EN Official Journal of the European Union C 126/1

Decision of the High Representative of the Union for Foreign Affairs and Security Policy of 19 September 2017 on the security rules for the European External Action Service

ADMIN(2017) 10

(2018/C 126/01)

THE HIGH REPRESENTATIVE OF THE UNION FOR FOREIGN AFFAIRS AND SECURITY POLICY,

Having regard to Council Decision 2010/427/EU of 26 July 2010 establishing the organisation and functioning of the European External Action Service (1) (‘EEAS’),

Having regard to the opinion of the Committee referred to in Article 9(6) of the Decision of the High Representative of 15 June 2011 on the security rules for the European External Action Service (2),

Whereas:

(1) The EEAS, as a functionally autonomous body of the European Union (EU), should have security rules as referred to in Article 10(1) of the Council Decision 2010/427/EU;

(2) The High Representative of the Union for Foreign Affairs and Security Policy (hereinafter ‘High Representative’ or ‘HR’) should decide on security rules for the EEAS covering all aspects of security regarding the functioning of the EEAS, so that it can manage effectively the risks to staff placed under its responsibility, to its physical assets, information, and visitors, and fulfil its duty of care responsibilities in this regard;

(3) In particular, a level of protection should be afforded to staff placed under the responsibility of the EEAS, to EEAS physical assets, including communication and information systems, information, and visitors, which is in line with the best practice in the Council, the Commission, the Member States and, as appropriate, in international organisations;

(4) The security rules for the EEAS should help achieve a more coherent comprehensive general framework within the EU for protecting EU Classified Information (hereinafter referred to as ‘EUCI’), building on, and maintaining as much coherence as possible with, the Council of the European Union (hereinafter referred to as ‘the Council’) security rules and the European Commission security provisions;

(5) The EEAS, the Council and the Commission are committed to applying equivalent security standards for protecting EUCI;

(6) This Decision is taken without prejudice to Articles 15 and 16 of the Treaty on the Functioning of the European Union (TFEU) and to instruments implementing them;

(7) It is necessary to establish the organisation of security in the EEAS and the allocation of security tasks within the EEAS structures;

(8) The High Representative should draw on relevant expertise in the Member States, in the General Secretariat of the Council and in the Commission as necessary;

(9) The High Representative should take all appropriate measures necessary to implement these rules with the support of the Member States, the General Secretariat of the Council and the Commission;

(10) The Secretary-General of the EEAS is the Security Authority of the EEAS, and Article 1 of Decision ADMIN (2015)34 of 14 September 2015 of the Secretary General of the European External Action Service provides that the security functions of the Security Authority, as provided for in the EEAS security rules, shall be exercised by the Director-General for budget and administration,

HAS ADOPTED THIS DECISION:

Article 1

Purpose and scope

This Decision lays down the security rules for the European External Action Service (hereinafter ‘EEAS security rules’).

Pursuant to Article 10(1) of Council Decision 2010/427/EU of 26 July 2010 establishing the organisation and functioning of the European External Action Service, it shall apply to all EEAS staff and all staff in Union Delegations, regardless of their administrative status or origin, and it shall establish the general regulatory framework for managing effectively the risks to staff placed under the responsibility of the EEAS as referred to in Article 2, to EEAS premises, physical assets, information, and visitors.

Article 2

Definitions

For the purpose of this decision, the following definitions shall apply:

(a) ‘EEAS staff’ means EEAS officials and other servants, including personnel from the diplomatic services of the Member States appointed as temporary agents, and seconded national experts, as defined in Article 6 of Council Decision 2010/427/EU of 26 July 2010 establishing the organisation and functioning of the European External Action Service.

(b) ‘Staff placed under the responsibility of the EEAS’ means the EEAS staff at Headquarters and in Union Delegations and all other staff in Union Delegations, regardless of their administrative status or origin, as well as, in the context of this decision, the High Representative and, as appropriate, other staff resident in EEAS Headquarters premises.

(c) ‘Dependants’ means the members of the family of the staff member placed under the responsibility of the EEAS in Union Delegations forming part of their respective household as notified to the Ministry for Foreign Affairs of the receiving State.

(d) ‘EEAS premises’ means all EEAS establishments, including buildings, offices, rooms and other areas, as well as areas housing communication and information systems (including those handling EUCI), where the EEAS conducts permanent or temporary activities.

(e) ‘EEAS security interests’ means the Staff placed under the responsibility of the EEAS, EEAS premises, dependants, physical assets, including communication and information systems, information, and visitors.

(f) ‘EUCI’ means any information or material designated by an EU security classification, the unauthorised disclosure of which could cause varying degrees of prejudice to the interests of the European Union or of one or more of the Member States.

(g) ‘Union Delegation’ means delegations to third countries and international organisations as referred to in Article 1(4) of Council Decision 2010/427/EU of 26 July 2010 establishing the organisation and functioning of the European External Action Service.

Other definitions are listed in the relevant Annexes and in Appendix A.

Article 3

Duty of care

1. The EEAS security rules shall aim at fulfilling the duty of care responsibilities of the EEAS.

2. The EEAS duty of care comprises due diligence in taking all reasonable steps to implement security measures to prevent reasonably foreseeable harm to EEAS security interests.

It encompasses both security and safety components, including those resulting from emergency situations or crises, whatever their nature.

3. Taking into account the duty of care responsibility of Member States, EU institutions or bodies and other parties with staff in Union Delegations and/or in Union Delegation premises, or such responsibility incumbent upon the EEAS when Union Delegations are hosted in above mentioned other parties' premises, the EEAS shall enter into administrative arrangements with each of the above entities that shall address the respective roles and responsibilities, tasks and cooperation mechanisms.

Article 4

Physical and infrastructure security

1. The EEAS shall put in place all appropriate physical security measures (whether permanent or temporary), including access control arrangements, in all EEAS premises, for the protection of EEAS security interests. Such measures shall be taken into account in the design and the planning of new premises or before leasing existing premises.

2. Special obligations or restrictions can be imposed on staff placed under the responsibility of the EEAS and on dependants, for security reasons, for a specific period and in specific areas.

3. The measures referred to in paragraphs 1 and 2 shall be commensurate with the assessed risk.

Article 5

Alert states and management of crisis situations

1. The EEAS Security Authority as defined in Article 13(1), Section I, shall be responsible for putting in place appropriate alert state measures in anticipation of or in response to threats and incidents affecting security at the EEAS, and for measures required for managing crisis situations.

2. The alert state measures referred to in paragraph 1 shall be commensurate with the level of threat to security. The alert state levels shall be defined in close cooperation with the competent services of other Union institutions, agencies and bodies, and of the Member State or Member States hosting EEAS premises.

3. The EEAS Security Authority shall be the contact point for alert states and management of crisis situations.

Article 6

The protection of classified information

1. The protection of EUCI shall be governed by the requirements laid down in this decision, and in particular in Annex A. The holder of any item of EUCI shall be responsible for protecting it accordingly.

2. The EEAS shall ensure that access to classified information is only granted to individuals who meet the conditions set out in Article 5 of Annex A.

3. The conditions under which local agents may have access to EUCI shall also be laid down by the High Representative, in accordance with the rules for protecting EUCI laid down in Annex A to this decision.

4. The EEAS Directorate responsible for Security manages a database on the security clearance status of all staff placed under the responsibility of the EEAS and of EEAS contractors.

5. Where Member States introduce classified information bearing a national security classification marking into the structures or networks of the EEAS, the EEAS shall protect that information in accordance with the requirements applicable to EUCI at the equivalent level, as set out in the table of equivalence of security classifications contained in Appendix B to this decision.

6. Areas in the EEAS, in which information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above, or classified at an equivalent level, is stored, shall be established as Secured Areas in accordance with the rules pursuant to Annex AII to this decision, and shall be approved by the EEAS Security Authority.

7. Procedures for performing High Representative responsibilities in the framework of agreements or administrative arrangements for the exchange of EUCI with third States or international organisations are described in Annexes A and AVI of this Decision.

8. The Secretary General shall determine the conditions under which the EEAS may share EUCI held by it with other Union institutions, bodies, offices or agencies. An appropriate framework will be put in place to that effect, including by entering into interinstitutional agreements or other arrangements where necessary for that purpose.

9. Any such framework shall ensure that EUCI is given protection appropriate to its classification level and according to basic principles and minimum standards which shall be equivalent to those laid down in this Decision.

Article 7

Security incidents and emergencies

1. In order to ensure a timely and effective response to security incidents, the EEAS shall establish a process for reporting such incidents and emergencies, which shall be operational twenty-four hours a day, seven days a week and cover any kind of security incidents or threats to the EEAS security interests (e.g. accidents, conflict, malicious acts, criminal acts, kidnap and hostage situations, medical emergencies, communication and information systems incidents, cyber-attacks, etc.).

2. Emergency liaison channels shall be established between the EEAS Headquarters, the Union Delegations, the Council, the Commission, the EU Special Representatives and Member States, to support them in managing security incidents involving personnel and their consequences, including contingency planning.

3. This security incident management shall include, inter alia:

— procedures for effectively supporting the decision-making process in relation to a security incident involving personnel, including decisions relating to the extraction or the suspension of a mission, and

— a policy and procedures for personnel recovery — e.g. in the case of missing personnel or kidnap and hostage situations — taking into account the particular responsibilities of the Member States, of the EU Institutions and of the EEAS in this regard. The need for specific capabilities, within the management of such operations in this regard, shall be considered taking into account the resources that could be provided by the Member States.

4. The EEAS shall put in place appropriate administrative arrangements for reporting security incidents in Union Delegations. When appropriate, the Member States, the Commission, any other relevant authority, as well as the relevant Security Committees shall be informed.

5. The incident management processes should be regularly exercised and reviewed.

Article 8

Security of communication and information systems

1. The EEAS shall protect information handled in communication and information systems (‘CIS’) against threats to confidentiality, integrity, availability, authenticity and non-repudiation.

2. Rules, security Guidelines and a security programme for protecting all CIS owned or operated by EEAS shall be approved by the EEAS Security Authority.

3. The rules, the policy and the programme shall be in conformity and their implementation closely coordinated with those of the Council and the Commission, and, where appropriate, with the security policies applied by the Member States.

4. All CIS handling classified information shall undergo an accreditation process. The EEAS shall apply a system for managing security accreditation in consultation with the General Secretariat of the Council and the Commission.

5. Where the protection of EUCI handled by the EEAS is provided by cryptographic products, such products shall be approved by the EEAS Crypto Approval Authority on a recommendation by the Council Security Committee.

6. The EEAS Security Authority shall, to the extent necessary, establish the following information assurance functions:

(a) an information assurance authority;

(b) a TEMPEST authority;

(c) a crypto approval authority;

(d) a crypto distribution authority.

7. For each system, the EEAS Security Authority shall establish the following functions:

(a) a security accreditation authority;

(b) an information assurance operational authority.

8. Provisions for implementing this Article as regards the protection of EUCI are set out in Annex A and A IV.

Article 9

Security breaches and compromise of classified information

1. A breach of security occurs as the result of an act or omission which is contrary to the security rules laid down in this Decision and/or to the security policies or guidelines setting out any measures necessary for its implementation, as approved in accordance with Article 21(1).

2. A compromise of classified information occurs when it has wholly or in part been disclosed to unauthorised persons or entities.

3. Any breach or suspected breach of security, and any compromise or suspected compromise of classified information shall be reported immediately to the EEAS Directorate responsible for security, which shall take appropriate measures as set out in Annex A, Article 11.

4. Any individual who is responsible for a breach of the security rules laid down in this Decision, or for compromising classified information, may be liable to disciplinary and/or legal action, in accordance with the applicable laws, rules and regulations, as set out in Article 11(3) of Annex A.

Article 10

Investigation of security incidents, breaches and/or compromises and corrective actions

1. Without prejudice to Article 86 (disciplinary measures) and Annex IX of the Staff Regulations (3), security investigations may be conducted by the EEAS Directorate responsible for security:

(a) in case of potential leakage, mishandling or compromise of EUCI, Euratom Classified Information or sensitive non-classified information;

(b) to counter hostile intelligence service attacks against the EEAS and its staff;

(c) to counter terrorist attacks against the EEAS and its staff;

(d) in case of cyber-incidents;

(e) in case of other incidents that affect or may affect general security at the EEAS, including suspected criminal offences;

2. The EEAS Directorate responsible for security assisted by experts from Member States and/or from other EU institutions as appropriate, and upon authorisation from the EEAS Security Authority as necessary, shall implement any necessary corrective actions resulting from investigations, when and as appropriate.

Only staff authorised on the basis of a nominative mandate conferred on them by the EEAS Security Authority, given their current duties, may be entrusted with the power to conduct and coordinate security investigations in the EEAS.

3. Investigators shall have access to all information necessary for the conduct of such investigations and shall receive the full support of all EEAS services and staff in this regard.

Investigators may take appropriate actions to safeguard the trail of evidence in a manner that is proportionate to the seriousness of the matter under investigation.

4. Where access to information relates to personal data, including those contained in communication and information systems, such access shall be in accordance with Regulation (EC) 45/2001 (4).

5. Where it is necessary to establish an investigative database that will contain personal data, the European Data Protection Supervisor (EDPS) shall be notified in accordance with the aforementioned regulation.

Article 11

Security risk management

1. In order to determine its protective security needs, the EEAS shall develop, in close cooperation with the Security Directorate of the Commission and, where appropriate, with the Security Office of the General Secretariat of the Council, a comprehensive security risk assessment methodology.

2. Risks to EEAS security interests shall be managed as a process. This process shall be aimed at determining known security risks, at defining security measures to reduce such risks to an acceptable level and at applying measures in line with the concept of defence in depth. The effectiveness of such measures, and the level of risk, shall be continuously evaluated.

3. The roles, responsibilities and tasks laid down in this Decision are without prejudice to the responsibility of each member of staff placed under the responsibility of the EEAS; in particular EU staff on mission in third countries must exercise common sense and good judgement with regard to their own safety and security, and comply with all applicable security rules, regulations, procedures and instructions.

4. In order to prevent and control risks to security, mandated staff may carry out background checks of persons falling under the scope of this Decision, so as to determine whether giving such persons access to EEAS premises or information presents a threat to security. For that purpose, and in compliance with Regulation (EC) No 45/2001, the mandated staff concerned may: (a) use any source of information available to the EEAS, taking into account the reliability of the source of information; (b) access the personnel file or data the EEAS holds with regard to individuals it employs or intends to employ, or for contractors' staff when duly justified.

5. The EEAS shall take all reasonable measures to ensure its security interests are protected, and to prevent reasonably foreseeable damage thereto.

6. Security measures in the EEAS for protecting EUCI throughout its life cycle shall be commensurate in particular with its security classification level, with the form and volume of the information or material, with the location and construction of facilities housing EUCI and with the threat, including the locally assessed threat, of malicious and/or criminal activities, including espionage, sabotage and terrorism.

Article 12

Security awareness and training

1. The EEAS Security Authority shall ensure that appropriate security awareness and training programmes are drawn up and implemented, and that Staff placed under the responsibility of the EEAS as well as, where appropriate, their dependants, receive the necessary awareness briefings and training commensurate with the risks in their place of work or residence.

2. Before being granted access to EUCI and at regular intervals thereafter, staff shall be briefed on and acknowledge their responsibilities to protect EUCI in accordance with the rules pursuant to Article 6.

Article 13

Organisation of security in the EEAS

1. The Secretary General shall be the Security Authority of the EEAS. In that capacity, the Secretary General shall ensure that:

(a) security measures are coordinated as necessary with the competent authorities of the Member States, the General Secretariat of the Council and the Commission, and, as appropriate, of third States or international organisations, on all security matters relevant for the EEAS' activities, including on the nature of risks to the EEAS security interests and the means of protection against them;

(b) security aspects are fully taken into account from the outset for all EEAS activities;

(c) access to classified information is only granted to individuals who meet the conditions set out in Article 5 of Annex A;

(d) a registry system is established which shall ensure that information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above is handled in accordance with this Decision within EEAS, and when released to EU Member States, EU Institutions, bodies or agencies or other authorised recipients. A separate record shall be kept of all EUCI released by the EEAS to third States or international organisations, and of all classified information received from third States or international organisations;

(e) security inspections referred to in Article 16 are undertaken;

(f) investigations are conducted into any actual or suspected breach of security, as well as into any actual or suspected compromise or loss of classified information held by or originated in the EEAS, and that the relevant security authorities are requested to assist in such investigations;

(g) appropriate incident and consequence management plans and mechanisms are established, in order to provide a timely and effective response to security incidents;

(h) appropriate measures are taken in the event of failure by individuals to comply with this Decision;

(i) appropriate physical and organisational measures are in place for the protection of the EEAS security interests. In this regard, the EEAS Security Authority: — sets the security category of the Union Delegations, in consultation with the Commission, — decides, after consulting the HR, where appropriate, when Union Delegation staff should be evacuated if the security situation requires it, — decides on the measures to be applied for the protection of dependants, when appropriate, taking into account arrangements with EU institutions as referred to in article 3(3); — approves the crypto communication policy, in particular the programme of installation of cryptographic products and mechanism.

2. The EEAS Security Authority shall be assisted in this task by the DGBA, by the EEAS Director responsible for security, and, as appropriate, by the Deputy Secretary-General for CSDP and Crisis Response.

3. The Secretary-General as EEAS Security Authority may delegate tasks in this regard, as appropriate.

4. Each Head of department/division shall be responsible for implementing rules on protecting EUCI within his department/division.

Whilst remaining responsible as mentioned above, each Head of department/division shall designate staff for a Departmental Security Coordinator function, whose resources shall be proportionate to the amount of EUCI handled by that department/division.

Departmental Security Coordinators shall, when and as appropriate, assist and support their Head of department/division in performing tasks related to security, such as:

(a) developing any additional security requirements appropriate to the specific needs of the department/division;

(b) giving periodic security briefings to the members of their department/division;

(c) ensuring the need-to-know principle is respected in their department/division;

(d) maintaining up-to-date a list of safe codes and keys;

(e) maintaining security procedures and security measures;

(f) reporting any breaches of security and/or compromise of EUCI both to their Director and to the Directorate responsible for security;

(g) debriefing staff who cease to be employed by the EEAS;

(h) providing regular reports through their hierarchy on department/division's security matters;

(i) liaising with the EEAS Directorate responsible for security on security issues.

Any activity or issue that might have an impact on security shall be notified to the EEAS Directorate responsible for security in a timely manner.

5. Each Head of Delegation shall be responsible for implementing all measures relating to the security of the Union Delegation.

1. The EEAS shall have a Directorate responsible for security. It shall:

(a) manage, coordinate, supervise and/or implement all security measures in all premises under the responsibility of the EEAS, at Headquarters, within the EU and in third States;

(b) ensure coherence and consistency with this decision and with implementing provisions of any activity which may have an impact on protecting EEAS security interests;

(c) be the principal adviser of the HR, of the EEAS Security Authority and of the Deputy Secretary-General on all matters related to security;

(d) be assisted by the competent services of the Member States, in accordance with Article 10(3) of Council Decision 2010/427/EU establishing the organisation and functioning of the EEAS.

(e) support the activities of the EEAS Security Accreditation Authority by carrying out physical security assessments of the General Security Environment (GSE) / Local Security Environment (LSE) of communication and information systems handling EUCI, and of premises to be authorised for handling and storing EUCI.

2. The EEAS Director responsible for security shall be responsible for:

(a) ensuring the overall protection of the EEAS security interests;

(b) drafting, reviewing and updating of the security rules, as well as co-ordinating security measures with the competent authorities of the Member States and, as appropriate, the competent authorities of third States and international organisations linked to the EU by security agreements and/or arrangements;

(c) supporting the EEAS Security Committee proceedings, as set out in Article 15(1) of this Decision;

(d) liaising with any partners or authorities other than those under (b) above on security matters, where appropriate;

(e) prioritising and making proposals for the management of the budget for security in Headquarters and in Union Delegations.

3. The Head of the EEAS Directorate responsible for security shall:

(a) ensure that security breaches and compromises are recorded and investigations are launched and undertaken where and when necessary;

(b) meet regularly, and whenever necessary, to discuss areas of common interest with the Director of Security of the General Secretariat of the Council and the Director of the Security Directorate of the Commission.

4. The EEAS Directorate responsible for security shall establish contact and maintain close cooperation with:

— the departments in charge of security in the Ministries of Foreign Affairs of the Member States;

— the National Security Authorities (NSAs) and/or the other competent security authorities of Member States, to elicit their assistance in regard to the information it needs to assess such dangers and threats as may face the EEAS, its staff, its activities, its assets and resources and its classified information at its usual place of business;

— the competent security authorities of the Member States or Host States on the territory of which the EEAS may exercise its activity, regarding any matter relating to the protection of its staff, its activity, its assets and resources, and its classified information while on their territory;

— the Security Office of the General Secretariat of the Council and the Security Directorate of the Directorate General for Human Resources and Security of the Commission, and, where appropriate the security departments of the other EU institutions, bodies and agencies;

— the security departments of third States or international organisations, with a view to any useful co-ordination; and

— the Member States' NSAs, regarding any matter relating to the protection of EUCI.

1. Each Head of Delegation shall be responsible for locally implementing and managing all measures relating to the protection of EEAS security interests within the Union Delegations' premises and competence.

In consultation with the competent authorities of the Host State when necessary, he will take all reasonably practicable measures to ensure that appropriate physical and organisational measures are in place to achieve this aim.

The Head of Delegation shall draw up security procedures for the protection of the dependants as defined in Article 2(c), when appropriate, taking into account any administrative arrangement, as referred to in Article 3(3). The Head of Delegation shall report on all security related issues within his remit to the Head of the EEAS Directorate responsible for security.

He shall be assisted, in these tasks, by the EEAS Directorate responsible for security, by the Union Delegation's Security Management Team which is composed of staff exercising security tasks and functions, and by security staff posted where necessary.

The Union Delegation shall establish regular contacts and maintain close cooperation in security matters with Member States' diplomatic missions.

2. In addition, the Head of Delegation will:

— establish detailed Union Delegation security and contingency plans, on the basis of generic standard operating procedures;

— operate an effective 24/7 system for managing security incidents and emergencies within the Union Delegation scope of operation;

— ensure that all staff deployed in the Union Delegation are covered by insurance as required by the conditions in the area;

— ensure that security is part of the Union Delegation induction training to be given to all staff deployed in the Union Delegation upon arriving in the Union Delegation; and

— ensure that any recommendations made following security assessments are implemented, and provide written reports at regular intervals on their implementation and on other security issues to the EEAS Security Authority.

3. Whilst remaining both responsible and accountable for safeguarding the security management as well as for ensuring corporate resilience, the Head of Delegation may delegate the execution of his or her security tasks to the Delegation Security Coordinator (‘DSC’), being the Deputy Head of Delegation or, where none is appointed, an appropriate alternative.

In particular, the following responsibilities may be entrusted to the DSC:

— to coordinate security functions in the Union Delegation;

— to liaise on security issues with competent authorities of the host State and the appropriate counterparts in the Member States embassies and diplomatic missions;

— to implement appropriate security management procedures related to the EEAS Security interests, including the protection of EUCI;

— to ensure compliance with security rules and instructions;

— to brief staff about the security rules that are applicable to them, and on the particular risks in the host State;

— to submit requests to the EEAS Directorate responsible for security clearances regarding those positions which require a Personnel Security Clearance (PSC); and

— to keep the Head of Delegation, the Regional Security Officer (RSO) and the EEAS Directorate responsible for security continuously informed with regard to incidents or developments in the area which have a bearing on the protection of EEAS security interests.

4. The Head of Delegation may delegate security tasks of an administrative or technical character to the Head of Administration and other members of the Union Delegation's staff.

5. The Union Delegation shall be assisted by an RSO. The RSOs shall undertake the roles defined below in the Union Delegations within each of their respective geographical areas of responsibility.

In certain circumstances, where the prevailing security situation dictates, a dedicated RSO may be assigned to a specific Union Delegation as full time resident.

An RSO may be required to relocate to an area outside his present area of responsibility, including the Headquarters, or even take up a residential post according to the relevant security situation in any country, and as required by the EEAS Directorate responsible for security.

6. The RSOs shall be under the direct operational control of the EEAS Headquarters service in charge of Field Security, but under the shared administrative control of the Head of Delegation of their place of employment and the Headquarters service in charge of Field Security. They shall advise and assist the Head of Delegation and the Union Delegation's staff in arranging and implementing all physical, organisational and procedural measures related to the security of the Union Delegation.

7. RSOs provide the Head of Delegation and Union Delegation staff with advice and support. Where appropriate, in particular where an RSO is a full time resident, he or she should assist a Union Delegation in security management and implementation, including the preparation of security contracts, the management of accreditations and clearances.

Article 14

CSDP Operations and EU Special Representatives

The EEAS Directorate responsible for security advises the Director of the Crisis Management and Planning Directorate (CMPD), the Director General of the EU Military Staff (EUMS), the Civilian Operations Commander heading the Civilian Planning and Conduct Capacity (CPCC), and the EU Military Operations Commanders on security aspects of CSDP operations, and the EU Special Representatives on security aspects of their mandate, complementary to the specific provisions existing in this regard in the relevant policies adopted by the Council.

Article 15

The EEAS Security Committee

1. An EEAS Security Committee is hereby established.

It shall be chaired by the EEAS Security Authority or a designated delegate, and shall meet as instructed by the Chair or at the request of any of its members. The EEAS Directorate responsible for security shall support the Chair in this function and provide administrative assistance, as necessary, to the Committee proceedings.

2. The EEAS Security Committee shall be composed of representatives of:

— each Member State;

— the Security Office of the General Secretariat of the Council;

— the Security Directorate of the Directorate General for Human Resources and Security of the Commission.

A Member State delegation to the EEAS Security Committee may consist of members of:

— the National Security Authority and/or the Designated Security Authority,

— the departments in charge of security in the Ministries of Foreign Affairs.

3. The Committee's representatives may be accompanied and advised by experts as they deem necessary. Representatives of other EU Institutions, agencies or bodies may be invited to attend when issues relevant to their security are discussed.

4. Without prejudice to paragraph 5 below, the EEAS Security Committee shall assist the EEAS, by means of consultation, on all security issues relevant to EEAS activities, to Headquarters and Union Delegations.

In particular, without prejudice to paragraph 5 below, the EEAS Security Committee:

(a) shall be consulted on: — security policies, guidelines, concepts or other methodology documents related to security, in particular as regards the protection of classified information and the measures to be taken in the event of a failure by EEAS staff to comply with the security rules; — technical security aspects which may influence the HR decision to submit a recommendation to the Council for the opening of negotiations for security of information agreements referred to in Article 10,1(a) of Annex A; — any amendments to this decision.

(b) may be consulted or informed, as appropriate, on issues relating to the security of staff and assets within EEAS Headquarters and Union Delegations, without prejudice to Article 3(3);

(c) shall be informed of any compromises or losses of EUCI occurred within the EEAS.

5. Any change to the rules relating to the protection of EUCI contained in this decision and its Annex A shall require the unanimous favourable opinion of the Member States as represented in the EEAS Security Committee. Such unanimous favourable opinion shall also be required before:

— entering into negotiations of administrative arrangements as referred to in Article 10(1)(b) of Annex A;

— releasing classified information in the exceptional circumstances referred to in Paragraphs 9, 11 and 12 of Annex A VI

— assuming the information originator's responsibility in the circumstances referred to in Article 10(6), last sentence, of Annex A.

When a unanimous favourable opinion is requested, this condition will be met when no objections are expressed by Member States delegations during the Committee proceedings.

6. The EEAS Security Committee shall take full account of security policies and guidelines in force in the Council and the Commission.

7. The EEAS Security Committee receives the list of annual EEAS inspections, and the inspection reports, once finalised.

8. Organisation of the meetings:

— The EEAS Security Committee shall meet at least twice a year. Additional meetings, either in its fully fledged configuration or in NSA/DSA or in MFA security format, can be arranged by the Chair or requested by the members of the Committee.

— The EEAS Security Committee shall organise its activities in such a way that it can make recommendations on specific areas of security. It may establish other expert sub-areas as necessary. It shall draw up terms of reference for such expert sub-areas and receive reports from them on their activities.

— The EEAS Directorate responsible for security shall be responsible for preparing items for discussion. The Chair shall draw up the provisional agenda for each meeting. The members of the Committee may propose additional items for discussion.

Article 16

Security inspections

1. The EEAS Security Authority shall ensure that security inspections are undertaken, on a regular basis, within the EEAS Headquarters and within Union Delegations in order to assess the adequacy of security measures and to verify their compliance with this Decision. The EEAS Directorate responsible for security may, where appropriate, designate contributing experts to participate in security inspections to EU agencies and bodies established under title V, Chapter 2 of the TEU.

2. EEAS security inspections are conducted under the authority of the EEAS Directorate responsible for security and, when appropriate, with the support of security experts representing other EU Institutions or Member States, in particular in the context of the arrangements referred to in Article 3(3).

3. The EEAS may draw, as necessary, on expertise in the Member States, in the General Secretariat of the Council and in the Commission.

Where necessary, relevant security experts based in Member State Missions in the third States and/or representatives of the diplomatic security departments of the Member States may be invited to participate in the security inspection of the Union Delegation.

4. Provisions for implementing this Article as regards the protection of EUCI are set out in Annex A III.

Article 17

Assessment visits

Assessment visits shall be arranged to ascertain the effectiveness of the security measures in place in a third State or international organisation for protecting EUCI exchanged under an administrative arrangement as referred to in Article 10(1)(b) of Annex A.

The EEAS Directorate responsible for security may designate contributing experts to participate in assessment visits to third States or international organisations with which the EU has concluded a Security of Information Agreement as referred to in Article 10(1)(a) of Annex A,

Article 18

Business continuity planning

The EEAS Directorate responsible for security shall assist the EEAS Security Authority in managing the security-related aspects of EEAS business continuity processes as part of the overall Business Continuity Planning of the EEAS.

Article 19

Travel advice for missions outside the EU

The EEAS Directorate responsible for security shall ensure the availability of travel advice regarding missions of staff placed under the responsibility of the EEAS outside the EU, drawing upon the resources of all relevant services of the EEAS — in particular the SITROOM, the INTCEN, the geographical departments and the Union Delegations.

The EEAS Directorate responsible for security provides, on request, and drawing upon aforementioned resources, specific travel advice regarding missions by staff placed under the responsibility of the EEAS to third States presenting a high risk or an increased risk level.

Article 20

Health and Safety

The EEAS security rules complement the EEAS rules for the protection of health and safety, as adopted by the High Representative.

Article 21

Implementation and review

1. The EEAS Security Authority shall, after consultation with the EEAS Security Committee as appropriate, approve security Guidelines setting out any measures necessary to implement these rules in the EEAS, and shall build up the necessary capacity covering all aspects of security, in close cooperation with the Member States' competent security authorities and with the support of the relevant services of the EU Institutions.

2. In accordance with article 4(5) of Council Decision 2010/427/EU of 26 July 2010 establishing the organisation and functioning of the European External Action Service, transitional arrangements may be used, as necessary, through service-level agreements with the relevant services of the General Secretariat of the Council and of the Commission.

3. The HR shall ensure overall consistency in the application of this Decision, and shall keep these security rules under review.

4. The EEAS security rules are to be implemented in close cooperation with the Member States' competent security authorities.

5. EEAS shall ensure that all aspects of the security process are taken into account within the EEAS crisis response system.

6. The Secretary General, as Security Authority, and the Head of the EEAS Directorate responsible for security shall ensure implementation of this decision.

Article 22

Replacement of previous decisions

This decision shall repeal and replace the Decision of the High Representative of the Union for Foreign Affairs and Security Policy of 19 April 2013 on the security rules for the European External Action Service (5).

Article 23

Final provisions

This decision shall enter into force on the date of its signature.

It shall be published in the Official Journal of the European Union.

The competent authorities in the EEAS shall duly and timely inform all staff falling within the scope of this decision and its annexes, on the content, entry into force and any subsequent modifications thereof.

Done at Brussels, 19 September 2017. Federica MOGHERINI High Representative of the Union for Foreign Affairs and Security Policy

(1) OJ L 201, 3.8.2010, p. 30.

(2) OJ C 304, 15.10.2011, p. 7.

(3) Staff regulations of Officials of the European Union and the Conditions of Employment of Other Servants of the European Union, laid down in Regulation (EEC, Euratom, ECSC) No 259/68 of the Council (OJ L 56, 4.3.1968, p. 1), hereinafter referred to as ‘the Staff Regulations’.

(4) Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).

(5) OJ C 190, 29.6.2013, p. 1.