**Executive summary**

A new element in the Horizon 2020 is the use of data management plans
detailing what data the project generates and how this data is accessible. The
purpose of this Data Management Plan (DMP) is to provide an analysis of the
main elements of the data management policy that will be used by the STOP-IT
project with regard to all the datasets that will be generated or collected by
the project. This deliverable presents the first version of the DMP for the
STOP-IT project. First, it presents the key considerations made to ensure open
access to the project’s publications. Next, we describe the background for why
and how STOP-IT needs to be an open access project, influencing the overall
data management processes. This deliverable describes the data sets to be
gathered, processed and analysed. These data set descriptions follow the DMP
template provided by the European Commission. This template was circulated to
the project partners responsible for the different pilot studies to be
conducted, and partners completed the data set descriptions according to the
current plans for gathering and analysis of data as well as the methods and
processes foreseen to be applied to ensure compliance with ethics
requirements. In cases, in which open access to research data represents a
risk for compromising the privacy of study participants, data will not be
shared or made accessible. The DMP is not a fixed document, but evolves during
the lifespan of the project; in fact it functions as a dynamic document of
agreements.

**Data Management Plan**

  1. **Introduction**

  

  

**1.1 Purpose of the document**

This Data Management Plan (DMP) describes the data management life cycle for
the data sets to be collected and processed by STOP-IT. The DMP outlines the
handling of research data during the project, and how and what parts of the
data sets will be made available after the project has been completed. This
includes an assessment of when and how data can be shared without disclosing
directly or indirectly identifiable information from study participants [1],
[2].

In principle, publicly funded research data are a public good, produced for
the public interest that should be made openly available with as few
restrictions as possible in a timely and responsible manner that does not harm
intellectual property and confidentiality. On this basis, the DMP intends to
help researchers consider at an early stage, when research is being designed
and planned, how data will be managed during the research process and shared
afterwards with the wider research community.

The DMP specifies the availability of research data, describes measures to
ensure data are properly anonymized to ensure the privacy of informants and
respondents, and to ensure the open data strategy does not violate the terms
made with the Communities of Practice operated by WP2. In any case, the
developed tools and models within the project (WP4) will not contain any case
or company specific information, sensitive data or related inputs and as such,
its availability will not be of threat to any water utility or other
infrastructure operator.

With regard to access to research data, STOP-IT will make the data and
metadata available on the project internal website research data repository.
Project members will, in this repository, have access to both data and
metadata. For the time being, research data is planned to be archived at the
the European repository zenodo.org to ensure re-use in future research
projects and follow-up studies.

With regard to open access to scientific publications, STOP-IT aims to publish
in open access journals (gold open access), and to establish links to
publications behind pay-walls available as final peer-reviewed manuscripts in
an online repository after publication (green open access). To ensure gold
open access, the STOP-IT project will place priority on relevant journals
choosing gold open access journals. With regard to the latter, following the
recommendations of the data management plan ensures we only submit our work to
journals with an easy access to third parties.

The benefits of a well-designed DMP not only concern the way data are treated
but also the successful outcome of the project itself. A properly planned DMP
guides the researchers first to think what to do with the data and then how to
collect, store and process them, etc.

Furthermore, a planning in data treatment is important for addressing timely
security,

privacy and ethical aspects. This way the research data are kept in track in
cases of possible staff or other changes. The DMP can also increase
preparedness for possible data requests. In short, planned activities, such as
implementation of well-designed DMP, stand a better chance of meeting their
goals than unplanned ones.

**1.2 Intended readership**

This deliverable is intended for use internally in the project only and
provides guidance on data management to the project partners and participants.
It is particularly relevant for partners responsible for data collection and
pilots. It is a snapshot of the DMP at the current stage; however, the DMP
will evolve throughout the project as new procedures etc. are added or
existing ones are changed.

The process of planning is also a process of communication, increasingly
important in a multi-partner research. The characteristics of collaboration
should be accordingly harmonised among project partners from different
organisations or different countries. The DMP also provides an ideal
opportunity to engender best practice with regards to e.g. file formats,
metadata standards, storage and risk management practices, leading to greater
longevity and sustainability of data and higher quality standards.

Ultimately, the DMP should engage researchers in conversations with those
providing the services (e.g. water utilities). In this context, the DMP
becomes a document in accordance with relevant standards and community best
practice.

**1.3 Structure of this document**

This deliverable is structured as follows:

  * Section 1 is the introductory chapter describing the main purposes of the DMP 

  

  * Section 2 describes the guiding principles for the overall data management of STOP- 

  

IT.

  * Section 3 presents the data sets to be gathered, processed and analysed, considering the H2020 DMP template [2]. For each data set, we will: (i) provide an identifier for the data set to be produced; (ii) provide the data set description; (iii) refer to standards and metadata; (iv) describe how data will be shared; and (v) describe the procedures for archiving and long-term preservation of the data. 

  

  * Section 4 describes how STOP-IT is aligned to the Horizon 2020 mandate on open access to publications. 

  

**1.4 Relationship with other deliverables**

This document complements the following deliverables:

  * D9.3 – Dissemination and Communication Plan 

  

  * D10.2 – Management of personal data  D10.3 – Big Data approach and privacy 

  

  * D10.4 – how to deal with data not publicly available 

  

This list of related deliverables may be expanded during the course of the
project.

**2 Guiding principles**

The legal requirement for open research data in the Grant Agreement is not
applicable. However, the legal requirements for publications should not
represent a risk for compromising the privacy of informants participating in
the different STOP-IT interviews, focus interview or pilot studies by
following ethical requirements (D7.4). This DMP assesses when and how data can
be shared within a sound research ethical framework, where directly or
indirectly identifiable information is not disclosed in the research process
at any stage (following guidelines specified in [1], [2]).

In addition, we will return to this in section 4. Below, in section 3, we
describe the data sets to be gathered and processed in STOP-IT, and the
procedures followed to ensure access to these data sets without violating the
privacy of informants taking part in the STOP-IT pilot studies.

Figure 1 illustrates the main points to ensure the project has open access to
research data and publications will be ensured in the project (adapted from
[1]).

**Figure 1: STOP-IT data sets and publications**

Finally, it is worth noting that open access to research data and publications
is important within the context of responsible research and innovation  1  .
Ensuring research data and publications can be openly and freely accessed
means that any relevant stakeholder can choose to cross-check and validate
whether research data are accurately and comprehensively reported and
analysed, and may also encourage re-use and re-mixing of data. A better
exploitation of research data has much to offer, also in terms of alleviating
the efforts required by study participants as well as researchers. Optimizing
sharing of research data could potentially imply less duplication of very
similar studies as previously collected data sets may be used at least as
additional sources of data in new projects. Again, we emphasize that open
access to research data must comply with sound research ethics, ensuring no
directly or indirectly identifiable information is revealed.

**3 Data sets to be gathered and processed in STOP-IT**

In this chapter we describe the different data sets that will be gathered and
processed by the STOP-IT-partners. These descriptions follow the template
developed within the project. It will be updated by the project-partners
responsible for the different pilots to be conducted. The data sets follow
many of the same procedures, e.g., with regard to using the project
collaboration tool as a data repository. This means the same wording is often
repeated in the different data sets. As each data set description should give
a comprehensive overview of the gathering, processing and open access
archiving of data, we assessed it as necessary to repeat the procedures in the
different data set descriptions. The name for each data set includes a prefix
"DS" for data set, followed by a case-study identification number, the partner
responsible for collecting and processing the data, as well as a short title.
The template requires that information about a data set is provided. We have
primarily based the outlining of how and what data will be created on the
guidelines provided by the European University Institute [3].

Table 1 gives a preliminary overview of the datasets to be collected. The
descriptions of each data set, following the STOP-IT template, will be
provided in the following sections in later versions of this deliverable. The
STOP-IT dataset template is provided in Annex A.

#  Table 1: Overview of data sets  
  
<table>  
<tr>  
<th>

**No.**

</th>  
<th>

**Identifier/Name**

</th>  
<th>

**Brief description**

</th>  
<th>

**Dissemination**

</th> </tr>  
<tr>  
<td>

1

</td>  
<td>

Threats/Events

</td>  
<td>

Includes the physical and cyber threads or events in the water utilities
infrastructure

</td>  
<td>

CO

</td> </tr>  
<tr>  
<td>

2

</td>  
<td>

Risks

</td>  
<td>

Refers to the RIDB (task 3.2)

</td>  
<td>

CO

</td> </tr>  
<tr>  
<td>

3

</td>  
<td>

Reduction Measures

</td>  
<td>

Refers to the RRM (task 4.3)

</td>  
<td>

PU

</td> </tr>  
<tr>  
<td>

4

</td>  
<td>

Population

</td>  
<td>

Refers to the population data for each FR water utility

</td>  
<td>

PU

</td> </tr>  
<tr>  
<td>

5

</td>  
<td>

Supply

</td>  
<td>

Includes the data of the supply for the pilot demos

</td>  
<td>

PU

</td> </tr>  
<tr>  
<td>

6

</td>  
<td>

Demand

</td>  
<td>

Includes the data of the demand for the pilot demos

</td>  
<td>

PU

</td> </tr>  
<tr>  
<td>

7

</td>  
<td>

Critical Infrastructure

</td>  
<td>

Refers to the existing critical

infrastructure for each FR water utility

</td>  
<td>

CO

</td> </tr>  
<tr>  
<td>

8

</td>  
<td>

Vulnerable assets

</td>  
<td>

Refers to the list of vulnerable assets

</td>  
<td>

CO

</td> </tr> </table>

**3.1 Data discoverability (making data Findable)**

The data will be stored, by each responsible partner, following their internal
policy guidelines and providing metadata making them discoverable. For
example, for the performance of the machine learning algorithms the timestamps
by the data originator or as otherwise agreed should be known. The details are
not yet available and should be defined in the next few months with the
partners who will be responsible for the specific procedures (e.g., machine
learning).

**3.2 Data sharing**

**Access procedures:** Public datasets are available from
_https://www.innovationplace.eu/_ .

**Document format and availability** : The datasets will be available as PDF/A
at https://www.innovationplace.eu/. From here the fully anonymized data are
accessible to anyone within the project, free of charge.

The dataset will be as open as possible and as closed as necessary, according
to the EC regulations. To this goal, the Zenodo open data repository for the
STOP-IT project will be developed. It is funded by the EC (via the OpenAIRE
projects), CERN and donations, hosted by CERN, embedded in its IT department.
This repository allows for the deposition of all kinds of digital content:
publications, data, software, multimedia etc. All published data will be
provided with a Digital Object Identifier (DOI): Once published, datasets
remain fixed over their lifetime, while the metadata can change.

The data will be uploaded to zenodo.org in M36 of STOP-IT's project period.
Before uploading datasets, we will first have to anonymize data. We anonymize
data after each interview. Nevertheless, we will further verify that data is
anonymized in the final month of the project.

**3.3 Data Interoperability**

The final architecture and the way the STOP-IT platform will be connected with
the various technological components of the project, as well as the legacy
systems was not finalized at the time of writing this deliverable. Different
options will be investigated in order to ensure interoperability and at the
same time to serve the objectives of the project.

In general, the STOP-IT approach (both in terms of internal design but also in
terms of output and exchanged data with other systems) amounts to the usage of
a few wellestablished interfaces, where feasible; limiting the complexity
generated by multiple types of interfaces (and gateways) is considered by the
consortium a key-point in achieving data interoperability.

Taking into account the early stage of the project and the fact that several
implementation choices are subject to update, we discuss in more details how
STOP-IT seeks to provide a data-interoperable solution:

**3.4 Archiving and preservation (including storage and backup)**

Archiving of the anonymized dataset at zenodo.org guarantees a long-term and
secure preservation of the data at no additional cost for the project. The
STOP-IT repository can be reached at _https://zenodo.org/communities/stop-it-
project. Every partner will be responsible_ _for uploading open data that they
own. Open data will be accessible to any and all third_ _parties through_
Zenodo.

**4 Open access to publications**

Any publications from STOP-IT must be available as open access (as far as
practicable possible). Open access to publications can be ensured either by
publishing in Gold open access journals or Green open access journals. As part
of the dissemination and publication plan in WP9, STOP-IT relevant journals
will be reviewed, and an initial list of relevant journal will be presented in
D9.3.

Gold open access means the article is available as open access by the
scientific publisher. Some journals require an author-processing fee for
publishing open access.

Green open access or self-archiving means that the published article or the
final peerreviewed manuscript is archived by the researcher in an online
repository (e.g., on InnovationPlace), in most cases after its publication.
Most journals within the social sciences domains require authors to delay
self-archiving to repositories to 12 months after the article first being
published.

In the STOP-IT project, author-publishing fees for gold open access journals
can be reimbursed within the project period and budget. There are, however, a
very good selection of relevant gold open access and green open access
journals available that do not charge author processing fees. Scholarly
publication can take a very long time, and final acceptance of all submitted
manuscripts may not occur before the end of the STOP-IT project. For these
reasons, we will prioritize to submit our work to gold open access journals
without author processing fees, or to green open access journals.

Project members will maintain an updated list of relevant journals in the
project internal collaboration tool.

**5 Code of Conduct**

Finally, and most important is the need to define which possible uses are
allowed on the data pool built from the project. The data usage can be managed
by defining specific purposes, establishing ethical guidelines or generating
Codes of Conduct. Most of the existing codes of conduct emerged in the area of
data analytics tackle these similar topics:

  * Don't break the law. 

  

  * Be professional. Make sure you are up to date with all analytical techniques to avoid using the wrong or suboptimal style of analytics. 

  

  * Work scientifically, and don't be goal directed (working toward a certain desired result). Be prepared to reject every hypothesis. 

  

  * Respect the points of view of other professionals. Seek review from others to improve analytical results. 

  

  * As a hygiene factor, take care of security. 

  

The STOP-IT project will implement a specific Code of Conduct particularised
to the use cases and data sources to be integrated, but that will be initially
based on the Data Science Code of Professional Conduct established by the Data
Science Association [5].

An explicit commitment of all data users will be to notify any possible re-
identification of a specific data subject based on the combination of the data
provided by different operators.

**6 Data Exchange with third countries**

The ethical standards and guidelines of Horizon2020 will be rigorously
applied, regardless of the country in which the research is carried out.

The STOP-IT partners that are not EU members are located in Norway and Israel.
According to Commission decisions, personal data can flow to and from Norway
without any safeguards being necessary [6]. The Commission has also recognized
**Israel** as providing adequate protection.

Furthermore, no raw data will be exported from the country in which it is
collected, also due to the internal security regulations at the participating
water network operators. Only suitably anonymized and aggregated data will be
exported, in accordance with the rules laid out by the STOP-IT security board.

SINTEF will take the role as data controller ensuring that:

  * Personal Data will be processed legally and fairly; 

  

  * Data will be collected for explicit and legitimate purposes and used accordingly; 

  

  * Data will be adequate, relevant and not excessive in relation to the purposes for which it is collected and processed; 

  

  * Data will be accurate, and updated where necessary; 

  

  * Data subjects can rectify, remove or block incorrect data about themselves; 

  

  * Data that identifies individuals (personal data) will not be kept any longer than necessary; 

  

  * We will protect personal data against accidental or lawful destruction, loss, alteration and disclosure, particularly when processing involves data transmission over networks. Appropriate security measures will be implemented. 

  

Protection measures will ensure a level of protection appropriate to the data.
The H2020 program has made available guidelines to help participants to
complete the ethics SelfAssessment in their proposals [7]. According to that
document (see Pages 19 and 20) the data transfer within EU/EEA countries is
not subject to specific requirements (i.e., specific authorizations or other
restrictions), but only needs to comply with the general requirements of
Directive 95/46/EC. In addition, for data transfer to third countries on the
“Commission list of countries offering adequate protection” no additional
requirements are solicited, and thus the data transfer from EU to them
responds to the referred EU Directive.

Only partners from Norway as EEA member and Israel as Associated Countries
participate in STOP-IT. Accordingly, the Directive allows personal data flow
without any further safeguard being necessary to Norway (as EEA member
country) and Israel (belongs to the “Commission list of countries offering
adequate protection”). Therefore, the consortium does not need to take any
further action for transferring data to Norway and Israel beyond the
application of Directive 95/46/EC.

**7 Confidential deliverables**

In addition to the deliverables classified as RESTREINT EU /EU RESTRICTED, the
following deliverables are deemed to be Confidential, and will only be
disseminated to the members of the consortium (including the Commission
Services).

#  Table 2: Project Confidential Deliverables  
  
<table>  
<tr>  
<th>

**Deliverable**

**Number**

</th>  
<th>

**Deliverable**

**Title**

</th>  
<th>

**WP**

**number**

</th>  
<th>

**Lead beneficiary**

</th>  
<th>

**Type**

</th>  
<th>

**Dissemination level**

</th>  
<th>

**Due**

**Date (in months)**

</th> </tr>  
<tr>  
<td>

D3.1

</td>  
<td>

Establishing the context

for risk

assessment in FR water utility

</td>  
<td>

WP3

</td>  
<td>

3 - CET

</td>  
<td>

Report

</td>  
<td>

Confidential, only for

members

of the consortium (including the

Commission

Services)

</td>  
<td>

9

</td> </tr>  
<tr>  
<td>

D3.3

</td>  
<td>

Definition of end-user requirements in FR

water utility.

</td>  
<td>

WP3

</td>  
<td>

3 - CET

</td>  
<td>

Report

</td>  
<td>

Confidential, only for

members

of the consortium (including the

Commission

Services)

</td>  
<td>

12

</td> </tr>  
<tr>  
<td>

D7.3

</td>  
<td>

Integration

report per demo

site

</td>  
<td>

WP7

</td>  
<td>

12 - ICCS

</td>  
<td>

Report

</td>  
<td>

Confidential, only for

members of the consortium (including the

Commission

Services)

</td>  
<td>

32

</td> </tr>  
<tr>  
<td>

D9.4

</td>  
<td>

Final

Exploitation and business plan

</td>  
<td>

WP9

</td>  
<td>

16 - PNO

</td>  
<td>

Report

</td>  
<td>

Confidential, only for

members of the consortium (including the

Commission

Services)

</td>  
<td>

48

</td> </tr>  
<tr>  
<td>

D10.1

</td>  
<td>

Data protection ethics approval (H – Requirement No. 2 )

</td>  
<td>

WP10

</td>  
<td>

1 - SINTEF

</td>  
<td>

Ethics

</td>  
<td>

Confidential, only for

members of the consortium (including the

Commission

Services)

</td>  
<td>

30

</td> </tr>  
<tr>  
<td>

D10.2

</td>  
<td>

Procedures for data collection, storage, protection, retention and destruction

(POPD –

Requirement

No. 3 )

</td>  
<td>

WP10

</td>  
<td>

1 - SINTEF

</td>  
<td>

Ethics

</td>  
<td>

Confidential, only for

members of the consortium (including the

Commission

Services)

</td>  
<td>

6

</td> </tr>  
<tr>  
<td>

D10.3

</td>  
<td>

Considerations on personal data in the big data approach

(POPD –

Requirement

No. 4)

</td>  
<td>

WP10

</td>  
<td>

1 – SINTEF

</td>  
<td>

Ethics

</td>  
<td>

Confidential, only for

members of the consortium (including the

Commission

Services)

</td>  
<td>

6

</td> </tr>  
<tr>  
<td>

D10.4

</td>  
<td>

Authorisations for use of data not publicly

available

(POPD – Requirement

No. 6 )

</td>  
<td>

WP10

</td>  
<td>

1 - SINTEF

</td>  
<td>

Ethics

</td>  
<td>

Confidential, only for

members of the consortium (including the

Commission

Services)

</td>  
<td>

6

</td> </tr>  
<tr>  
<td>

D10.5

</td>  
<td>

Report from ethics advisor

(GEN – Requirement

No. 10)

</td>  
<td>

WP10

</td>  
<td>

1 - SINTEF

</td>  
<td>

Ethics

</td>  
<td>

Confidential, only for

members of the consortium (including the

Commission

Services)

</td>  
<td>

12

</td> </tr> </table>

**8 Classified data**

The STOP-IT project does not envision using classified data as input, but a
number of

STOP-IT deliverables have been flagged as classified (RESTREINT UE / EU

RESTRICTED) for reasons of aggregation. Any classified deliverables will be
handled in accordance with EU rules.

The evaluation process concluded that the following STOP-IT deliverables shall
be classified RESTREINT UE / EU RESTRICTED:

#  Table 3: Provisional EU RESTRICTED deliverables  
  
<table>  
<tr>  
<th>

D2.3 – Best Practice guidelines for CoPs in Water Infrastructure Protection
(M48)

</th> </tr>  
<tr>  
<td>

D4.1 – Asset vulnerability assessment Tool (M12)

</td> </tr>  
<tr>  
<td>

D5.1 – Secure Wireless Sensor Communications Module (M21)

</td> </tr>  
<tr>  
<td>

D5.2 – IT and SCADA Security technologies (M18)

</td> </tr>  
<tr>  
<td>

D5.3 – Physical threats protection technologies (M18)

</td> </tr>  
<tr>  
<td>

D5.7 – Real-Time anomaly detection system (M24)

</td> </tr>  
<tr>  
<td>

D6.1 – STOP-IT architecture and STOP-IT framework design (M11)

</td> </tr>  
<tr>  
<td>

D6.5 – Integrated framework- version 1 (M29)

</td> </tr>  
<tr>  
<td>

D6.5 – Integrated framework- version 2 (M36)

</td> </tr>  
<tr>  
<td>

D7.1 – Pilot Plans and Report for the demo preparations (M18)

</td> </tr>  
<tr>  
<td>

D7.4 – Risk Management plan (draft M36) (M48)

</td> </tr>  
<tr>  
<td>

D7.5 – Lessons Learned, societal impact and STOP-IT adoption Roadmap (M48)

</td> </tr>  
<tr>  
<td>

D9.5 – STOP-IT adaptation roadmap (M48)

</td> </tr> </table>

The consortium does not agree with this classification for all deliverables,
so a process for declassification of selected deliverables will be initiated
by M12. In the meantime, all deliverables listed in Table 3 must be treated as
outlined below.

**8.1 Production of classified deliverables**

All classified deliverables must be treated as RESTREINT UE / EU RESTRICTED,
also as work-in-progress (see section 8.3). Please refer to the "Guidelines
for the classification of information in research projects" [9], and note the
following:

  * Do NOT prioritise any threats described in any deliverable 

  

  * Do NOT perform any criticality analyses, vulnerability modelling of supply systems or provide any information on vulnerability assessment methodologies without anonymizing the water operators involved 

  

  * Do NOT provide any information on the performance of systems installed in water infrastructures without anonymizing the water operators involved 

  

  * Do NOT perform any in-depth quantitative analyses of the potential or actual consequences of attacks against water infrastructures without anonymizing the water operators involved (if in doubt consult the SAB regarding acceptable depth). 

    2. **Quality Assurance**

  
  

  

The Quality Assurance process as outlined in the Quality Assurance Plan (D1.2)
will also apply to classified deliverables, but only partners with a specified
need to know (as outlined in the Grant Agreement) will be involved in the QA
process. Partners involved with the QA process for classified deliverables
will need to have access to a computer approved for RESTREINT UE / EU
RESTRICTED (see below).

  3. **Handling of classified deliverables**

  

  

All classified deliverables must be treated according to RESTREINT UE / EU
RESTRICTED handling rules, also when they are works-in-progress.

Since STOP-IT partners do not have access to classified computer networks,
each partner involved with production of classified deliverables will need to
procure (at least) one computer approved for RESTREINT UE / EU RESTRICTED, as
described in national guidelines for securing stand-alone computer systems
[8].

  1. **Marking and storage of paper copies and equipment**

  

  

**Figure 2: Marking of classified documents**

All equipment used to create, edit or view information classified as RESTREINT
UE / EU RESTRICTED shall be stored in the same manner as documents classified
as RESTREINT UE / EU RESTRICTED.

Documents classified as RESTREINT UE / EU RESTRICTED shall be clearly marked
top and bottom, as shown in Figure 2. When not in use by authorized personnel,
documents classified as RESTREINT UE / EU RESTRICTED shall be locked down in a
filing cabinet or similar that satisfies national rules for storing documents
of equivalent classification of

RESTREINT UE / EU RESTRICTED.

  2. **Sending classified deliverables**

  

  

Hardcopies of classified deliverables must be placed in an addressed envelope
sealed with security tape, with classification markings top and bottom as
illustrated in Figure 3 and Figure 4, and this envelope should be placed in an
opaque, unmarked envelope, and sent to the addressee using registered mail
(Figure 5).

**Figure 3: Envelope sealed with security tape**

**Figure 4: Sealed and marked inner envelope placed in outer envelope**

**Figure 5: Outer envelope with address but no classification markings**

  3. **Requirements for computer equipment**

  

  

Recommendations for stand-alone computer equipment include at least the
following (national authorities may have additional requirements):

  * Not connected to network 

  

  * No wireless connections 

  

  * No built-in camera or microphone 

  

  * Full disk encryption 

  

  * No network printers 

  

  * 64-bit processor 

  

  * BIOS password 

  

  * The equipment must be labelled "RESTREINT UE / EU RESTRICTED" 

  

No private PCs may be used for handling RESTREINT UE / EU RESTRICTED
information.

Stand-alone PCs should run Windows 7 Professional or better.

  4. **Encryption software**

  

  

Information classified RESTREINT UE / EU RESTRICTED may be encrypted by an
approved encryption system, and the encrypted data may be sent over an
unsecure network. A list of approved software solutions is available from EU
[10]. STOP-IT has chosen the off-line encryption tool Zed! [11] for use within
the project. It is relatively inexpensive, has EAL3+ evaluation, and also has
the option of downloading a free readonly version, implying that only partners
that need to send RESTREINT UE / EU RESTRICTED have to purchase the
professional version.

  5. **Responsibility**

  

  

The adherance to these rules is the responsibility of

  * The work package leader (of the relevant WPs producing or reading classified deliverables) 

  

  * The partner responsible for each classified deliverable 

  

  * The Project Steering Board (PSB) member for the partners involved in producing or reading each classified deliverable 

  

It is this up to the abovementioned roles to ensure that each individual
involved follows the rules.  
  
<table>  
<tr>  
<th>

Production of classified Foreground information

</th> </tr>  
<tr>  
<td>

Subject

</td>  
<td>

Classification Level

</td>  
<td>

Beneficiary involved in the production or wanting to access

</td> </tr>  
<tr>  
<td>

Name

</td>  
<td>

Responsibility

</td>  
<td>

Date of production

</td>  
<td>

Comments including purpose of the access and planned use

</td> </tr>  
<tr>  
<td>

D2.3 - Best Practice guidelines for

CoPs in

Water

Infrastructure

Protection

</td>  
<td>

RESTREINT UE / EU RESTRICTED

</td>  
<td>

KWR

IWW

SINTEF

TECHN PNO

CET

EUT

RISA

ICCS

AB

VAV

BWB

MEK

</td>  
<td>

Security

Manager/Main contributor Contributor

Contributor

Contributor

Contributor

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

</td>  
<td>

M48

</td>  
<td>

</td> </tr>  
<tr>  
<td>

D4.1 - Asset vulnerability assessment

tool

</td>  
<td>

RESTREINT UE / EU RESTRICTED

</td>  
<td>

TECHN

SINTEF

IWW MEK

ICCS

KWR

CET

AB

EUT

ATOS

WS

RISA

VAV

BWB

</td>  
<td>

Security

Manager/Main contributor Contributor

Contributor

Contributor

Contributor

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

</td>  
<td>

M12

</td>  
<td>

as input to D4.2 as input to D4.2 as input to D4.2

as input to D4.5 as input to D6.5 and D6.6 as input to D6.5 and D6.6 as input
to D6.5 and D6.6

</td> </tr> </table>

**8.4 Access to classified data**

#  Table 4: Access to classified deliverables  
  
  
<table>  
<tr>  
<th>

Production of classified Foreground information

</th> </tr>  
<tr>  
<td>

Subject

</td>  
<td>

Classification Level

</td>  
<td>

Beneficiary involved in the production or wanting to access

</td> </tr>  
<tr>  
<td>

Name

</td>  
<td>

Responsibility

</td>  
<td>

Date of production

</td>  
<td>

Comments including purpose of the access and planned use

</td> </tr>  
<tr>  
<td>

D5.1 - Secure

Wireless

Sensor Communicati ons Module

</td>  
<td>

RESTREINT UE / EU RESTRICTED

</td>  
<td>

WS

EUT

RISA

ATOS

ICCS

SINTEF

IWW

CET

KWR

AB

VAV

MEK

BWB

PNO

</td>  
<td>

Security manager/main contributor Contributor

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

</td>  
<td>

M21

</td>  
<td>

as input to D6.5 and D6.6 as input to D6.5 and D6.6

as input to D6.5 and D6.6

</td> </tr>  
<tr>  
<td>

D5.2 -IT and

SCADA

Security technologies

</td>  
<td>

RESTREINT UE / EU

RESTRICTED

</td>  
<td>

TECHN

SINTEF

CET

EUT ATOS mnem

RISA

ICCS

WS

IWW

KWR

</td>  
<td>

Security

Manager/Main contributor Contributor

Contributor

Contributor

Contributor

Contributor

Reader only

Reader only

Reader only

Reader only

Reader only

</td>  
<td>

M18

</td>  
<td>

as input to D6.5 and D6.6 as input to D6.5 and D6.6

as input to D6.5

</td> </tr> </table>  
<table>  
<tr>  
<th>

Production of classified Foreground information

</th> </tr>  
<tr>  
<td>

Subject

</td>  
<td>

Classification Level

</td>  
<td>

Beneficiary involved in the production or wanting to access

</td> </tr>  
<tr>  
<td>

Name

</td>  
<td>

Responsibility

</td>  
<td>

Date of production

</td>  
<td>

Comments including purpose of the access and planned use

</td> </tr>  
<tr>  
<td>

D5.3 - Physical threats protection technologies

</td>  
<td>

RESTREINT UE / EU

RESTRICTED

</td>  
<td>

ICCS

CET

ATOS

MEK

AB

Apl

EUT

RISA

WS

SINTEF

IWW

KWR

</td>  
<td>

Security

Manager/Main contributor Contributor

Contributor

Contributor

Contributor

Contributor

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

</td>  
<td>

M18

</td>  
<td>

as input to D6.5 and D6.6 as input to develop D6.5 and D6.6 as input to
develop D6.5

</td> </tr>  
<tr>  
<td>

D5.7 - RealTime anomaly detection system

</td>  
<td>

RESTREINT UE / EU RESTRICTED

</td>  
<td>

EUT

CET

TECHN

ATOS

AB

ICCS WS mnem

RISA

SINTEF

IWW

KWR

VAV

BWB

MEK PNO

</td>  
<td>

Security

Manager/Main contributor Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

</td>  
<td>

M24

</td>  
<td>

as input to develop D6.5 and D6.6

</td> </tr> </table>  
<table>  
<tr>  
<th>

Production of classified Foreground information

</th> </tr>  
<tr>  
<td>

Subject

</td>  
<td>

Classification Level

</td>  
<td>

Beneficiary involved in the production or wanting to access

</td> </tr>  
<tr>  
<td>

Name

</td>  
<td>

Responsibility

</td>  
<td>

Date of production

</td>  
<td>

Comments including purpose of the access and planned use

</td> </tr>  
<tr>  
<td>

D6.1- STOP-

IT architecture and STOP-IT framework design

</td>  
<td>

RESTREINT UE / EU RESTRICTED

</td>  
<td>

ATOS

CET

EUT

ICCS

RISA

WS

SINTEF

IWW

KWR

AB

VAV

BWB

MEK

</td>  
<td>

Security

Manager/Main contributor Contributor

Contributor

Contributor

Contributor

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

</td>  
<td>

M11

</td>  
<td>

as input to develop D6.5

</td> </tr>  
<tr>  
<td>

D6.5 - Integrated framework- version 1

</td>  
<td>

RESTREINT UE / EU RESTRICTED

</td>  
<td>

RISA

EUT

ATOS

ICCS

WS

mnem

Apl

CET

SINTEF

IWW

KWR

AB

VAV

MEK

BWB

</td>  
<td>

Security

Manager/Main contributor Contributor

Contributor

Contributor

Contributor

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

</td>  
<td>

M29

</td>  
<td>

as input to develop D6.6

to be used in WP7 to be used in WP7 to be used in WP7 to be used in WP7

</td> </tr> </table>  
<table>  
<tr>  
<th>

Production of classified Foreground information

</th> </tr>  
<tr>  
<td>

Subject

</td>  
<td>

Classification Level

</td>  
<td>

Beneficiary involved in the production or wanting to access

</td> </tr>  
<tr>  
<td>

Name

</td>  
<td>

Responsibility

</td>  
<td>

Date of production

</td>  
<td>

Comments including purpose of the access and planned use

</td> </tr>  
<tr>  
<td>

D6.6 - Integrated framework- version 2

</td>  
<td>

RESTREINT UE / EU RESTRICTED

</td>  
<td>

EUT

CET

ATOS

ICCS

RISA

WS mnem

Ap

PNOI

SINTEF

IWW

KWR

AB

VAV

MEK

BWB

</td>  
<td>

Security

Manager/Main contributor Contributor

Contributor

Contributor

Contributor

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

</td>  
<td>

M36

</td>  
<td>

to be used in WP7 to be used in WP7 to be used in WP7 to be used in WP7

</td> </tr> </table>  
<table>  
<tr>  
<th>

Production of classified Foreground information

</th> </tr>  
<tr>  
<td>

Subject

</td>  
<td>

Classification Level

</td>  
<td>

Beneficiary involved in the production or wanting to access

</td> </tr>  
<tr>  
<td>

Name

</td>  
<td>

Responsibility

</td>  
<td>

Date of production

</td>  
<td>

Comments including purpose of the access and planned use

</td> </tr>  
<tr>  
<td>

D7.1 - Pilot

Plans and Report for the demo

preparations

</td>  
<td>

RESTREINT UE / EU RESTRICTED

</td>  
<td>

ICCS

SINTEF

IWW

CET

EUT

TECHN

ATOS

MEK

AB

VAV

BWB

RISA

KWR

Apl

WS mnem

</td>  
<td>

Security

Manager/Main contributor Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Reader only

Reader only

Reader only

Reader only

</td>  
<td>

M18

</td>  
<td>

as input to T7.2 as input to T7.3 as input to T7.3 as input to T7.4

</td> </tr> </table>  
<table>  
<tr>  
<th>

Production of classified Foreground information

</th> </tr>  
<tr>  
<td>

Subject

</td>  
<td>

Classification Level

</td>  
<td>

Beneficiary involved in the production or wanting to access

</td> </tr>  
<tr>  
<td>

Name

</td>  
<td>

Responsibility

</td>  
<td>

Date of production

</td>  
<td>

Comments including purpose of the access and planned use

</td> </tr>  
<tr>  
<td>

D7.4 - Risk Management

plan (draft

M36)

</td>  
<td>

RESTREINT UE / EU RESTRICTED

</td>  
<td>

CET

VAV

BWB

MEK

AB

SINTEF

IWW

EUT

TECHN

ATOS

ICCS

Apl

WS RISA mnem

KWR

</td>  
<td>

Security

Manager/Main contributor Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Reader only

</td>  
<td>

M48

</td>  
<td>

</td> </tr>  
<tr>  
<td>

D7.5 - Lessons Learned, societal impact and STOP-IT adoption roadmap

</td>  
<td>

RESTREINT UE / EU

RESTRICTED

</td>  
<td>

CET

SINTEF

IWW MEK

AB

VAV

ICCS

BWB

RISA

KWR

EUT

PNO

</td>  
<td>

Security

Manager/Main contributor Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Contributor

Reader only

Reader only

Reader only

</td>  
<td>

M48

</td>  
<td>

</td> </tr> </table>  
<table>  
<tr>  
<th>

</th>  
<th>

</th>  
<th>

Production of classified Foreground information

</th> </tr>  
<tr>  
<td>

Subject

</td>  
<td>

Classification Level

</td>  
<td>

Beneficiary involved in the production or wanting to access

</td> </tr>  
<tr>  
<td>

Name

</td>  
<td>

Responsibility

</td>  
<td>

Date of production

</td>  
<td>

Comments including purpose of the access and planned use

</td> </tr>  
<tr>  
<td>

D9.5 - STOPIT adaptation roadmap

</td>  
<td>

RESTREINT UE / EU RESTRICTED

</td>  
<td>

WssTP

PNO BK

EMA

HW

DeW

TECHN

ATOS

Apl

WS mnem SINTEF

IWW

CET

KWR EUT

RISA

ICCS

VAV

BWB

AB

MEK

</td>  
<td>

Security

Manager/Main contributor Contributor

Contributor

Contributor

Contributor

Contributor

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

Reader only

</td>  
<td>

M48

</td>  
<td>

</td> </tr> </table>

**9 Conclusions**

Since the DMP is expected to mature during the project, more developed
versions of the plan will be produced at later stages (in M12, M18, M24, M36
and M48). In this initial DMP we have described the requirements imposed on
STOP-IT with regard to access to research data and open access to
publications. The project partners have decided to use a combination of
collaborative web-site and zenodo.org as the open project and publication
repository, and to link the repository to a STOP-IT project site.

Chapter 3, which describes the data sets, is the most important part of the
DMP. These descriptions will likely need to be revised to provide updated
versions as the STOP-IT project evolves. We believe this is required as the
DMP should be a living document. Although we have attempted to take into
consideration the data management life cycle for the data sets to be collected
and processed by STOP-IT, it is very likely that additions and changes may be
needed.

This DMP acknowledges the importance of STOP-IT-relevant open access journals,
with an emphasis on gold open access journals. Project members will maintain
an updated list of relevant journals in the project´s internal collaboration
system. For each planned publication we will consider which journals will be
the most appropriate first choices for publication.