Article 5 Security incidents

Any event that has or may have an impact on the security of the operation of VIS and may cause damage or loss to the VIS shall be considered as a security incident, especially where access to data may have occurred or where the availability, integrity and confidentiality of data has or may have been compromised.

The Security Policy shall establish procedures to recover from an incident. Security incidents shall be managed to ensure a quick, effective and proper response in compliance with the Security Policy.

Information regarding a security incident that has or may have an impact on the operation of VIS in a Member State or on the availability, integrity and confidentiality of the VIS data entered by a Member State, shall be provided to the Member State concerned. Security incidents shall be notified to the Data Protection Officer of the Commission.