OpenLegislation

Article 13 Access control

United Kingdom

Original text. Later amendments are not shown.

1.

The Security Policy shall establish a formal staff registration and de-registration procedure in place for granting and revoking access to SIS II hardware and software for the purposes of the operational management. The allocation and use of adequate access credentials (passwords or other appropriate means) shall be controlled through a formal management process as laid down in the Security Policy.

2.

Access to SIS II hardware and software at the CS-SIS shall:

  1. (i)

    be restricted to authorised persons;

  2. (ii)

    be limited to cases where a legitimate purpose in accordance with Article 45 of Regulation (EC) No 1987/2006 and Article 61 of Decision 2007/533/JHA, or with Article 50(2) of Regulation (EC) No 1987/2006 and Article 66(2) of Decision 2007/533/JHA, can be identified;

  3. (iii)

    not exceed the duration and scope necessary for the purpose of the access; and

  4. (iv)

    take place only in accordance with an access control policy to be defined in the Security Policy.

3.

Only the consoles and software authorised by the Local Security Officer for Central SIS II shall be used at the CS-SIS. The use of system utilities that might be capable of overriding system and application controls shall be restricted and controlled. There shall be procedures in place to control the installation of software.