Article 6 Incident management

All staff and contractors involved in developing, managing or operating SIS II shall be required to note and report any observed or suspected security weaknesses in the Communication Infrastructure to the System Security Officer or the Local Security Officer for the Communication Infrastructure.

In case of detection of any incident that has or may have an impact on the security of SIS II, the Local Security Officer for the Communication Infrastructure shall inform as quickly as possible the System Security Officer and, where appropriate, the single national contact point for SIS II security, if such a contact point exists in the Member State in question, in writing or, in case of extreme urgency, via other communication channels. The report shall contain the description of the security incident, the level of risk, the possible consequences and the measures that have been or should be taken to mitigate the risk.

Any evidence in relation to the security incident shall be secured immediately by the Local Security Officer for the Communication Infrastructure. To the extent possible under applicable data protection provisions, such evidence shall be made available to the System Security Officer upon request of the latter.

Feedback processes shall be defined in the Security Policy to ensure that information about the type, handling and outcome of a security incident is communicated to the System Security Officer and to the Local Security Officer for the Communication Infrastructure, once the incident has been dealt with and is no longer in progress.

Paragraphs (1) to (4) shall apply mutatis mutandis to incidents in Central SIS II. To that extent, any reference to the Local Security Officer for the Communication Infrastructure in paragraphs (1) to (4) shall be read as a reference to the Local Security Officer for Central SIS II.