# Council Decision of 31 March 1992 in the field of security of information systems (92/242/EEC), Division 6.1: Issue

Extent: E+W+S+N.I.

Depending on the exact nature of the security features of information systems, the required functions will need to be incorporated at different parts of the information system including terminals/computers, services, network management to cryptographic devices, smart cards, public and private keys, etc. Some of these can be expected to be embedded in the hardware or software provided by vendors, while others may be part of distributed systems (e.g. network management), in the possession of the individual user (e.g. smart cards) or provided from a specialized organization (e.g. public/private keys).
Most of the security products and services can be expected to be provided by vendors, service providers or operators. For specific functions, e.g. the provision of public/private keys, auditing authorization, there may be the need to identify and mandate appropriate organizations.
The same applies for certification, evaluation and verification of quality of service which are functions which need to be addressed by organizations independent of the interests of vendors, service providers or operators. These organizations could be private, governmental, or licensed by government to perform delegated functions.

---
Source: https://www.legislation.gov.uk/eudn/1992/242/annex/division/1/division/6/division/6.1 (the official version)
Page: https://openlegislation.uk/eu-decision-1992-242/annex/division-1/division-6/division-6.1
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.