EN Official Journal of the European Communities L 123/19

COUNCIL DECISION

of 31 March 1992

in the field of security of information systems

(92/242/EEC)

THE COUNCIL OF THE EUROPEAN COMMUNITIES,

Having regard to the Treaty establishing the European Economic Community, and in particular Article 235 thereof,

Having regard to the proposal from the Commission (1),

Having regard to the opinion of the European Parliament (2),

Having regard to the opinion of the Economic and Social Committee (3),

Whereas the Community has as its task, by establishing a common market and progressively approximating the economic policies of the Member States, to promote throughout the Community a harmonious development of economic activities, a continuous and balanced expansion, an increase in stability, an accelerated raising of the standard of living and closer relations between the Member States;

Whereas information stored, processed and transmitted electronically plays an increasingly important role in economic and social activities;

Whereas the advent of efficient global communications and the pervasive use of electronic handling of information emphasizes the need for adequate protection;

Whereas the European Parliament has repeatedly stressed the importance of the security of information systems in its debates and resolutions;

Whereas the Economic and Social Committee has emphasized the need to address issues relating to the security of information systems in Community forms of action, particularly in view of the impact of the completion of the internal market;

Whereas forms of action at national, international and Community levels provide a good basis;

Whereas there is a close link between telecommunications, information technology, standardization, the information market and research, development and technology (RDT) policies, as well as the work already undertaken in these areas by the Community;

Whereas it is appropriate to ensure that efforts are concerted by building on existing national and international work and by promoting cooperation between the principal parties concerned; whereas it is therefore appropriate to proceed within the framework of a coherent action plan;

Whereas the complexity of the security of information systems calls for the development of strategies to enable the free movement of information within the single market while ensuring the security of the use of information systems throughout the Community;

Whereas it is the responsibility of each Member State to take into account the constraints imposed by security and public order;

Whereas the responsibilities of the Member States in this area imply a concerted approach based on close collaboration with senior officials of the Member States;

Whereas provision should be made for a plan of action for an initial period of twenty-four months and the setting-up of a Committee of Senior Officials with a long-term mandate to advise the Commission on forms of action in the area of security of information systems;

Whereas an amount of ECU 12 million is considered necessary to implement the action for an initial period of twenty-four months; whereas for 1992, in the context of the present financial perspective, the amount estimated necessary is ECU 2 million;

Whereas the amounts to be committed in order to finance the programme for the period following the 1992 budget year will form part of the existing Community financial framework,

HAS DECIDED AS FOLLOWS:

Article 1

An action in the field of the security of information systems is hereby adopted. It comprises:

— development of overall strategies for the security of information systems (action plan) for an initial period of 24 months, and

— setting-up Senior Officials Group with a long-term mandate to advise the Commission on action to be undertaken in the field of the security of information systems, hereinafter referred to as the ‘Committee’.

Article 2

1. The Commission shall consult the Committee systematically on issues relating to the security of the information systems for the various activities carried out by the Community, in particular on the definition of work strategies and programmes.

2. The action plan, as indicated in the Annex, shall include preparatory work under the following themes:

I. development of a strategic framework for the security of information systems;

II. identification of user and service provider requirements for the security of information systems;

III. solutions for immediate and interim needs of users, suppliers and service providers;

IV. development of specifications, standardization, evaluation and certification in respect of the security of information systems;

V. technological and Operational developments in the security of information systems;

VI. provision of security of information systems.

Article 3

1. The Community funds estimated as necessary for the execution of the action amount to ECU 12 million for the initial period, including ECU 2 million for 1992 within the 1988-1992 financial perspective.

For the subsequent period of application of the programme, the amount will have to be included in the Community financial framework in force.

2. The budgetary authority shall determine the appropriations available for each financial year, taking into account the principles of sound management referred to in Article 2 of the Financial Regulation applicable to the general budget of the European Communities.

Article 4

An evaluation of the progress achieved during the initial period shall be carried out for the Commission by a group of indepedent experts. This group's report, together with any comments by the Commission, shall be submitted to the European Parliament and the Council.

Article 5

1. The Commission shall be responsible for implementing the action. It shall be assisted by an advisory committee composed of representatives of the Member States and chaired by the representative of the Commission.

2. The action plan shall be implemented in accordance with the objectives set out in Article 2 and updated where necessary. It shall set out the detailed objectives and types of actions to be undertaken, and the financial arrangements to be made for them. The Commission shall make calls for proposals on the basis of the action plan.

3. The action plan shall be implemented in close collaboration with the sector actors. It shall take into account, promote and complement the European and international standardization activities under way in this field.

Article 6

1. The procedure laid down in Article 7 shall apply to:

— measures relating to Community policy in the field of the security of information systems;

2. The procedure laid down in Article 8 shall apply to:

— the preparation and updating of the action plan referred to in Article 5;

— the contents of the calls for proposals, the assessment of proposals and the estimated amount of the Community's contribution to measures where this amount exceeds ECU 200 000;

— the cooperation in any activity under this Decision of non-Community organizations;

— arrangements for the dissemination, protection and exploitation of the results of the measures;

— the measures to be undertaken to evaluate the action.

3. Where the amount of the Community contribution to the measures is less than, or equal to, ECU 200 000, the Commission shall consult the Committee on the measures to be taken and inform the Committee of the outcome of its assessment.

Article 7

The representative of the Commission shall submit to the Committee a draft of the measures to be taken. The Committee shall deliver its opinion on the draft, within a time limit which the Chairman may lay down according to the urgency of the matter, if necessary by taking a vote.

The opinion shall be recorded in the minutes; in addition, each Member State shall have the right to ask to have its position recorded in the minutes.

The Commission shall take the utmost account of the opinion delivered by the Committee. It shall inform the Committee of the manner in which its opinion has been taken into account.

Article 8

The representative of the Commission shall submit to the Committee a draft of the measures to be taken. The Committee shall deliver its opinion on the draft within a time limit which the Chairman may lay down according to the urgency of the matter. The opinion shall be delivered by the majority laid down in Article 148 (2) of the Treaty in the case of decisions which the Council is required to adopt on a proposal from the Commission. The votes of the representatives of the Member States within the Committee shall be weighted in the manner set out in that Article. The Chairman shall not vote.

The Commission shall adopt the measures envisaged if they are in accordance with the opinion of the Committee.

If the measures envisaged are not in accordance with the opinion of the Committee, of if no opinion is delivered, the Commission shall, without delay, submit to the Council a proposal relating to the measures to be taken. The Council shall act by a qualified majority.

If, on the expiry of a period of three months from the date of referral to it the Council has not acted, the proposed measures shall be adopted by the Commission, save where the Council has decided against the said measures by a simple majority.

Done at Brussels, 31 March 1992. For the Council The President Vitor MARTINS

(1) OJ No C 277, 5. 11. 1990, p. 18.

(2) OJ No C 94, 13. 3. 1992.

(3) OJ No C 159, 17. 6. 1991, p. 38.