COMMISSION DECISION (EU, Euratom) 2021/259

of 10 February 2021

laying down implementing rules on industrial security with regard to classified grants

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249 thereof,

Having regard to the Treaty establishing the European Atomic Energy Community, and in particular Article 106 thereof,

Having regard to Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012 (1),

Having regard to Commission Decision (EU, Euratom) 2015/443 of 13 March 2015 on Security in the Commission (2),

Having regard to Commission Decision (EU, Euratom) 2015/444 of 13 March 2015 on the security rules for protecting EU classified information (3),

Having regard to Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission (4),

After consulting the Commission Security Expert Group, in accordance with Article 41(5) of Decision (EU, Euratom) 2015/444,

Whereas:

(1) Articles 41, 42, 47 and 48 of Decision (EU, Euratom) 2015/444 provide that more detailed provisions to supplement and support Chapter 6 of that Decision are to be laid down in implementing rules on industrial security, governing issues such as the award of classified grant agreements, facility security clearances, personnel security clearances, visits and transmission and carriage of European Union classified information (‘EUCI’).

(2) Decision (EU, Euratom) 2015/444 states that classified grant agreements are to be implemented in close cooperation with the national security authority, the designated security authority or any other competent authority of the Member States concerned. The Member States have agreed to ensure that any entity under their jurisdiction which may receive or generate classified information originating in the Commission is appropriately security cleared and is capable of providing suitable protection equivalent to that afforded by the security rules of the Council of the European Union for protecting EU classified information bearing a corresponding classification marking, as provided for in the Agreement between the Member States of the European Union, meeting within the Council, regarding the protection of classified information exchanged in the interests of the European Union (2011/C 202/05) (5).

(3) The Council, the Commission and the High Representative of the Union for Foreign Affairs and Security Policy have agreed to ensure maximum consistency in the application of security rules regarding their protection of EUCI, while taking into account their specific institutional and organisational needs, in accordance with the declarations attached to the minutes of the Council session at which Council Decision 2013/488/EU (6) on the security rules for protecting EU classified information was adopted.

(4) The Commission’s implementing rules on industrial security with regard to classified grants should therefore also ensure maximum consistency and take into account the Guidelines on Industrial Security approved by the Council Security Committee on 13 December 2016.

(5) On 4 May 2016 the Commission adopted a decision (7) empowering the Member of the Commission responsible for security matters to adopt, on behalf of the Commission and under its responsibility, the implementing rules provided for in Article 60 of Decision (EU, Euratom) 2015/444,

HAS ADOPTED THIS DECISION:

CHAPTER 1

GENERAL PROVISIONS

Article 1 Subject matter and scope 1. This Decision sets out implementing rules on industrial security with regard to classified grants within the meaning of Decision (EU, Euratom) 2015/444, and in particular Chapter 6 of that Decision. 2. This Decision lays down specific requirements to ensure the protection of EU classified information (EUCI) in the publication of calls, and when awarding grants and implementing the classified grant agreements concluded by the European Commission. 3. This Decision applies to grants involving information classified at the following levels: (a) RESTREINT UE/EU RESTRICTED; (b) CONFIDENTIEL UE/EU CONFIDENTIAL; (c) SECRET UE/EU SECRET. 4. This Decision applies without prejudice to specific rules laid down in other legal acts, such as those concerning the European Defence Industrial Development Programme.

Article 2 Responsibilities within the Commission 1. As part of the responsibilities of the authorising officer of the granting authority referred to in Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council, he or she shall ensure that the classified grant complies with Decision (EU, Euratom) 2015/444 and its implementing rules. 2. To that end, the authorising officer concerned shall, at all stages, seek the advice of the Commission security authority on issues regarding the security elements of a classified grant agreement, programme or project, and shall inform the local security officer about the signed classified grant agreements. The decision on the classification level of specific subjects shall rest with the granting authority and shall be taken with due regard to the security classification guide. 3. Where the programme or project security instructions referred to in Article 5(3) are applied, the granting authority and the Commission security authority shall discharge the responsibilities assigned to them in those instructions. 4. In respecting the requirements of these implementing rules, the Commission security authority shall cooperate closely with the national security authorities (‘NSAs’) and the designated security authorities (‘DSAs’) of the Member States concerned, in particular as regards facility security clearances (‘FSCs’) and personnel security clearances (‘PSCs’), visit procedures and transportation plans. 5. Where grants are managed by EU executive agencies or other funding bodies and the specific rules laid down in other legal acts referred to in Article 1(4) do not apply: (a) the delegating Commission department shall exercise the rights pertaining to the originator of EUCI generated in the context of the grants if the delegation arrangements so provide; (b) the delegating Commission department shall be responsible for determining the security classification; (c) requests for security clearance information and the notifications to NSAs and/or DSAs shall be sent through the Commission security authority.

CHAPTER 2

HANDLING OF CALLS FOR CLASSIFIED GRANTS

Article 3 Basic principles 1. Classified parts of the grants shall be implemented only by beneficiaries registered in a Member State, or by beneficiaries registered in a third country or established by an international organisation where that third country or international organisation has concluded a security of information agreement with the Union or entered into an administrative arrangement with the Commission (8). 2. Before launching a call for a classified grant, the granting authority shall determine the security classification of any information that could be provided to applicants. The granting authority shall also determine the maximum security classification of any information used or generated in the performance of the grant agreement or programme or project, or at least the anticipated volume and type of information to be produced or handled, and the need for a classified communication and information system (CIS). 3. The granting authority shall ensure that calls for classified grants provide information about the special security obligations related to classified information. The call documentation shall include clarifications about the timeline for beneficiaries to obtain the FSCs, where they are required. Annexes I and II contain sample templates for information regarding the call conditions. 4. The granting authority shall ensure that information classified RESTREINT UE/EU RESTRICTED, CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET is disclosed to applicants only after they have signed a non-disclosure agreement, obliging applicants to handle and protect EUCI in accordance with Decision (EU, Euratom) 2015/444, its implementing rules and the applicable national rules. 5. Where RESTREINT UE/EU RESTRICTED information is provided to applicants, the minimum requirements mentioned in Article 5(7) of this Decision shall be included in the call or in the non-disclosure arrangements concluded at proposal stage. 6. All applicants and beneficiaries which are required to handle or store information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET within their facilities, either at the proposal stage or during the performance of the classified grant agreement itself, shall hold an FSC at the required level, except for cases mentioned in paragraph 9. The following identifies the three scenarios that may arise during the proposal stage for a classified grant involving EUCI at CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET level: (a) no access to EUCI at CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET level during the proposal stage: Where the call concerns a grant that will involve EUCI at CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET level, but does not require the applicant to handle such information at the proposal stage, an applicant which does not hold an FSC at the required level shall not be excluded from the application process on the grounds that it does not hold an FSC; (b) access to EUCI at CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET level on the premises of the granting authority during the proposal stage: Access shall be granted to applicant personnel who hold a PSC at the required level and who have a need-to-know; (c) handling or storage of EUCI at CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET level on the premises of the applicant during the proposal stage: Where the call requires applicants to handle or store EUCI on their premises, the applicant shall hold an FSC at the required level. In such circumstances, the granting authority shall obtain, through the Commission security authority, an assurance from the relevant NSA or DSA that the applicant has been granted an appropriate FSC before any EUCI material is provided to the applicant. Access shall be granted to applicant personnel who hold a PSC at the required level and who have a need-to-know. 7. In principle, an FSC or PSC shall not be required for access to RESTREINT UE/EU RESTRICTED information, either at the proposal stage or for the performance of the grant agreement. Where Member States require an FSC or PSC for grant agreements or subcontracts at RESTREINT UE/EU RESTRICTED level under their national laws and regulations, as listed in Annex IV, those national requirements shall not place any additional obligations on other Member States or exclude applicants, beneficiaries or subcontractors from Member States that have no such FSC or PSC requirements for access to RESTREINT UE/EU RESTRICTED information from related grant agreements or subcontracts, or a competition for such. Those grant agreements shall be performed in Member States in accordance with their national laws and regulations. 8. Where an FSC is required in the handling of a call and for the implementation of a classified grant agreement, the granting authority shall submit, through the Commission security authority, a request to the beneficiary’s NSA or DSA using a facility security clearance information sheet (‘FSCIS’) or any established equivalent electronic form. Annex III, Appendix D, contains an example of an FSCIS (9). Response to an FSCIS is provided, to the extent possible, within ten working days of the date of the request. 9. Where Member States’ government establishments or establishments under the control of their government participate in classified grants that require FSCs, and where FSCs are not issued for those establishments under national laws, the granting authority shall verify with the NSA or DSA concerned, through the Commission security authority, whether those government establishments are capable of handling EUCI at the required level. 10. Where a PSC is required for the performance of a classified grant agreement and where, according to national rules, an FSC is necessary before a PSC is granted, the granting authority shall check with the beneficiary’s NSA or DSA, through the Commission security authority, using an FSCIS, that the beneficiary holds an FSC or that the FSC process is underway. In this case, the Commission shall not issue requests for PSCs using personnel security clearance information sheet (‘PSCIS’).

Article 4 Subcontracting in classified grants 1. The conditions under which beneficiaries may subcontract action tasks involving EUCI shall be defined in the call and in the grant agreement. These conditions shall include the requirement that all FSCISs shall be submitted through the Commission security authority. Subcontracting shall be subject to prior written consent from the granting authority. Where applicable, subcontracting shall comply with the basic act establishing the programme. 2. Classified parts of the grants shall be subcontracted only to entities registered in a Member State, or to entities registered in a third country or established by an international organisation where that third country or international organisation has concluded a security of information agreement with the Union or entered into an administrative arrangement with the Commission (10).

CHAPTER 3

HANDLING OF CLASSIFIED GRANTS

Article 5 Basic principles 1. When awarding a classified grant, the granting authority, together with the Commission security authority, shall ensure that the beneficiaries’ obligations regarding the protection of EUCI used or generated in the performance of the grant agreement are an integral part of the grant agreement. Grant-specific security requirements shall take the form of a security aspects letter (‘SAL’). A sample template for a SAL is set out in Annex III. 2. Before signing a classified grant, the granting authority shall approve a security classification guide (‘SCG’) for the tasks to be performed and information generated in the implementation of the grant, or at programme or project level, where applicable. The SCG shall be part of the SAL. 3. Programme- or project-specific security requirements shall take the form of a programme (or project) security instruction (‘PSI’). The PSI may be drafted using the provisions of the SAL template as set out in Annex III. The PSI shall be developed by the Commission department managing the programme or project, in close cooperation with the Commission security authority, and submitted for advice to the Commission Security Expert Group. Where a grant agreement is part of a programme or project with its own PSI, the SAL of the grant agreement shall have a simplified form and shall include reference to the security provisions set out in the PSI of the programme or project. 4. Except for cases mentioned in Article 3(9), the classified grant agreement shall not be signed until the applicant’s NSA or DSA has confirmed the applicant’s FSC, or, where the classified grant agreement is awarded to a consortium, until the NSA or DSA of at least one applicant, within the consortium, or more if necessary, has confirmed that applicant’s FSC. 5. In principle, and save provided otherwise in other relevant rules, the granting authority shall be considered the originator of EUCI generated in the performance of the grant agreement. 6. The granting authority, through the Commission security authority, shall notify the NSAs and/or DSAs of all beneficiaries and subcontractors about the signature of classified grant agreements or subcontracts and any extensions or early terminations of such grant agreements or subcontracts. A list of country requirements is provided in Annex IV. 7. Grant agreements involving information classified RESTREINT UE/EU RESTRICTED shall include a security clause making the provisions set out in Annex III, Appendix E binding upon beneficiaries. Those grant agreements shall include an SAL setting out, as a minimum, the requirements for handling RESTREINT UE/EU RESTRICTED information including information assurance aspects and specific requirements to be fulfilled by the beneficiaries regarding the accreditation of their CIS handling RESTREINT UE/EU RESTRICTED information. 8. Where this is required by Member States’ national laws and regulations, NSAs or DSAs ensure that beneficiaries or subcontractors under their jurisdiction comply with the applicable security provisions for the protection of RESTREINT UE/EU RESTRICTED information and conduct verification visits to beneficiaries’ or subcontractors’ facilities located in their territory. Where the NSA or DSA is not under such an obligation, the granting authority shall ensure that the beneficiaries implement the required security provisions set out in Annex III, Appendix E.

Article 6 Access to EUCI by staff of beneficiaries and subcontractors 1. The granting authority shall ensure that classified grant agreements include provisions stating that staff of beneficiaries or subcontractors who, for the performance of the classified grant agreement or subcontract, require access to EUCI, may be granted that access only if: (a) it has been established that they have a need-to-know; (b) for information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET, they have been security cleared at the relevant level by the respective NSA or DSA or any other competent security authority; (c) they have been briefed on the applicable security rules for protecting EUCI, and have acknowledged their responsibilities with regard to protecting such information. 2. Where applicable, access to EUCI shall also be in compliance with the basic act establishing the programme and take account of any additional markings defined in the SCG. 3. If a beneficiary or subcontractor wishes to employ a national of a non-EU country in a position that requires access to EUCI classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET, it is the responsibility of the beneficiary or subcontractor to initiate the security clearance procedure of such a person in accordance with national laws and regulations applicable at the location where access to the EUCI is to be granted.

Article 7 Access to EUCI by experts participating in checks, reviews or audits 1. Where external persons (‘experts’) are involved in checks, reviews or audits conducted by the granting authority or in performance reviews of the beneficiaries that require access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET, they shall be provided with a contract only if they have been security cleared at the relevant level by the respective NSA or DSA or any other competent security authority. The granting authority, through the Commission security authority, shall check and, where necessary, ask the NSA or DSA to initiate the vetting process for experts at least six months prior to the start of their respective contracts. 2. Before signing their contracts, the experts shall be briefed on the applicable security rules for protecting EUCI, and shall have acknowledged their responsibilities with regard to protecting such information.

CHAPTER 4

VISITS IN CONNECTION WITH CLASSIFIED GRANT AGREEMENTS

Article 8 Basic principles 1. Where the granting authority, experts, beneficiaries or subcontractors require access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET on each other’s premises in the context of the implementation of a classified grant agreement, visits shall be arranged in liaison with the NSAs or DSAs or any other competent security authorities concerned. 2. The visits referred to in paragraph 1 shall be subject to the following requirements: (a) the visit shall have an official purpose related to the classified grant; (b) any visitor shall hold a PSC at the required level and shall have a need-to-know in order to access EUCI used or generated in the performance of the classified grant.

Article 9 Requests for visits 1. Visits by beneficiaries or subcontractors to other beneficiaries’ or subcontractors’ facilities, or to granting authority premises, that involve access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET shall be arranged in accordance with the following procedure: (a) the security officer of the facility sending the visitor shall complete all relevant parts of the request for visit (RFV) form and submit the request to the facility’s NSA or DSA. A template for the RFV form is set out in Annex III, Appendix C; (b) the sending facility’s NSA or DSA needs to confirm the visitor’s PSC before submitting the RFV to the host facility’s NSA or DSA (or the Commission security authority if the visit is to the premises of a granting authority); (c) the security officer of the sending facility shall then obtain from its NSA or DSA the reply of the host facility’s NSA or DSA (or the Commission security authority) either authorising or denying the RFV; (d) an RFV is considered approved if no objections are raised until five working days before the date of the visit. 2. Visits by granting authority officials or experts or auditors to beneficiaries’ or subcontractors’ facilities that involve access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET shall be arranged in accordance with the following procedure: (a) the visitor shall complete all relevant parts of the RFV form and submit it to the Commission security authority; (b) the Commission security authority shall confirm the PSC of the visitor before submitting the RFV to the host facility’s NSA or DSA; (c) the Commission security authority shall obtain a reply from the host facility’s NSA or DSA either authorising or denying the RFV; (d) an RFV is considered approved if no objections are raised until five working days before the date of the visit. 3. An RFV may cover either a single visit or recurring visits. In the case of recurring visits, the RFV may be valid for up to one year from the start date requested. 4. The validity of any RFV shall not exceed the validity of the visitor’s PSC. 5. As a general rule, an RFV should be submitted to the host facility’s competent security authority at least 15 working days before the date of the visit.

Article 10 Visit procedures 1. Before allowing visitors to have access to EUCI, the security office of the host facility shall comply with all the visit-related security procedures and rules laid down by its NSA or DSA. 2. Visitors shall prove their identity upon arrival at the host facility by presenting a valid ID card or passport. That identification information shall correspond to the information supplied in the RFV. 3. The host facility shall ensure that records are kept of all visitors, including their names, the organisation they represent, the date of expiry of the PSC, the date of the visit and the names of the persons visited. Such records shall be retained for a period of at least five years, or longer if required by the national rules and regulations of the country where the host facility is located.

Article 11 Visits arranged directly 1. In the context of specific projects, the relevant NSAs or DSAs and the Commission security authority may agree on a procedure whereby visits for a specific classified grant can be arranged directly between the visitor’s security officer and the security officer of the facility to be visited. A template of the form to be used for this purpose is set out in Annex III, Appendix C. Such an exceptional procedure shall be set out in the PSI or other specific arrangements. In such cases, the procedures set out in Article 9 and Article 10(1) shall not apply. 2. Visits involving access to information classified RESTREINT UE/EU RESTRICTED shall be arranged directly between the sending and receiving entity, without the need to follow the procedures set out in Article 9 and Article 10(1).

CHAPTER 5

TRANSMISSION AND CARRIAGE OF EUCI IN PERFORMANCE OF CLASSIFIED GRANT AGREEMENTS

Article 12 Basic principles The granting authority shall ensure that all decisions related to EUCI transfer and carriage are in accordance with Decision (EU, Euratom) 2015/444 and its implementing rules, and with the terms of the classified grant agreement, including the consent of the originator.

Article 13 Electronic handling 1. Electronic handling and transmission of EUCI shall be carried out in accordance with Chapters 5 and 6 of Decision (EU, Euratom) 2015/444 and its implementing rules. The communication and information systems owned by a beneficiary and used to handle EUCI for the performance of the grant agreement (‘beneficiary CIS’) shall be subject to accreditation by the security accreditation authority responsible (‘SAA’). Any electronic transmission of EUCI shall be protected by cryptographic products approved in accordance with Article 36(4) of Decision (EU, Euratom) 2015/444. TEMPEST security measures shall be implemented in accordance with Article 36(6) of that Decision. 2. The security accreditation of the beneficiary CIS handling EUCI at RESTREINT UE/EU RESTRICTED level and of any interconnection thereof may be delegated to the security officer of a beneficiary if this is permitted by national laws and regulations. Where that task is delegated, the beneficiary shall be responsible for implementing the minimum security requirements described in the SAL when handling RESTREINT UE/EU RESTRICTED information on its CIS. However, the relevant NSAs or DSAs, and SAAs retain responsibility for the protection of RESTREINT UE/EU RESTRICTED information handled by the beneficiary and the right to inspect the security measures taken by the beneficiary. In addition, the beneficiary shall provide the granting authority and, where required by national laws and regulations, the competent national SAA, with a statement of compliance certifying that the beneficiary CIS and related interconnections have been accredited for handling EUCI at RESTREINT UE/EU RESTRICTED level (11).

Article 14 Transport by commercial couriers The transport of EUCI by commercial couriers shall abide by the relevant provisions of Commission Decision (EU, Euratom) 2019/1962 (12) on implementing rules for handling RESTREINT UE/EU RESTRICTED information and Commission Decision (EU, Euratom) 2019/1961 (13) on implementing rules for handling CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET information.

Article 15 Hand carriage 1. The carriage of classified information by hand shall be subject to strict security requirements. 2. RESTREINT UE/EU RESTRICTED information may be hand carried by beneficiary personnel within the Union, provided the following requirements are met: (a) the envelope or packaging used is opaque and bears no indication of the classification of its contents; (b) the classified information does not leave the possession of the bearer; (c) the envelope or packaging is not opened en route. 3. For information classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET, hand carriage by beneficiary personnel within a Member State is arranged in advance between the sending and receiving entities. The dispatching authority or facility informs the receiving authority or facility of the details of the consignment, including reference, classification, expected time of arrival and name of courier. Such hand carriage is permitted, provided the following requirements are met: (a) the classified information is carried in a double envelope or packaging; (b) the outer envelope or packaging is secured and bears no indication of the classification of its contents, while the inner envelope bears the level of classification; (c) EUCI does not leave the possession of the bearer; (d) the envelope or packaging is not opened en route; (e) the envelope or packaging is carried in a lockable briefcase or similar approved container of such size and weight that it can be retained at all times in the personal possession of the bearer and not be consigned to a baggage hold; (f) the courier carries a courier certificate issued by his or her competent security authority authorising the courier to carry the classified consignment as identified. 4. For hand carriage by beneficiary personnel of information classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET from one Member State to another, the following additional rules shall apply: (a) the courier shall be responsible for the safe custody of the classified material carried until it is handed over to the recipient; (b) in the event of a security breach, the sender’s NSA or DSA may request that the authorities in the country where the breach occurred carry out an investigation, report their findings and take legal or other action as appropriate; (c) the courier shall have been briefed on all the security obligations to be observed during carriage and shall have signed an appropriate acknowledgement; (d) the instructions for the courier shall be attached to the courier certificate; (e) the courier shall have been provided with a description of the consignment and an itinerary; (f) the documents shall be returned to the issuing NSA or DSA upon completion of the journey(s) or be kept available by the recipient for monitoring purposes; (g) if customs, immigration authorities or border police ask to examine and inspect the consignment, they shall be permitted to open and observe sufficient parts of the consignment so as to establish that it contains no material other than that which is declared; (h) customs authorities should be urged to honour the official authority of the shipping documents and of the authorisation documents carried by the courier. If a consignment is opened by customs, this should be done out of sight of unauthorised persons and in the presence of the courier where possible. The courier shall request that the consignment be repacked and shall ask the authorities conducting the inspection to reseal the consignment and confirm in writing that it was opened by them. 5. Hand carriage by beneficiary personnel of information classified RESTREINT UE/EU RESTRICTED, CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET to a third country or an international organisation shall be subject to the provisions of the security of information agreement or the administrative arrangement concluded between, respectively, the Union or the Commission and that third country or international organisation.

CHAPTER 6

BUSINESS CONTINUITY PLANNING

Article 16 Contingency plans and recovery measures The granting authority shall ensure that the classified grant agreement requires the beneficiaries to set out business contingency plans (‘BCP’) for protecting EUCI handled in the context of the classified grant in emergency situations, and to put in place preventive and recovery measures in the context of business continuity planning to minimise the impact of incidents in relation to the handling and storage of EUCI. The beneficiaries shall confirm to the granting authority that their BCPs are in place.

Article 17 Entry into force This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Done at Brussels, 10 February 2021. For the Commission, On behalf of the President, Johannes HAHN Member of the Commission

(1) OJ L 193, 30.7.2018, p. 1.

(2) OJ L 72, 17.3.2015, p. 41.

(3) OJ L 72, 17.3.2015, p. 53.

(4) OJ L 6, 11.1.2017, p. 40.

(5) OJ C 202, 8.7.2011, p. 13.

(6) Council Decision 2013/488/EU of 23 September 2013 on the security rules for protecting EU classified information (OJ L 274, 15.10.2013, p. 1).

(7) Commission Decision of 4.5.2016 on an empowerment relating to security (C(2016) 2797 final).

(8) The list of agreements concluded by the EU and of administrative arrangements entered into by the European Commission, under which EU classified information may be exchanged with third countries and international organisations, can be found on the Commission website.

(9) Other forms used may differ from the example provided in these implementing rules in their design.

(10) The list of agreements concluded by the EU and of administrative arrangements entered into by the European Commission, under which EU classified information may be exchanged with third countries and international organisations, can be found on the Commission website.

(11) The minimum requirements for communication and information systems handling EUCI at RESTREINT UE/EU RESTRICTED level are laid down in Annex III, Appendix E.

(12) Commission Decision (EU, Euratom) 2019/1962 of 17 October 2019 on implementing rules for handling RESTREINT UE/EU RESTRICTED information (OJ L 311, 2.12.2019, p. 21).

(13) Commission Decision (EU, Euratom) 2019/1961 of 17 October 2019 on implementing rules for handling CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET information (OJ L 311, 2.12.2019, p. 1).