COMMISSION DECISION (EU, Euratom) 2019/1963

of 17 October 2019

laying down implementing rules on industrial security with regard to classified procurement contracts

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249 thereof,

Having regard to the Treaty establishing the European Atomic Energy Community, and in particular Article 106 thereof,

Having regard to Commission Decision (EU, Euratom) 2015/443 of 13 March 2015 on Security in the Commission (1),

Having regard to Commission Decision (EU, Euratom) 2015/444 of 13 March 2015 on the security rules for protecting EU classified information (2),

Having regard to Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission (3),

After consulting the Commission Security Expert Group, in accordance with Article 41(5) of Decision (EU, Euratom) 2015/444,

Whereas:

(1) Articles 41, 42, 47 and 48 of Decision (EU, Euratom) 2015/444 provide that more detailed provisions to supplement and support Chapter 6 of that Decision are to be laid down in implementing rules on industrial security, governing issues such as tendering, conclusion of classified contracts, facility security clearances, personnel security clearances, visits and transmission and carriage of European Union classified information (EUCl).

(2) Decision (EU, Euratom) 2015/444 states that classified contracts are to be implemented in close cooperation with the national security authority, the designated security authority or any other competent authority of the Member States concerned; the Member States have agreed to ensure that any entity under their jurisdiction which may receive or generate classified information originating in the Commission is appropriately security cleared and is capable of providing suitable protection equivalent to that afforded by the security rules of the Council of the European Union for protecting EU classified information bearing a corresponding classification marking, as provided in Agreement between the Member States of the European Union, meeting within Council, regarding the protection of classified information exchanged in the interests of the European Union (2011/C 202/05) (4).

(3) The Council, the Commission and the High Representative of the Union for Foreign Affairs and Security Policy have agreed to ensure maximum consistency in the application of security rules regarding their protection of EUCI while taking into account their specific institutional and organisational needs, in accordance with the declarations attached to the minutes of the Council session at which Council Decision 2013/488/EU (5) on the security rules for protecting EU classified information was adopted.

(4) The Commission's implementing rules on industrial security with regard to classified contracts should therefore also ensure maximum consistency and take into account the Guidelines on Industrial Security approved by the Council Security Committee on 13 December 2016 and Articles 7 and 22 of Directive 2009/81/EC of the European Parliament and of the Council (6).

(5) On 4 May 2016 the Commission adopted a decision (7) empowering the Member of the Commission responsible for security matters to adopt, on behalf of the Commission and under its responsibility, the implementing rules provided for in Article 60 of Decision (EU, Euratom) 2015/444,

HAS ADOPTED THIS DECISION:

CHAPTER 1

GENERAL PROVISIONS

Article 1 Subject matter and scope 1. This Decision sets out implementing rules on industrial security with regard to classified procurement contracts to support the implementation of Decision (EU, Euratom) 2015/444, and in particular Chapter 6 of that Decision. 2. This Decision lays down specific requirements to ensure the protection of EU classified information (EUCI) by economic operators in pre-contract stage, throughout the life cycle of classified contracts concluded by the European Commission, and in subcontracts concluded by Commission contractors. 3. This Decision concerns information classified at the following levels: (a) RESTREINT UE/EU RESTRICTED; (b) CONFIDENTIEL UE/EU CONFIDENTIAL; (c) SECRET UE/EU SECRET.

Article 2 Responsibility within the Commission 1. As part of the responsibilities as described in the Financial Regulation (8), each authorising officer of the Commission contracting authority shall ensure that the classified contract refers to the minimum standards on industrial security set out in Chapter 6 of Decision (EU, Euratom) 2015/444 and in these implementing rules, and where appropriate in the contract notice or the invitation to tender, and that these standards are met in the course of implementation. 2. To that end, the authorising officer concerned shall, at all stages, seek the advice of the Commission security authority on issues regarding the security elements of a classified contract, programme or project, and shall inform the local security officer about the contracts concluded. The decision on the classification level of specific subjects shall rest with the contracting authority and shall be taken with due regard to the security classification guide. 3. In respecting the requirements of these implementing rules, the Commission security authority shall cooperate closely with the national security authorities (NSAs) and the designated security authorities (DSAs) of the Member States concerned, in particular as regards facility security clearances (FSCs) and personnel security clearances (PSCs), visit procedures and transportation plans.

CHAPTER 2

HANDLING OF CALLS FOR TENDER FOR CLASSIFIED CONTRACTS

Article 3 Basic principles 1. Classified contracts shall be awarded only to economic operators registered in a Member State, or to economic operators registered in a third country or established by an international organisation where that third country or international organisation has concluded a security of information agreement with the European Union or entered into an administrative arrangement with the Commission (9). 2. Before launching an invitation to tender for a classified contract, the contracting authority shall determine the security classification of any information that could be provided to tenderers. The contracting authority shall also determine the maximum security classification of any information generated in the performance of the contract or programme or project, or at least the anticipated volume and type of information to be produced or handled, and the need for a classified communication and information system (CIS). 3. The contracting authority shall ensure that contract notices for classified contracts provide information about the special security obligations related to classified information. Annex I contains a sample template for the contract notice information. 4. The contracting authority shall ensure that information classified RESTREINT UE/EU RESTRICTED, CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET is disclosed to tenderers only after they have signed a non-disclosure agreement, obliging tenderers to handle and protect EUCI in accordance with Decision (EU, Euratom) 2015/444 and its implementing rules. 5. All contractors which are required to handle or store information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET within their facilities, either during the performance of the classified contract itself or at the pre-contractual stage, shall hold an FSC at the required level. The following identifies the three scenarios that may arise during the tendering stage for a classified contract involving EUCI at CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET level: (a) no access to EUCI at CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET level during the tendering stage: Where the contract notice or the invitation to tender concerns a contract that will involve EUCI at CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET level, but does not require the tenderer to handle such information at the tender stage, a tenderer which does not hold an FSC at the required level shall not be excluded from the bidding process on the grounds that they do not hold an FSC. (b) access to EUCI at CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET level on the premises of the contracting authority during the tendering stage: Access shall be granted to tenderer personnel who hold a PSC at the required level and who have a need-to-know. Before such access is granted, the contracting authority shall verify, through the Commission security authority, with the respective NSA/DSA whether an FSC is also required under national laws and regulations at this stage. (c) handling or storage of EUCI at CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET level on the premises of the tenderer during the tendering stage: Where the contract notice or the invitation to tender requires tenderers to handle or store EUCI on their premises, the tenderer shall hold an FSC at the required level. In such circumstances the contracting authority shall obtain, through the Commission security authority, an assurance from the relevant NSA/DSA that the tenderer has been granted an appropriate FSC. Access shall be granted to tenderer personnel who hold a PSC at the required level and who have a need-to-know. 6. In principle, an FSC shall not be required for access to RESTREINT UE/EU RESTRICTED information, either at the tender stage or for the performance of the contract. Where Member States require an FSC for contracts or subcontracts at RESTREINT UE/EU RESTRICTED level under their national laws and regulations, as listed in Annex IV, those national requirements shall not place any additional obligations on other Member States or exclude tenderers, contractors or subcontractors from Member States that have no such FSC requirements for access to RESTREINT UE/EU RESTRICTED information from related contracts/subcontracts or a competition for such. These contracts shall be performed in Member States in accordance with their national laws and regulations. 7. Where an FSC is required for the performance of a classified contract, the contracting authority shall submit, through the Commission security authority, a request to the contractor's NSA/DSA using a facility security clearance information sheet (FSCIS). Annex III, Appendix D, contains an example of an FSCIS (10). The classified contract shall not be awarded until the contractor's NSA/DSA has confirmed the tenderer's FSC. Response to an FSCIS is provided, to the extent possible, within ten working days of the date of the request.

Article 4 Subcontracting in classified contracts 1. The conditions under which a contractor awarded a Commission classified contract may subcontract shall be defined in the invitation to tender and in the contract documentation. Where the classified contract permits subcontracting of some of its parts, such subcontracting shall be subject to prior written consent from the contracting authority. Before giving its consent, the contracting authority shall consult the Commission security authority. 2. Classified contracts shall be subcontracted only to economic operators registered in a Member State, or to economic operators registered in a third country or established by an international organisation where that third country or international organisation has concluded a security of information agreement with the EU or entered into an administrative arrangement with the Commission (11).

CHAPTER 3

LETTING COMMISSION CLASSIFIED CONTRACTS

Article 5 Basic principles 1. When letting a classified contract, the contracting authority, together with the Commission security authority, shall ensure that the contractor's obligations regarding the protection of EUCI provided to that contractor or generated in the performance of the contract are an integral part of the contract. Contract-specific security requirements shall take the form of a security aspects letter (SAL). A sample template of a SAL is set out in Annex III. 2. Before signing a classified contract, the contracting authority shall prepare, after consulting the Commission security authority, a security classification guide (SCG) for the tasks to be performed and information generated in the performance of the contract, or at programme or project level, where applicable. The SCG shall be part of the SAL. 3. Programme or project-specific security requirements shall take the form of a programme (or project) security instruction (PSI). The PSI may be drafted using the provisions of the SAL template as set out in Annex III. The PSI shall be developed by the Commission department managing the programme or project, in close cooperation with the Commission security authority, and submitted for advice to the Commission Security Expert Group. Where a contract is part of a programme or project with its own PSI, the SAL of the contract shall have a simplified form and shall include reference to the security provisions set out in the PSI of the programme or project. 4. The contracting authority shall be considered the originator of classified information created and handled for the performance of the contract. 5. The contracting authority, through the Commission security authority, shall notify the NSAs/DSAs of all contractors and subcontractors about the conclusion of classified contracts or subcontracts and any extensions or early terminations of such contracts or subcontracts. A list of country requirements is provided in Annex IV. 6. Contracts involving information classified RESTREINT UE/EU RESTRICTED shall include a contract security clause making the provisions set out in Annex III, Appendix E binding upon the contractor. Those contracts shall include an SAL setting out, as a minimum, the requirements for handling RESTREINT UE/EU RESTRICTED information including information assurance aspects and specific requirements to be fulfilled by the contractor under delegation from the contracting authority for the accreditation of the contractor's CIS handling RESTREINT UE/EU RESTRICTED information. 7. Where RESTREINT UE/EU RESTRICTED information is provided to tenderers or to potential contractors, the minimum requirements mentioned in paragraph 6 shall be included in tenders or in relevant non-disclosure arrangements concluded at the tender stage. 8. Where this is required by Member States' national laws and regulations, NSAs/DSAs ensure that contractors or subcontractors under their jurisdiction comply with the applicable security provisions for the protection of RESTREINT UE/EU RESTRICTED information and conduct verification visits to contractors' facilities located in their territory. Where the NSA/DSA is not under such an obligation, the contracting authority shall ensure that the contractor implements the required security provisions set out in Annex III.

Article 6 Access to EUCI by personnel of contractors and subcontractors 1. The Commission department, as contracting authority, shall ensure that classified contracts include provisions indicating that personnel of a contractor or subcontractor who, for the performance of the classified contract or subcontract, require access to EUCI may be granted such access only if: (a) it has been established that they have a need-to-know; (b) for information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET, they have been granted a PSC at the relevant level by the respective NSA/DSA or any other competent security authority; (c) they have been briefed on the applicable security rules for protecting EUCI, and have acknowledged their responsibilities with regard to protecting such information. 2. If a contractor or subcontractor wishes to employ a national of a non-EU country in a position that requires access to EUCI classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET, it is the responsibility of the contractor or subcontractor to initiate the security clearance procedure of such a person in accordance with national laws and regulations applicable at the location where access to the EUCI is to be granted.

CHAPTER 4

VISITS IN CONNECTION WITH CLASSIFIED CONTRACTS

Article 7 Basic principles 1. Where the Commission, contractors or subcontractors require access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET on each other's premises for the performance of a classified contract, visits shall be arranged in liaison with the NSAs/DSAs or any other competent security authority concerned. 2. The visits referred to in paragraph 1 shall be subject to the following requirements: (a) the visit shall have an official purpose related to a classified contract let by the Commission; (b) any visitor shall hold a PSC at the required level and have a need-to-know in order to access EUCI provided or generated in the performance of a classified contract let by the Commission.

Article 8 Requests for visits 1. Visits by contractors to other contractors' facilities, or to Commission premises, that involve access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET shall be arranged in accordance with the following procedure: (a) the security officer of the facility sending the visitor shall complete all relevant parts of the request for visit (RFV) form and submit the request to the facility's NSA/DSA. A template of the RFV form is set out in Annex III, Appendix C; (b) the sending facility's NSA/DSA needs to confirm the visitor's PSC before submitting the RFV to the host facility's NSA/DSA (or the Commission security authority if the visit is to Commission premises); (c) the security officer of the sending facility shall then obtain from its NSA/DSA the reply of the host facility's NSA/DSA (or the Commission security authority) either authorising or denying the RFV; (d) an RFV is considered approved if no objections are raised until five working days before the date of the visit. 2. Visits by Commission officials to contractor facilities that involve access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET shall be arranged in accordance with the following procedure: (a) the visitor shall complete all relevant parts of the RFV form and submit it to the Commission security authority; (b) the Commission security authority shall confirm the PSC of the visitor before submitting the RFV to the host facility's NSA/DSA; (c) the Commission security authority shall obtain a reply from the host facility's NSA/DSA either authorising or denying the RFV; (d) an RFV is considered approved if no objections are raised until five working days before the date of the visit. 3. An RFV may cover either a single visit or recurring visits. In the case of recurring visits, the RFV may be valid for up to one year from the start date requested. 4. The validity of any RFV shall not exceed the validity of the PSC of the visitor. 5. As a general rule, an RFV should be submitted to the host facility's competent security authority at least 15 working days before the date of the visit.

Article 9 Visit procedures 1. Before allowing visitor to have access to EUCI, the security office of the host facility shall comply with all the visit-related security procedures and rules laid down by its NSA/DSA. 2. Visitors shall prove their identity upon arrival at the host facility by presenting a valid ID card or passport. That identification information shall correspond to the information supplied in the RFV. 3. The host facility shall ensure that records are kept of all visitors, including their names, the organisation they represent, the date of expiry of the PSC, the date of the visit and the names of the persons visited. Such records shall be retained for a period of at least five years or longer if required by the national rules and regulations of the country where the host facility is located.

Article 10 Visits arranged directly 1. In the context of specific projects, the relevant NSAs/DSAs and the Commission security authority may agree on a procedure whereby visits for a specific classified contract can be arranged directly between the visitor's security officer and the security officer of the facility to be visited. A template of the form to be used for this purpose is set out in Annex III, Appendix C. Such an exceptional procedure shall be set out in the PSI or other specific arrangements. In such cases, the procedures set out in Article 8 and Article 9(1) shall not apply. 2. Visits involving access to information classified RESTREINT UE/EU RESTRICTED shall be arranged directly between the sending and receiving entity without the need to follow the procedures set out in Article 8 and Article 9(1).

CHAPTER 5

TRANSMISSION AND CARRIAGE OF EUCI IN PERFORMANCE OF CLASSIFIED CONTRACTS

Article 11 Basic principles The contracting authority shall ensure that all decisions related to EUCI transfer and carriage are in accordance with Decision (EU, Euratom) 2015/444 and its implementing rules, and with the terms of the classified contract, including the consent of the originator.

Article 12 Electronic handling 1. Electronic handling and transmission of EUCI shall be carried out in accordance with Chapters 5 and 6 of Decision (EU, Euratom) 2015/444 and its implementing rules. The communication and information systems owned by a contractor and used to handle EUCI for the performance of the contract (‘contractor CIS’) shall be subject to accreditation by the responsible security accreditation authority (SAA). Any electronic transmission of EUCI shall be protected by cryptographic products approved in accordance with Article 36(4) of Decision (EU, Euratom) 2015/444. TEMPEST measures shall be implemented in accordance with Article 36(6) of that Decision. 2. The security accreditation of contractor CIS handling EUCI at RESTREINT UE/EU RESTRICTED level and any interconnection thereof may be delegated to the security officer of a contractor if this is permitted by national laws and regulations. Where that task is delegated, the contractor shall be responsible for implementing the minimum security requirements described in the SAL when handling RESTREINT UE/EU RESTRICTED information on its CIS. However, the relevant NSAs/DSAs and SAAs retain responsibility for the protection of RESTREINT UE/EU RESTRICTED information handled by the contractor and the right to inspect the security measures taken by the contractors. In addition, the contractor shall provide to the contracting authority and, where required by national laws and regulations, the competent national SAA, a statement of compliance certifying that the contractor CIS and related interconnections have been accredited for handling EUCI at RESTREINT UE/EU RESTRICTED level (12).

Article 13 Transport by commercial couriers The transport of EUCI by commercial couriers shall abide by the relevant provisions of Commission decisions on implementing rules for handling RESTREINT UE/EU RESTRICTED information and CONFIDENTIEL UE/EU CONFIDENTIAL information.

Article 14 Hand carriage 1. The carriage of classified information by hand shall be subject to strict security requirements. 2. RESTREINT UE/EU RESTRICTED information may be hand carried by contractor personnel within the EU, provided the following requirements are met: (a) the envelope or packaging used is opaque and bears no indication of the classification of its contents; (b) the classified information does not leave the possession of the bearer; (c) the envelope or packaging is not opened en route. 3. For information classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET, hand carriage by contractor personnel within an EU Member State is arranged in advance between the sending and receiving entities. The dispatching authority or facility informs the receiving authority or facility of the details of the consignment, including reference, classification, expected time of arrival and name of courier. Such hand carriage is permitted, provided the following requirements are met: (a) the classified information is carried in a double envelope or packaging; (b) the outer envelope or packaging is secured and bears no indication of the classification of its contents, while the inner envelope bears the level of classification; (c) EUCI does not leave the possession of the bearer; (d) the envelope or packaging is not opened en route; (e) the envelope or packaging is carried in a lockable briefcase or similar approved container of such size and weight that it can be retained at all times in the personal possession of the bearer and not be consigned to a baggage hold; (f) the courier carries a courier certificate issued by his/her competent security authority authorising the courier to carry the classified consignment as identified. 4. For hand carriage by contractor personnel of information classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET from one EU Member State to another, the following additional rules shall apply: (a) the courier shall be responsible for the safe custody of the classified material carried until it is handed over to the recipient; (b) in the event of a security breach, the sender's NSA/DSA may request that the authorities in the country where the breach occurred carry out an investigation, report their findings and take legal or other action as appropriate; (c) the courier shall have been briefed on all the security obligations to be observed during carriage and shall have signed an appropriate acknowledgement; (d) the instructions for the courier shall be attached to the courier certificate; (e) the courier shall have been provided with a description of the consignment and an itinerary; (f) the documents shall be returned to the issuing NSA/DSA upon completion of the journey(s) or be kept available by the recipient for monitoring purposes; (g) if customs, immigration authorities or border police ask to examine and inspect the consignment, they shall be permitted to open and observe sufficient parts of the consignment so as to establish that it contains no material other than that which is declared; (h) customs authorities should be urged to honour the official authority of the shipping documents and of the authorisation documents carried by the courier. If a consignment is opened by customs, this should be done out of sight of unauthorised persons and in the presence of the courier where possible. The courier shall request that the consignment be repacked and shall ask the authorities conducting the inspection to reseal the consignment and confirm in writing that it was opened by them. 5. Hand carriage by contractor personnel of information classified RESTREINT UE/EU RESTRICTED, CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET to a third country or an international organisation will be subject to provisions of the security of information agreement or the administrative arrangement concluded between, respectively, the European Union or the Commission and that third country or international organisation.

CHAPTER 6

BUSINESS CONTINUITY PLANNING

Article 15 Contingency plans and recovery measures The Commission department, as contracting authority, shall ensure that classified contract requires the contractor to set out business contingency plans (BCP) for protecting EUCI handled in connection with the performance of the classified contract in emergency situations, and to put in place preventive and recovery measures in the context of business continuity planning to minimise the impact of incidents in relation to the handling and storage of EUCI. The contractor shall inform the contracting authority of its BCP.

Article 16 Entry into force This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Done at Brussels, 17 October 2019. For the Commission, On behalf of the President, Günther OETTINGER Member of the Commission

(1) OJ L 72, 17.3.2015, p. 41.

(2) OJ L 72, 17.3.2015, p. 53.

(3) OJ L 6, 11.1.2017, p. 40.

(4) OJ C 202, 8.7.2011, p. 13.

(5) Council Decision 2013/488/EU of 23 September 2013 on the security rules for protecting EU classified information (OJ L 274, 15.10.2013, p. 1).

(6) Directive 2009/81/EC of the European Parliament and of the Council of 13 July 2009 on the coordination of procedures for the award of certain works contracts, supply contracts and service contracts by contracting authorities or entities in the fields of defence and security (OJ L 216, 20.8.2009, p. 76).

(7) Commission Decision of 4 May 2016 on an empowerment relating to security (C(2016) 2797 final).

(8) Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012 (OJ L 193, 30.7.2018, p. 1).

(9) The list of agreements concluded by the EU and of administrative arrangements entered into by the European Commission, under which EU classified information may be exchanged with third countries and international organisations, can be found on the Commission website.

(10) Other forms used may differ from the example provided in these implementing rules in their design.

(11) The list of agreements concluded by the EU and of administrative arrangements entered into by the European Commission, under which EU classified information may be exchanged with third countries and international organisations, can be found on the Commission website.

(12) The minimum requirements for communication and information systems handling EUCI at RESTREINT UE/EU RESTRICTED level are laid down in Annex III, Appendix E.