21.3.92 OfficialJournaloftheEuropeanCommunities NoC72/15
II
(PreparatoryActs)
COMMISSION
ProposalforaCouncilRegulation(EEC)onthesecuritymeasuresapplicabletoclassifiedinfor­
mationproducedortransmittedinconnectionwithEuropeanEconomicCommunityor
Euratomactivities
(92/C72/16)
COM(92)56final
(SubmittedbytheCommissionon26February1992)
THECOUNCILOFTHEEUROPEAN COMMUNITIES ,theframeworkofexistingprovisionsinMemberStates
andtheCommunityinstitutions;
HavingregardtoArticle235oftheTreatyestablishing
theEuropeanEconomicCommunity, WhereasunderpresentCommunitylawitisforeach
institutionandeachMemberStatetodeterminewhich
informationshouldbeclassified,withtheprovisothat
thesecuritygradingsshouldberespectedbyallparties;
whereasaccesstoinformation isoneofthefundamental
principlesofdemocracy;whereasitistherefore
necessarytolimitclassificationofinformationtothe
absoluteminimum;HavingregardtoArticle203oftheTreatyestablishing
theEuropeanAtomicEnergyCommunity,
HavingregardtotheproposalfromtheCommission,
HavingregardtotheopinionoftheEuropean
Parliament,Whereastherulesshouldcovernotonlyphysical
protectionofclassifiedinformationbutalsothepersons
andfirmswhomayhaveaccesstoit,withoutprejudice
tothestatusofpersonswhoareexercisinganelectoral
mandateoragovernmentfunctionorwhoaremembers
ofaninstitutionorbodyestablishedbytheTreaties;
WhereasthedevelopmentoftheCommunitywill
generateincreasingflowsofinformationbetweenthe
MemberStatesandtheinstitutionsoftheEuropean
Communities ;Whereasprotectionofpersonaldataandprivacyare
coveredbyseparatemeasures;
Whereasprotectionshouldbeaffordedtosensitiveinfor­
mationwhoseunauthorized disclosurecouldbe
detrimentaltotheessentialinterestsoftheEuropean
Communities andofMemberStates;Whereasspecialmeasuresshouldbelaiddownforthe
protectionofcomputerizedinformationtoallowforthe
particularcharacteristicsofelectronictechniques;
Whereasanyfailuretocomplywiththerequirementsof
thisRegulationorofsupplementary provisionsadopted
bytheinstitutionsortheMemberStateswillrenderthe
offenderliabletodisciplinaryaction;whereasprovision
mustbemadeforotherappropriatesanctionstobe
taken,wherenecessary,againstseriousoffenders;Whereassomecommonclassification rulesshould
thereforebelaiddowntoensureadequateprotectionof
informationatboththeproductionandthetransmission
stages;whereastherulesshouldbeimplementedbythe
competentadministrative andjudicialauthoritieswithin

21.3.92 NoC72/16 OfficialJournaloftheEuropeanCommunities
3.ThisRegulationdoesnotapplytoinformation
coveredbyRegulation(Euratom)No3.WhereasthisRegulationwillhelptofurtherthe
achievementofCommunityobjectivesingeneralandto
protecttheinterestsoftheCommunityinstitutionsand
MemberStates;
Article2
Supplementary provisions
1.ThesecuritymeasureslaiddowninthisRegulation
provideaframeworkofgeneralprinciplesandcoor­
dinatedrules.WhereasaCommissiondecisionbasedonArticle95of
theTreatyestablishingtheEuropeanCoalandSteel
CommunitywillbeadoptedtocoverECSCclassified
information ;
WhereastheTreatiesdonotprovidespecificpowersof
actionfortheestablishment ofcommonrulesinthis
field:2.TheinstitutionsoftheEuropeanCommunities
(hereinaftercalled'theinstitutions')andtheMember
Statesmay,wherenecessary,supplementthembyrules
onmatterswithintheirjurisdictioninordertotake
accountoflocalconditions,providedthisdoesnot
jeopardizetheuniformityoftreatmentoftheinfor­
mationreferredtoinArticle1(1).WhereasthisRegulationiswithoutprejudicetothe
applicationofthespecificsecuritymeasureslaiddownin
CouncilRegulation(Euratom)No3(')onthesecurity
gradingsandthesecuritymeasurestobeappliedto
Euratomclassifiedinformation ;
3.TheinstitutionsoftheEuropeanCommunitiesare
theEuropeanParliament,theCouncil,theCommission
andtheCourtofJustice.
WhereastheprovisionsofthisRegulationdonotaffect
thenormalrulesofconfidentiality whichapplytoall
publicservantswithregardtoinformationnotexpressly
intendedforthepublic, 4.ForthepurposesofthisRegulation,theCourtof
Auditors,theEconomicandSocialCommitteeandthe
EuropeanInvestmentBankaredeemedtobeinstitutions .
HASADOPTEDTHISREGULATION :
TITLEI
PROTECTION :PRINCIPLES ANDGENERALRULESArticle3
Classifiedinformation
1.ForthepurposesofthisRegulation,'classified
information'meansallformsofinformation whose
unauthorized disclosurecouldbedetrimentaltothe1
essentialinterestsoftheEuropeanCommunitiesandof
theMemberStatesandwhichthereforemustbe
protectedbyappropriatesecuritymeasures.Article1
Scope:subjectmatter
1.ThisRegulationestablishessecuritygradingsfor
sensitiveinformationconnectedwithEECorEuratom
activitiesandthesecuritymeasurestobeappliedtosuch
informationbothinsideMemberStatesandinstitutions
andwhenitistransmittedbyoneMemberStateor
institutiontoanother.2.'Information'meansanyinformation,whether
recordedinwriting,orallyoropticallyandwhateverthe
mediumused:paper,audioorvideotape,transmission
networks,technicalorphysicalprocesses.Forthe
purposesofthisRegulation,theconceptofclassified
informationmustbeunderstoodsolelybyreferencetoits
context.
2.ThisRegulationalsoestablishestheconditionsof
accesstoclassifiedinformationbypublicservantsand
personsorfirmsundercontract.
3.Whereinformation isnotcontainedinawritten
document,protectionofclassifiedinformationmay
requirespecialrulestakingaccountofthenatureofthe
medium,inparticularforaudioandvideorecordings,
microfilm,filmorvideotapesorcomputermedia. (')OJNo17,6.10.1958,p.406/58.

NoC72/17 21.3.92 OfficialJournaloftheEuropeanCommunities
4.Theinformationreferredtoinparagraphs 1and2
aboveshallretainitsclassifiedstatusevenwhenitis
preparatoryoronlyfortemporaryuse.2.Informationfromanyothersource,whetherornot
bearingasecuritygrading,shallifnecessarybeassigned
anECsecuritygradingbytherecipientinstitutionor
MemberState,accountbeingtakenofthelegitimate
interestsoftheauthororthesourceoftheinformation .
TITLEII
PROCEDURAL PROVISIONS
Article7
Assignmentofsecuritygradings
Theassignmentofsecuritygradingsshallbetherespon­
sibilityoftheinstitutionorMemberStateinwhichthe
documentoriginates.Article4
Classificationprinciples
1.Thesecuritygradingapplicabletoanitemofinfor­
mationshallbedeterminedbyreferencetothecontent
oftheinformationinquestion.
2.Securitygradingsshallbeassignedonlywhere
necessaryandforthetimenecessary.
3.Wheretheinformationtobeprotectedhasa
temporarysecuritygrading,thedateshallbeindicated
beyondwhichitcanbeconsidereddeclassifiedoran
equivalentembargoshallbeattached. EachinstitutionandeachMemberStateshalldetermine
theinternalproceduresforassignmentofsecurity
gradings,takingaccountofthecriterialaiddownin
Article4andavoidingunnecessarygradings.4.Whereanumberofitemsofinformationare
groupedtogether,thesecuritygradingtobeappliedto
thewholeshallbeatleastashighasthatoftheitemof
informationbearingthehighestgrading.Acollectionof
informationmay,however,begivenahighergrading
thananyofitsconstituentparts.Article8
Declassification ofinformation
1.TheinstitutionorMemberStatewhichassignedthe
securitygradingtoanitemofinformationshallbe
responsiblefordecidingthatthegradingistobeliftedor
changedandforinformingtherecipients.
InthecaseofTOPSECRETorSECRETinformationsuch
decisionsshallbecommunicated torecipientsinwriting.Article5
Securitygradings
SecuritygradingsforECclassifiedinformationshallbe
asfollows:
(a)EC-TOPSECRET:whereunauthorizeddisclosure
mightbeextremelydetrimentaltotheessential
interestsoftheCommunities orofoneormore
MemberStates;
(b)EC-SECRET :whereunauthorizeddisclosuremightbe
seriouslydetrimentaltotheessentialinterestsofthe
CommunitiesorofoneormoreMemberStates;
(c)EC-CONFIDENTIAL :whereunauthorizeddisclosure
mightbedetrimentaltotheessentialinterestsofthe
CommunitiesorofoneormoreMemberStates.2.Informationtemporarilyclassifiedshallbe
declassifiedautomaticallyontheexpirydateoras
otherwisespecified.
3.Informationinhistoricalarchivesissubjecttoa
declassification procedureafter30yearswithaviewto
allowingpublicaccess.
Article9
Scope:persons
1.ThesecuritymeasureslaiddowninthisRegulation
shallbeobservedbyallofficialsorotherpublicservants
who,foranyreason,haveoccasion:Article6
Informationfromoutsidesources
1.Classifiedinformationfromanyoftheinstitutions
orMemberStatesshallretainitsoriginalsecurity
grading.

NoC72/18 OfficialJournaloftheEuropeanCommunities 21.3.92
2.Authorizations shallterminatewhentheauthorized
personleavestheserviceoftheCommunitiesortheir
contractends.(a)inaninstitution,inacommitteeforwhichan
institutionisresponsibleorinthecourseofwork
withthestaffofaninstitution,tohaveaccessto
classifiedinformationproducedwithintheinstitution
orcommunicated toit:
3.Authorizations shallbesubjecttoperiodicalreview
everyfiveyearsatleast.
(b)inaMemberState,tohaveaccesstoECclassified
informationproducedintheMemberStateor
communicated toit.Article12
Vetting
1.(a)Vettingshallbeundertakenattherequestofthe
institutionorMemberStatetowhoseauthority
thepersontobegivenauthorization in
accordancewithArticle10(2)or(3)issubject.
ThevettingshallbecarriedoutbytheMember
Stateofwhichthepersonconcernedisanational.2.Anyfirmorcompany,includingsubcontractors ,
workingforaninstitutionorMemberStatewhosestaff
mayhaveoccasiontoreadclassifiedinformationby
reasonoftheirworkshallbeboundbytherequirements
ofthisRegulationandshallimposethesameobligations
oneverymemberofstaffconcerned.Itshalldesignatea
persontoberesponsibleformonitoringtheimplemen­
tationofthesemeasures.
(b)WherethepersonconcernedisnotaCommunity
national,theMemberStateresponsibleforvetting
istheoneinwhichthepersonisdomiciledor
usuallyresident.Article10
Accesstoclassifieddocuments
1.AccesstoandpossessionofECclassifiedinfor­
mationshallberestrictedtothepersonsreferredtoin
Article9who,byreasonoftheirdutiesorofservice
requirements,needtoacquaintthemselveswithsuch
informationortohandleit.(c)Wherethepersonconcernedhasbeenresidentfor
aperiodoftimeinaMemberStateotherthanthe
onereferredtointhepreviousparagraph,orif
thepersonhastiesinanotherMemberState,the
MemberStateinquestionshalltakepartinthe
vettingprocedure.TheMemberStateinquestion
shallcommunicatetheresultsofitsenquiriesto
theMemberStateresponsibleforvetting.
2.TobeallowedaccesstoEC-TOPSECRETand
EC-SECRETandEC-CONFIDENTIAL information,the
personsreferredtoinparagraph 1mustbegivenauth­
orizationinaccordancewithArticle11.2.Thevettingprocedureshallbegovernedbythe
relevantrulesandrequirementsappliedintheMember
Stateinquestion.
3.Suchauthorizationshallbegrantedonlytopersons
whohavebeenvettedinaccordancewithArticle12.3.InstitutionsandMemberStatesshallcooperateand
exchangewhateverinformationisnecessaryforthe
properapplicationofthisArticle.
4.WhereonlyoccasionalaccesstoEC-CON­
FIDENTIALinformationisrequired,suchaccessmaybe
authorizedbywayofexceptionwithoutpriorvetting,
providedthatallnecessaryprecautionsaretaken.Inparticular,institutionsandMemberStatesshallnotify
eachotherofanythingwhichmaycastdoubtsonthe
credentialsoftheauthorizedperson.
Article11
Authorization
1.Authorizations underArticle10shallbegrantedby
eachinstitutionandMemberStatetopersonssubjectto
itsauthorityinaccordancewithitsownarrangements .Article13
Instructions
AllpersonsauthorizedinaccordancewithArticle10
shall,atthetimeofauthorizationandatregularintervals
thereafter,begivenappropriateinstructionsconcerning
theprotectionofclassifiedinformationandmethodsto

21.3.92 OfficialJournaloftheEuropeanCommunities NoC72/19
beapplied.Theyshallsignadeclarationthattheyhave
receivedtheinstructionsandthattheyundertaketo
complywiththem.2.Itshallbethetaskofsecurityofficersto:
(a)keepuptodatethelistofpersonsintheir
departments authorizedtohaveaccessto
CONFIDENTIAL ,SECRETandTOPSECRETinfor­
mation;
(b)giveinstructionstostaffregardingtheirresponsibility
fortheprotectionofclassifiedinformation ;
(c)enforcethephysicalsecuritymeasures;
(d)supervisetheworkofthespecialofficesprovidedfor
inArticle17.TITLEIII
STRUCTURES
Article14
Responsibilityforsecurity
EachinstitutionandMemberStateshalldesignatea
departmenttosupervisetheapplicationofthisRegu­
lationandofsupplementarymeasuresasprovidedforin
Article2andshallinformtheotherinstitutionsand
MemberStatesthroughtheCommission .
3.OnlypersonsauthorizedinaccordancewithArticle
10tohaveaccesstoclassifiedinformationmaybe
securityofficers.Article15
Coordination betweeninstitutionsandMemberStates
1.TheinstitutionsandMemberStatesshallsetup
whateverproceduresarenecessaryforthecoherent
applicationofthisRegulation .Article17
Specialoffices
1.TheinstitutionsandMemberStatesshalluse
specializeddepartments (hereinaftercalled'special
offices')fortheexchangeofEC-TOPSECRET,
EC-SECRET ,andEC-CONFIDENTIAL information .2.TheCommissionshallorganizethenecessarycoor­
dinationbetweeninstitutionsandbetweenthe
institutionsandtheMemberStates.
2.Thespecialofficeshallassumeresponsibilityfor
handlingclassifiedinformationreferredtoinparagraph
1,inparticularregistration,reproduction ,translation,
transmission,storageanddestruction .3.TheCommissionshallbeassistedinthistaskbyan
AdvisoryCommitteeonSecuritycomposedofrepresen­
tativesoftheMemberStatesandchairedbya
Commissionrepresentative .
3.Wherenecessaryforthedischargeoftheirduties,
officialsassignedtothespecialofficesshallbeauth­
orizedtohaveaccesstoclassifiedinformation in
accordancewithArticle10.4.Thecommitteeshalldrawupitsrulesofprocedure.
Representatives ofotherinstitutionsmayattendits
meetingsasobservers.
5.Thecommittee'sremitshallbetoexamine,onthe
initiativeofitschairmanorattherequestofan
institutionorMemberState,anymattercomingwithin
thescopeofthisRegulation .TITLEIV
PROTECTION OFDOCUMENTS
Article18
Distinctivemarkingofclassifieddocuments
1.Thesecuritygradingassignedtoclassifiedinfor­
mationinwrittenformshallbeshownasfollows:
—EC-TOPSECRETandEC-SECRET :byaclearly
visiblestamponthetopandbottomofeachpageor
bysomeequivalentindication,suchasadiagonal
bandextendingacrossthefullpage,Article16
Securityofficers
1.TheinstitutionsandMemberStatesshalldesignate,
ineachdepartmentreceivingorhandlingclassifiedinfor­
mation,officialsofappropriaterank(hereinaftercalled
'securityofficers')toberesponsiblefortheimplemen­
tationofthisRegulation .

NoC72/20 OfficialJournaloftheEuropeanCommunities21.3.92
—EC-CONFIDENTIAL :byaclearlyvisiblesumpon
eachpageorbysomeequivalentindication,suchasa
diagonalbandextendingacrossthefullpage.
Thestampshallbeinalltheofficiallanguagesofthe
Community .
2.Inthecaseoftemporaryclassification,thedate
afterwhichthedocumentmaybeconsidereddeclassified
ortheequivalentembargoformulashallbeaddedina
suitableplace.Article20
Registration,distributionandreceptionofEC-TOP
SECRET,EC-SECRETandEC-CONFIDENTIAL infor­
mation
AllEC-TOPSECRET,EC-SECRETandEC-CONFI­
DENTIALdocumentsshallberegisteredinoneofthe
specialofficesreferredtoinArticle17;thespecialoffice
therebytakesdeliveryofthedocumentandarrangesany
necessarytransmission .Thepurposeofsuchregistration
shallbetomakeitpossible:
—todrawupimmediatelyalistofthepersonswho
haveconsultedtheinformationorhaditintheir
possession,
—toascertainatonce,afterdistribution,whoisin
possessionofeachcopyandofanyduplicates.
Article21
Messengers
Withtheagreementofthesecuritydepartment
concerned,messengersshallbespeciallydesignatedto
carryclassifieddocuments,inparticularEC-TOP
SECRETandEC-SECRETdocuments .3.EachcopyofanEC-TOPSECRETorEC-SECRET
documentshallbearaserialnumber,bymeansofwhich
thesource,recipientandyearcanbeidentified.This
serialnumbershallberepeatedonthecoverpageof
eachdocument.Thepagesshallbenumbered.
4.Ifthesecuritygradingofaclassifieddocumentis
changed,thedocumentshallbemarkedasappropriate
forthenewgrading.
5.ReferencestoEC-TOPSECRET,EC-SECRETand
EC-CONFIDENTIAL information,includingcompu­
terizedreferences,shallbekepttoaminimumandunder
nocircumstances musttheyrevealeitherthecontentor
thesecuritygradingoftheinformation .
Article19
Preparation,productionandreproductionofEC-TOP
SECRET,EC-SECRETandEC-CONFIDENTIAL docu­
ments
1.RunsofEC-TOPSECRET,EC-SECRETand
EC-CONFIDENTIAL documentsshallbestrictlylimited
tothenumberofcopiesrequiredtocoverestimated
essentialneeds.Article22
Delivery
1.EC-TOPSECRET,EC-SECRETandEC-CONFI­
DENTIALinformationshallbedispatchedandreceived
bythespecialoffices.
2.Thefollowingproceduresshallapplyforthe
deliveryofclassifieddocuments :
(a)EC-TOPSECRETandEC-SECRET :
byauthorizedmessenger,orbydiplomaticbagorby
insuredmail,withadviceofdelivery;
(b)EC-CONFIDENTIAL :
bymessenger,internalmailorregisteredpost,with
adviceofdelivery;
(c)whateverthemeansofdelivery,theenvelopeshall
bearnodistinctivemarkingontheoutside.
Article23
Diplomaticbag
Thedeliveryofclassifieddocumentsbydiplomaticbag
shallbegovernedbyappropriateruleswhichafford
adequateprotection .2.Classifiedinformationmaybereproducedinwhole
orinpart,inwhateverformandbywhatevermeans,
onlyundertheauthorityofoneofthespecialoffices
referredtoinArticle17.
Thenumberofcopies(e.g.furtherruns,duplicatesor
extracts)shallbelimitedtoessentialneedsnotforeseen
whenthedocumentwasoriginallyproduced.

21.3.92 OfficialJournaloftheEuropeanCommunities NoC72/21
Article24
Removalofclassifieddocumentsfrombuildings
1.Classifieddocumentsshallbekeptatalltimesina
securelocation.
2.Classifieddocumentsmayonlybetakenaway
whereabsolutelynecessaryandshallremainatalltimes
inthepersonalcustodyofthepersonwhoremovesthem.TITLEVII
TRANSMISSION BYTELECOMMUNICATIONS
Article27
Transmissionofclassifieddocumentsbytelecommuni­
cations
1.EC-TOPSECRET,EC-SECRETandEC-CONFI­
DENTIALinformationshallnotbesentbytelegram,
radio,telephone,telex,telefaxoranyotherelectronic
meansunlessitisencipheredusingasystemthesecurity
departmentregardsassafe.Classifieddocumentsshouldnotbeleftinlocations
wheretheycannotremainundersurveillanceatalltimes.
2.Notwithstanding paragraph 1,EC-CONFIDENTIAL
informationmayincasesofemergencyandabsolute
necessitybesentbysuchmeanswithoutbeingenci­
phered,providedthatauthorization isobtainedfromthe
competentauthorityoftheinstitutionortheMember
StateandtheCipherOfficeisinformed.TITLEV
DESTRUCTION
Article25
Destructionofclassifieddocuments 3.EC-CONFIDENTIAL informationwhichhasbeen
sentwithoutbeingencipheredmayneversubsequentlybe
sentinencipheredform.1.Outdatedandsurpluscopiesofclassifieddocu­
mentsshallbedestroyedundertheresponsibilityofthe
appropriateauthorities.
ThedestructionofEC-TOPSECRET,EC-SECRETand
EC-CONFIDENTIAL documentsshallbecarriedout
usingashredderoranotherapprovedmethodof
destruction .4.TheprovisionsofthisArticleshallapplyin
conjunctionwiththerulesanddirectivesonthesecurity
ofcomputerizedinformationlaiddowninArticle32.
2.ThedestructionofEC-TOPSECRETand
EC-SECRETdocumentsshallbewitnessed,recordedina
reportandnotedintheregisterofthespecialofficein
question.TITLEVIII
PHYSICALPROTECTION
Article28
Buildings
1.Buildingsorpartsofbuildingshousingclassified
documentsshallbeaccessibleonlytopersonsauthorized
toenterthem.Theyshallbesuitablyprotectedby
providing,wherenecessary,permanentsurveillanceor
installinganalarmsystem.3.Atleastonecopyshallbekeptinthearchiveswith
adequateprotection.
2.Visitorsshallnotbeleftunaccompanied inplaces
whereclassifieddocumentsarekept.TITLEVI
PROTECTION OFOTHERINFORMATION MATERIAL
ANDMEDIA
Article26
Otherinformationmaterial
Informationmaterialandmediaotherthanthose
referredtoinTidesIVandVshallbeprotectedin
accordancewiththeprincipleslaiddowninthesetwo
titles.Article29
Securityfurniture
EC-TOPSECRET,EC-SECRETandEC-CONFIDENTIAL
documentsshallbekeptincupboardsorotherstorage

NoC72/22 OfficialJournaloftheEuropeanCommunities 21.3.92
unitsapprovedbythesecurityofficeasbeingsufficiently
sturdyandhavingasafelockingmechanism.2.EachMemberStateandinstitutionshalladopt
specialrulesforthesecurityofcomputerizedinfor­
mation.Theserulesshallcomprisegeneralmeasures
supplementedbyspecificmeasuresbasedonananalysis
oftherisks.Article30
Protectionofcombination-lock settingsandsecuritykeys
1.Thesettingofcombinationlocksshallbechanged
atthetimeofdelivery,everytimestaffhaving
knowledgeofthesettingischanged,wheneverthe
settinghasorappearstohavebeencompromisedand,at
allevents,every12monthsatleast.
2.Theterm'securitykeys'shallmeanallkeysto
furnitureusedtohouseclassifieddocuments .3.Thesemeasuresshallinparticular:
(a)defineresponsibilitiesfor:
—authorizingaccess,
—applyingtheauthorization procedure(i.e.
permittingaccess),
—checkingeffectiveaccessagainstauthorizations
granted;
(b)ensurereliableidentificationandauthentication of
users;
(c)setthetechnicalsecuritycriteriaforoperating
systems,networksandsoftwareonthebasisof
recognizedstandards;
(d)determinerulesforthemanagementofcomputer
configurationsandinparticularrulesforthecertifi­
cationofthecriteriaprovidedforin(c).3.Holdersofsecuritykeysandthedepartments
responsibleshalltakewhatevermeasuresarenecessaryto
safeguardsecuritykeys,inparticular,topreventunauth­
orizedpersonsfromhavingaccesstothem.
4.Thelossofasecuritykeyorthecompromisingofa
combination-lock settingshallbebroughttothe
immediateattentionofthesecurityofficer,whoshall
arrangeatonceforthelocktobereplacedorthesetting
tobechanged.
Article31
Specialprovisionsfortheprotectionofclassifiedinfor­
mation
Ifspecialcircumstancespreventtheapplicationofanyof
theprovisionsofthisRegulationordictatestricter
measures,theresponsiblesecurityofficer,after
consultingthesecuritydepartment,shalltakeorcauseto
betakenappropriatemeasurestoprovideadegreeof
protectionequivalenttothatprovidedforinthisRegu­
lation.4.Themeasuresshallalsoincludecommonrulesand
technicaloptionsasregards:
(a)theencipheringandauthentication ofdataandthe
managementofkeys;
(b)theprecautionstobetakenfortheeliminationof
electromagnetic radiationbyreferencetothe
Tempeststandard(oraEuropeanequivalenttobe
defined). TITLEIX
PROTECTION OFCOMPUTERIZED INFORMATION
Article32
Securityofcomputerizedinformation
1.Classifiedinformationincomputerizedorelec­
tronicformshallbegovernedbytheprotectivemeasures
laiddowninthisRegulation .Theprocessingofsuch
information(forexample,itsstorageortransmission)
usingequipmentsuchascomputers,networksand
terminalsshallbesubjecttosecuritymeasuresspecially
devisedforthesetechniques .TITLEX
FINALPROVISIONS
Article33
.ProcedureintheeventofinfringementofthisRegulation
1.Anypersonemployedbyaninstitutionwhointhe
courseofhisdutieshasaccesstoclassifiedinformation
shallbeinformedbythesecuritydepartmentorthe

21.3.92 OfficialJournaloftheEuropeanCommunities NoC72/23
securityofficersthatfailuretocomplywiththe
requirementsofthisRegulationrendershimliableto
disciplinaryaction.
2.Anypersonwhofinds,orhasreasontobelieve,
thatclassifiedinformationhasgoneastrayorbeen
compromisedorthataninfringementofthisRegulation
orofsecuritymeasureshasbeencommittedshall
immediatelyinformthesecurityofficer,whowillatonce
informhissuperior.
3.IfthereisasuggestionthatEC-TOPSECRET,
EC-SECRETorEC-CONFIDENTIAL informationhas
cometotheknowledgeofanunauthorizedperson,the
securitydepartmentshallbeinformedimmediatelyso
thatitcanassessthesituation.Article34
Penalties
MemberStatesandinstitutionsshalltakeappropriate
actiontopenalizefailuretocomplywiththe
requirementsofthisRegulation .
Article35
TreatiesoragreementswithMemberStatesandregu­
lations
1.Theseprovisionsshallbewithoutprejudicetothe
obligationsoftheCommunityand/ortheMemberStates
inthisfieldarisingoutoftreatiesoragreements
concludedwiththirdcountries,internationalorganiz­
ationsoranationalofathirdcountry.
2.ThisRegulationshallbewithoutprejudiceto
Regulation(Euratom)No3implementingArticle24of
theTreatyestablishingtheEuropeanAtomicEnergy
Community .
Article36
Entryintoforce
ThisRegulationshallenterintoforceonthe20thday
followingitspublicationintheOfficialJournalofthe
EuropeanCommunities .
ThisRegulationshallbebindinginitsentiretyand
directlyapplicableinallMemberStates.4.Ifthesuspectedbreachwithinthemeaningof
paragraph3isconfirmed,thesecuritydepartmentshall
takeappropriatestepswiththeresponsibleofficials
concernedinordertolimitthedamagecausedtoa
minimumandtopreventanyrecurrence.
5.Ifaseriousinfringement committedinan
institutionoraMemberStateconcernsinformationorig­
inatinginanotherinstitutionorMemberState,that
institutionorMemberStateshallbeadvised.