Introductory text

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EC) No 1987/2006 of the European Parliament and of the Council of 20 December 2006 on the establishment, operation and use of the second generation Schengen Information System (SIS II)^f1 and in particular Article 16 thereof,

Having regard to Council Decision 2007/533/JHA of 12 June 2007 on the establishment, operation and use of the second generation Schengen Information System (SIS II)^f2 and in particular Article 16 thereof,

Whereas:

Article 16 of Regulation (EC) No 1987/2006 and Article 16 of Decision 2007/533/JHA provide that the Management Authority, in relation to Central SIS II, and the Commission, in relation to the Communication Infrastructure, should adopt the necessary measures, including a security plan.

Article 15(4) of Regulation (EC) No 1987/2006 and Article 15(4) of Decision 2007/533/JHA provide that during a transitional period before the Management Authority takes up its responsibilities, the Commission should be responsible for the operational management of Central SIS II.

As the Management Authority has not yet been established, the security plan to be adopted by the Commission should be applicable also to Central SIS II for a transitional period.

Regulation (EC) No 45/2001 of the European Parliament and of the Council^f3 applies to the processing of personal data by the Commission when carrying out its responsibilities in the operational management of SIS II.

Article 15(7) of Regulation (EC) No 1987/2006 and Article 15(7) of Decision 2007/533/JHA provide that where the Commission delegates its responsibilities during the transitional period before the Management Authority takes up its responsibilities, it shall ensure that this delegation does not adversely affect any effective control mechanism under Union law, whether of the Court of Justice, the Court of Auditors or the European Data Protection Supervisor.

The Management Authority should adopt its own security plan in relation to Central SIS II once it will have taken up its responsibilities. This security plan should therefore expire, to the extent it relates to the Central SIS II, when the Management Authority takes up its responsibilities.

Article 4(3) of Regulation (EC) No 1987/2006 and Article 4(3) of Decision 2007/533/JHA provide that CS-SIS, which performs technical supervision and administration functions, shall be located in Strasbourg (France) and a backup CS-SIS, capable of ensuring all functionalities of the principal CS-SIS in the event of failure of this system, shall be located in Sankt Johann im Pongau (Austria).

The security plan should foresee one System Security Officer performing security-related tasks concerning both Central SIS II and the Communication Infrastructure and two Local Security Officers performing security-related tasks concerning the Central SIS II and the Communication Infrastructure, respectively. The roles of the security officers should be laid down in order to ensure efficient and prompt response to security incidents and reporting thereof.

A Security Policy should be set up describing all technical and organisational details in line with the provisions of this Decision.

Measures should be defined to ensure the appropriate level of security of the operation of Central SIS II and the Communication Infrastructure,

HAS ADOPTED THIS DECISION: