU TOP SECRET sub-registry shall report the matter to the GSC Security Office via its central EU TOP SECRET registry; in the event of a compromise of EU classified information occurring within the jurisdiction of a Member State, it shall be reported to the GSC Security Office as specified in paragraph 5, through the NSA responsible.

7. Cases involving RESTREINT UE information need to be reported only when they present unusual features.

8. On being informed that a breach of security has occurred, the Secretary-General/High Representative shall: (a) notify the authority that originated the classified information in question; (b) ask the appropriate security authorities to initiate investigations; (c) coordinate enquiries where more than one security authority is affected; (d) obtain a report on the circumstances of the breach, the date or period during which it may have occurred and was discovered, with a detailed description of the content and classification of the material involved. Damage done to the interests of the EU or of one or more of its Member States and action taken to prevent a recurrence should also be reported.

9. The originating authority shall inform the addressees and shall give appropriate instructions.

10. Any individual who is responsible for compromising EU classified information shall be liable to disciplinary action according to the relevant rules and regulations. Such action shall be without prejudice to any legal action.

SECTION XI

PROTECTION OF INFORMATION HANDLED IN INFORMATION TECHNOLOGY AND COMMUNICATION SYSTEMS







Contents Chapter I Introduction… Chapter II Definitions… Chapter III Security responsibilities… Chapter IV Non-technical security measures… Chapter V Technical security measures… Chapter VI Security during handling… Chapter VII Procurement… Chapter VIII Temporary or occasional use…

Chapter I

Introduction

GENERAL ASPECTS

1. The security policy and requirements in this section shall apply to all communications and information systems and networks (hereinafter SYSTEMS) handling information classified CONFIDENTIEL UE and above.

2. SYSTEMS handling RESTREINT UE information also require security measures to protect the confidentiality of that information. All SYSTEMS require security measures to protect the integrity and availability of those systems and of the information they contain. The security measures to be applied to those systems will be determined by the designated Security Accreditation Authority (SAA) and will be commensurate with the assessed risk and consistent with the policy stated in these security regulations.

3. Protection of sensor systems containing embedded IT SYSTEMS shall be determined and specified in the general context of the systems to which they belong using applicable provisions of this section to the extent possible.

THREATS TO, AND VULNERABILITIES OF SYSTEMS

4. In general terms, a threat can be defined as a potential for the accidental or deliberate compromise of security. In the case of SYSTEMS, such a compromise involves loss of one or more of the properties of confidentiality, of integrity and of availability. A vulnerability can be defined as a weakness or lack of controls that would facilitate or allow a threat actuation against a specific asset or target. A vulnerability may be an omission or it may relate to a deficiency in a control's strength, completeness or consistency; it may be technical, procedural or operational in nature.

5. EU classified and unclassified information handled in SYSTEMS in a concentrated form designed for rapid retrieval, communication and use is vulnerable to many risks. These include access to the information by unauthorised users or, conversely, denial of access to authorised users. There are also the risks of the unauthorised disclosure, corruption, modification or deletion of the information. Furthermore, the complex and sometimes fragile equipment is expensive and often difficult to repair or replace rapidly. These SYSTEMS are therefore attractive targets for intelligence gathering operations and sabotage, especially if security measures are thought to be ineffective.

SECURITY MEASURES

6. The main purpose of the security measures stated in this section is to provide protection against unauthorised disclosure of information (the loss of confidentiality) and against the loss of integrity and availability of information. To achieve adequate security protection of a SYSTEM handling EU classified information, the appropriate standards of conventional security shall be specified, along with appropriate special security procedures and techniques particularly designed for each SYSTEM.

7. A balanced set of security measures shall be identified and implemented to create a secure environment in which a SYSTEM operates. The fields of application of those measures concern physical elements, personnel, non-technical procedures, computer and communications operating procedures.

8. Computer security measures (hardware and software security features) shall be required to implement the need-to-know principle, and to prevent or detect the unauthorised disclosure of information. The extent to which computer security measures are to be relied upon shall be determined during the process of establishing the security requirement. The process of accreditation shall determine that an adequate level of assurance is present to support this reliance on computer security measures.

SYSTEM-SPECIFIC SECURITY REQUIREMENT STATEMENT (SSRS)

9. For all SYSTEMS handling information classified CONFIDENTIEL UE and above, a SYSTEM-Specific Security Requirement Statement (SSRS) shall be required to be produced by the IT System Operational Authority (ITSOA) in cooperation with input and assistance as required from the project staff and INFOSEC Authority, and approved by the SAA. An SSRS shall also be required where the availability and integrity of the RESTREINT UE or unclassified information is deemed critical by the SAA.

10. The SSRS shall be formulated at the earliest stage of a project's inception and shall be developed and enhanced as the project develops, fulfilling different roles at different stages in the project and SYSTEM's life cycle.

11. The SSRS shall form the binding agreement between the IT System Operational Authority and the SAA against which the SYSTEM is to be accredited.

12. The SSRS is a complete and explicit statement of the security principles to be observed and of the detailed security requirements to be met. It is based on Council security policy and risk assessment, or imposed by parameters covering the operational environment, the lowest level of personnel security clearance, the highest classification of information handled, the security mode of operation or user requirements. The SSRS is an integral part of project documentation submitted to the appropriate authorities for technical, budgetary and security approval purposes. In its final form, the SSRS constitutes a complete statement of what it means for the SYSTEM to be secure.

SECURITY MODES OF OPERATION

13. All SYSTEMS handling information classified CONFIDENTIEL UE and above shall be accredited to operate in one, or where warranted by requirements during different time periods, more than one, of the following security modes of operation, or their national equivalent: (a) dedicated; (b) system high; and (c) multi-level.

Chapter II

Definitions

ADDITIONAL MARKINGS

14. Additional markings such as CRYPTO or any other EU-recognised special handling designator, shall apply where there is a need for limited distribution and special handling in addition to that designated by the security classification.

15. ‘DEDICATED’ SECURITY MODE OF OPERATION shall mean: a mode of operation in which ALL individuals with access to the SYSTEM are cleared to the highest classification level of information handled within the SYSTEM, and with a common need-to-know for ALL of the information handled within the SYSTEM. (1) The common need-to-know indicates there is no mandatory requirement for computer security features to provide separation of information within the SYSTEM. (2) Other security features (for example, physical, personnel and procedural) shall conform to the requirements for the highest classification level and all category designations of the information handled within the SYSTEM.

16. ‘SYSTEM HIGH’ SECURITY MODE OF OPERATION shall mean: a mode of operation in which ALL individuals with access to the SYSTEM are cleared to the highest classification level of information handled within the SYSTEM, but NOT ALL individuals with access to the SYSTEM have a common need-to-know for the information handled within the SYSTEM. (1) The lack of common need-to-know indicates that there is a requirement for computer security features to provide selective access to, and separation of, information within the SYSTEM. (2) Other security features (for example, physical, personnel and procedural) shall conform to the requirements for the highest classification level and all category designations of the information handled within the SYSTEM. (3) All information handled or being available to a SYSTEM under this mode of operation, together with output generated, shall be protected as potentially of the information category designation and of the highest classification level being handled until determined otherwise, unless there is an acceptable level of trust that can be placed in any labelling functionality present.

17. ‘MULTI-LEVEL’ SECURITY MODE OF OPERATION shall mean: a mode of operation in which NOT ALL individuals with access to the SYSTEM are cleared to the highest classification level of information handled within the SYSTEM, and NOT ALL individuals with access to the SYSTEM have a common need-to-know for the information handled within the SYSTEM. (1) This mode of operation permits, currently, the handling of information of different classification levels and of mixed information category designations. (2) The fact that not all individuals are cleared to the highest levels, associated with a lack of common need-to-know, indicates that there is a requirement for computer security features to provide elective access to, and separation of, information within the SYSTEM.

18. INFOSEC shall mean: the application of security measures to protect information processed, stored or transmitted in communication, information and other electronic systems against loss of confidentiality, integrity or availability, whether accidental or intentional, and to prevent loss of integrity and availability of the systems themselves. INFOSEC measures include those of computer, transmission, emission and cryptographic security, and the detection, documentation and countering of threats to information and to the SYSTEMS.

19. COMPUTER SECURITY (COMPUSEC) shall mean: the application of hardware, firmware and software security features to a computer system in order to protect against, or prevent, the unauthorised disclosure, manipulation, modification/deletion of information or denial of service.

20. COMPUTER SECURITY PRODUCT shall mean: a generic computer security item which is intended for incorporation into an IT system for use in enhancing, or providing for, confidentiality, integrity or availability of information handled.

21. COMMUNICATIONS SECURITY (COMSEC) shall mean: the application of security measures to telecommunications in order to deny unauthorised persons information of value which might be derived from the possession and study of such telecommunications or to ensure the authenticity of such telecommunications. Such measures include cryptographic, transmission and emission security; and also include procedural, physical, personnel, document and computer security.

22. EVALUATION shall mean: the detailed technical examination, by an appropriate authority, of the security aspects of a SYSTEM or of a cryptographic or a computer security product. (1) The evaluation investigates the presence of required security functionality and the absence of compromising side-effects from such functionality and assesses the incorruptibility of such functionality. (2) The evaluation determines the extent to which the security requirements of a SYSTEM, or the security claims of a computer security product, are satisfied and establishes the assurance level of the SYSTEM or of the cryptographic, or the computer security product's trusted function.

23. CERTIFICATION shall mean: the issue of a formal statement, supported by an independent review of the conduct and results of an evaluation, of the extent to which a SYSTEM meets the security requirement, or a computer security product meets pre-defined security claims.

24. ACCREDITATION shall mean: the authorisation and approval granted to a SYSTEM to process EU classified information in its operational environment. Such accreditation should be made after all appropriate security procedures have been implemented and a sufficient level of protection of the system resources has been achieved. Accreditation should normally be made on the basis of the SSRS, including the following: (a) a statement of the objective of accreditation for the system; in particular, what classification level(s) of information are to be handled and what system or network security mode(s) of operation is being proposed; (b) production of a risk management review to identify the threats and vulnerabilities and measures to counter them; (c) the Security Operating Procedures (SecOPs) with a detailed description of the proposed operations (e.g., modes, serv