101.

Calls on the competent services of the Secretariat of the European Parliament, under the responsibility of the President of Parliament, to carry out, by June 2015 at the latest with an intermediate report by December 2014 at the latest, a thorough review and assessment of Parliament’s IT security dependability, focused on: budgetary means, staff resources, technical capabilities, internal organisation and all relevant elements, in order to achieve a high level of security for Parliament’s IT systems; believes that such an assessment should at the least provide information, analysis and recommendations on: — the need for regular, rigorous and independent security audits and penetration tests, with the selection of outside security experts ensuring transparency and guarantees of their credentials vis-à-vis third countries or any types of vested interest; — the inclusion in tender procedures for new IT systems of best-practice specific IT security/privacy requirements, including the possibility of a requirement for open-source software as a condition of purchase or a requirement that trusted European companies should take part in the tender when sensitive, security-related areas are concerned; — the list of companies under contract with Parliament in the IT and telecom fields, taking into account any information that has come to light about their cooperation with intelligence agencies (such as revelations about NSA contracts with a company such as RSA, whose products Parliament is using to supposedly protect remote access to their data by its Members and staff), including the feasibility of providing the same services by other, preferably European, companies; — the reliability and resilience of the software, and especially off-the-shelf commercial software, used by the EU institutions in their IT systems with regard to penetrations and intrusions by EU or third-country law enforcement and intelligence authorities, taking also into account relevant international standards, best-practice security risk management principles, and adherence to EU Network Information Security standards on security breaches; — the use of more open-source systems; — steps and measures to take in order to address the increased use of mobile tools (e.g. smartphones, tablets, whether professional or personal) and its effects on the IT security of the system; — the security of the communications between the different workplaces of the Parliament and of the IT systems used in Parliament; — the use and location of servers and IT centres for Parliament’s IT systems and the implications for the security and integrity of the systems; — the implementation in reality of the existing rules on security breaches and prompt notification of the competent authorities by the providers of publicly available telecommunication networks; — the use of cloud computing and storage services by Parliament, including the nature of the data stored in the cloud, how the content and access to it is protected and where the cloud-servers are located, clarifying the applicable data protection and intelligence legal framework, as well as assessing the possibilities of solely using cloud servers that are based on EU territory; — a plan allowing for the use of more cryptographic technologies, in particular end-to-end authenticated encryption for all IT and communications services such as cloud computing, email, instant messaging and telephony; — the use of electronic signatures in email; — a plan for using a default encryption standard, such as the GNU Privacy Guard, for emails that would at the same time allow for the use of digital signatures; — the possibility of setting up a secure instant messaging service within Parliament allowing secure communication, with the server only seeing encrypted content;