{
  "url": "https://openlegislation.uk/eu-decision-2010-260/article-6",
  "json_url": "https://openlegislation.uk/eu-decision-2010-260/article-6.json",
  "legislation": "eudn/2010/260",
  "legislation_title": "Commission Decision of 4 May 2010 on the Security Plan for the operation of the Visa Information System (2010/260/EU)",
  "legislation_url": "https://openlegislation.uk/eu-decision-2010-260",
  "path": "article/6",
  "kind": "article",
  "number": "6",
  "heading": "Incident management",
  "text": "1. All staff and contractors involved in developing, managing or operating VIS shall be required to note and report any observed or suspected security weaknesses in the operation of VIS to the System Security Officer or the Local Security Officer for the central VIS or the Local Security Officer for the communication infrastructure, as appropriate.\n2. In case of detection of any incident that has or may have an impact on the security of the operation of VIS, the Local Security Officer for the central VIS or the Local Security Officer for the communication infrastructure shall inform as quickly as possible the System Security Officer and, where appropriate, the single national contact point for VIS security, if such a contact point exists in the Member State in question, in writing or, in case of extreme urgency, via other communication channels. The report shall contain the description of the security incident, the level of risk, the possible consequences and the measures that have been or should be taken to mitigate the risk.\n3. Any evidence in relation to the security incident shall be secured immediately by the Local Security Officer for the central VIS or the Local Security Officer for the communication infrastructure, as appropriate. To the extent possible under applicable data protection provisions, such evidence shall be made available to the System Security Officer upon request of the latter.\n4. Feedback processes shall be implemented to ensure that information about the results is communicated, once the incident has been dealt with and terminated.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eudn/2010/260/article/6",
    "retrieved_at": "2026-11-01T15:16:07.680404+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}