Article 7 Security Policy

The Director-General of the Directorate General for Justice, Freedom and Security shall establish, update and regularly review a binding Security Policy in accordance with this Decision. The Security Policy shall provide for the detailed procedures and measures to protect against threats to the availability, integrity and confidentiality of the Communication Infrastructure, including emergency planning, in order to ensure the appropriate level of security as prescribed by this Decision. The Security Policy shall comply with this Decision.

The Security Policy shall be based on a risk assessment. The measures described by the Security Policy shall be proportionate to the risks identified.

The risk assessment and the Security Policy shall be updated, if technological changes, identification of new threats or any other circumstances make it necessary. The Security Policy shall be reviewed in any event on an annual basis to ensure that it is still appropriately responding to the latest risk assessment or any other newly identified technological change, threat or other relevant circumstance.

The Security Policy shall be prepared by the System Security Officer, in coordination with the Local Security Officer for Central SIS II and the Local Security Officer for the Communication Infrastructure.

Paragraphs (1) to (4) shall apply mutatis mutandis to the Security Policy for Central SIS II. To that extent, any reference to the Local Security Officer for the Communication Infrastructure in paragraphs (1) to (4) shall be read as a reference to the Local Security Officer for Central SIS II.