# Council Decision of 31 March 2011 on the security rules for protecting EU classified information (2011/292/EU), Appendix ANNEX IV: PROTECTION OF EUCI HANDLED IN CIS

Extent: E+W+S+N.I.

I.
INTRODUCTION
1.
This Annex sets out provisions for implementing Article 10.
2.
The following IA properties and concepts are essential for the security and correct functioning of operations on CIS:
Authenticity the guarantee that information is genuine and from bona fide sources;
Availability the property of being accessible and usable upon request by an authorised entity;
Confidentiality the property that information is not disclosed to unauthorised individuals, entities or processes;
Integrity the property of safeguarding the accuracy and completeness of information and assets;
Non-repudiation the ability to prove an action or event has taken place, so that this event or action cannot subsequently be denied.
II.
INFORMATION ASSURANCE PRINCIPLES
3.
The provisions set out below shall form the baseline for the security of any CIS handling EUCI. Detailed requirements for implementing these provisions shall be defined in IA security policies and security guidelines.
Security risk management
4.
Security risk management shall be an integral part of defining, developing, operating and maintaining CIS. Risk management (assessment, treatment, acceptance and communication) shall be conducted as an iterative process jointly by representatives of the system owners, project authorities, operating authorities and security approval authorities, using a proven, transparent and fully understandable risk assessment process. The scope of the CIS and its assets shall be clearly defined at the outset of the risk management process.
5.
The competent authorities shall review the potential threats to CIS and shall maintain up-to-date and accurate threat assessments which reflect the current operational environment. They shall constantly update their knowledge of vulnerability issues and periodically review the vulnerability assessment to keep up with the changing information technology (IT) environment.
6.
The aim of security risk treatment shall be to apply a set of security measures which results in a satisfactory balance between user requirements, cost and residual security risk.
7.
The specific requirements, scale and the degree of detail determined by the relevant SAA for accrediting a CIS shall be commensurate with the assessed risk, taking account of all relevant factors, including the classification level of the EUCI handled in the CIS. Accreditation shall include a formal residual risk statement and acceptance of the residual risk by a responsible authority.
Security throughout the CIS-life cycle
8.
Ensuring security shall be a requirement throughout the entire CIS life-cycle from initiation to withdrawal from service.
9.
The role and interaction of each actor involved in a CIS with regard to its security shall be identified for each phase of the life-cycle.
10.
Any CIS, including its technical and non-technical security measures, shall be subject to security testing during the accreditation process to ensure that the appropriate level of assurance is obtained and to verify that they are correctly implemented, integrated and configured.
11.
Security assessments, inspections and reviews shall be performed periodically during the operation and maintenance of a CIS and when exceptional circumstances arise.
12.
Security documentation for a CIS shall evolve over its life-cycle as an integral part of the process of change and configuration management.
Best practice
13.
The GSC and the Member States shall cooperate to develop best practice for protecting EUCI handled on CIS. Best practice guidelines shall set out technical, physical, organisational and procedural security measures for CIS with proven effectiveness in countering given threats and vulnerabilities.
14.
The protection of EUCI handled on CIS shall draw on lessons learned by entities involved in IA within and outside the EU.
15.
The dissemination and subsequent implementation of best practice shall help achieve an equivalent level of assurance for the various CIS operated by the GSC and by Member States which handle EUCI.
Defence in depth
16.
To mitigate risk to CIS, a range of technical and non-technical security measures, organised as multiple layers of defence, shall be implemented. These layers shall include:
(a) Deterrence security measures aimed at dissuading any adversary planning to attack the CIS;
(b) Prevention security measures aimed at impeding or blocking an attack on the CIS;
(c) Detection security measures aimed at discovering the occurrence of an attack on the CIS;
(d) Resilience security measures aimed at limiting impact of an attack to a minimum set of information or CIS assets and preventing further damage; and
(e) Recovery security measures aimed at regaining a secure situation for the CIS.
The degree of stringency of such security measures shall be determined following a risk assessment.
17.
The competent authorities shall ensure that they can respond to incidents which may transcend organisational and national boundaries to coordinate responses and share information about these incidents and the related risk (computer emergency response capabilities).
Principle of minimality and least privilege
18.
Only the essential functionalities, devices and services to meet operational requirements shall be implemented in order to avoid unnecessary risk.
19.
CIS users and automated processes shall be given only the access, privileges or authorisations they require to perform their tasks in order to limit any damage resulting from accidents, errors, or unauthorised use of CIS resources.
20.
Registration procedures performed by a CIS, where required, shall be verified as part of the accreditation process.
Information Assurance awareness
21.
Awareness of the risks and available security measures is the first line of defence for the security of CIS. In particular all personnel involved in the life-cycle of CIS, including users, shall understand:
(a) that security failures may significantly harm the CIS;
(b) the potential harm to others which may arise from interconnectivity and interdependency; and
(c) their individual responsibility and accountability for the security of CIS according to their roles within the systems and processes.
22.
To ensure that security responsibilities are understood, IA education and awareness training shall be mandatory for all personnel involved, including senior management and CIS users.
Evaluation and approval of IT-security products
23.
The required degree of confidence in the security measures, defined as a level of assurance, shall be determined following the outcome of the risk management process and in line with the relevant security policies and security guidelines.
24.
The level of assurance shall be verified by using internationally recognised or nationally approved processes and methodologies. This includes primarily evaluation, controls and auditing.
25.
Cryptographic products for protecting EUCI shall be evaluated and approved by a national CAA of a Member State.
26.
Prior to being recommended for approval by the Council or the Secretary-General in accordance with Article 10(6), such cryptographic products shall have undergone a successful second party evaluation by an Appropriately Qualified Authority (AQUA) of a Member State not involved in the design or manufacture of the equipment. The degree of detail required in a second party evaluation shall depend on the envisaged maximum classification level of EUCI to be protected by these products. The Council shall approve a security policy on the evaluation and approval of cryptographic products.
27.
Where warranted on specific operational grounds, the Council or the Secretary-General as appropriate may, upon recommendation by the Security Committee, waive the requirements under paragraphs 25 or 26 and grant an interim approval for a specific period in accordance with the procedure laid down in Article 10(6).
28.
An AQUA shall be a CAA of a Member State that has been accredited on the basis of criteria laid down by the Council to undertake the second evaluation of cryptographic products for protecting EUCI.
29.
The Council shall approve a security policy on the qualification and approval of non-cryptographic IT security products.
Transmission within Secured Areas
30.
Notwithstanding the provisions of this Decision, when transmission of EUCI is confined within Secured Areas, unencrypted distribution or encryption at a lower level may be used based on the outcome of a risk management process and subject to the approval of the SAA.
Secure interconnection of CIS
31.
For the purposes of this Decision, an interconnection shall mean the direct connection of two or more IT systems for the purpose of sharing data and other information resources (e.g. communication) in a unidirectional or multidirectional way.
32.
A CIS shall treat any interconnected IT system as untrusted and shall implement protective measures to control the exchange of classified information.
33.
For all interconnections of CIS with another IT system the following basic requirements shall be met:
(a) business or operational requirements for such interconnections shall be stated and approved by the competent authorities;
(b) the interconnection shall undergo a risk management and accreditation process and shall require the approval of the competent SAAs; and
(c) Boundary Protection Services (BPS) shall be implemented at the perimeter of all CIS.
34.
There shall be no interconnection between an accredited CIS and an unprotected or public network, except where the CIS has approved BPS installed for such a purpose between the CIS and the unprotected or public network. The security measures for such interconnections shall be reviewed by the competent IAA and approved by the competent SAA.
When the unprotected or public network is used solely as a carrier and the data is encrypted by a cryptographic product approved in accordance with Article 10, such a connection shall not be deemed to be an interconnection.
35.
The direct or cascaded interconnection of a CIS accredited to handle TRÈS SECRET UE/EU TOP SECRET to an unprotected or public network shall be prohibited.
Computer storage media
36.
Computer storage media shall be destroyed in accordance with procedures approved by the competent security authority.
37.
Computer storage media shall be reused, downgraded or declassified in accordance with a security policy to be established pursuant to Article 6(1).
Emergency circumstances
38.
Notwithstanding the provisions of this Decision, the specific procedures described below may be applied in an emergency, such as during impending or actual crisis, conflict, war situations or in exceptional operational circumstances.
39.
EUCI may be transmitted using cryptographic products which have been approved for a lower classification level or without encryption with the consent of the competent authority if any delay would cause harm clearly outweighing the harm entailed by any disclosure of the classified material and if:
(a) the sender and recipient do not have the required encryption facility or have no encryption facility; and
(b) the classified material cannot be conveyed in time by other means.
40.
Classified information transmitted under the circumstances set out in paragraph 38 shall not bear any markings or indications distinguishing it from information which is unclassified or which can be protected by an available cryptographic product. Recipients shall be notified of the classification level, without delay, by other means.
41.
Should recourse be made to paragraph 38 a subsequent report shall be made to the competent authority and to the Security Committee.
III.
INFORMATION ASSURANCE FUNCTIONS AND AUTHORITIES
42.
The following IA functions shall be established in the Member States and the GSC. These functions do not require single organisational entities. They shall have separate mandates. However, these functions, and their accompanying responsibilities, may be combined or integrated in the same organisational entity or split into different organisational entities, provided that internal conflicts of interests or tasks are avoided.
Information Assurance Authority
43.
The IAA shall be responsible for:
(a) developing IA security policies and security guidelines and monitoring their effectiveness and pertinence;
(b) safeguarding and administering technical information related to cryptographic products;
(c) ensuring that IA measures selected for protecting EUCI comply with the relevant policies governing their eligibility and selection;
(d) ensuring that cryptographic products are selected in compliance with policies governing their eligibility and selection;
(e) coordinating training and awareness on IA;
(f) consulting with the system provider, the security actors and representatives of users in respect to IA security policies and security guidelines; and
(g) ensuring appropriate expertise is available in the expert sub-area of the Security Committee for IA issues.
TEMPEST Authority
44.
The TEMPEST Authority (TA) shall be responsible for ensuring compliance of CIS with TEMPEST policies and guidelines. It shall approve TEMPEST countermeasures for installations and products to protect EUCI to a defined level of classification in its operational environment.
Crypto Approval Authority
45.
The Crypto Approval Authority (CAA) shall be responsible for ensuring that cryptographic products comply with national cryptographic policy or the Council’s cryptographic policy. It shall grant the approval of a cryptographic product to protect EUCI to a defined level of classification in its operational environment. As regards the Member States, the CAA shall in addition be responsible for evaluating cryptographic products.
Crypto Distribution Authority
46.
The Crypto Distribution Authority (CDA) shall be responsible for:
(a) managing and accounting for EU crypto material;
(b) ensuring that appropriate procedures are enforced and channels established for accounting, secure handling, storage and distribution of all EU crypto material; and
(c) ensuring the transfer of EU crypto material to or from individuals or services using it.
Security Accreditation Authority
47.
The SAA for each system shall be responsible for:
(a) ensuring that CIS comply with the relevant security policies and security guidelines, providing a statement of approval for CIS to handle EUCI to a defined level of classification in its operational environment, stating the terms and conditions of the accreditation, and criteria under which re-approval is required;
(b) establishing a security accreditation process, in accordance with the relevant policies, clearly stating the approval conditions for CIS under its authority;
(c) defining a security accreditation strategy setting out the degree of detail for the accreditation process commensurate with the required level of assurance;
(d) examining and approving security-related documentation, including risk management and residual risk statements, system-specific security requirement statements (hereinafter referred to as ‘SSRSs’), security implementation verification documentation and security operating procedures (hereinafter referred to as ‘SecOPs’), and ensuring that it complies with the Council’s security rules and policies;
(e) checking implementation of security measures in relation to the CIS by undertaking or sponsoring security assessments, inspections or reviews;
(f) defining security requirements (e.g. personnel clearance levels) for sensitive positions in relation to the CIS;
(g) endorsing the selection of approved cryptographic and TEMPEST products used to provide security for a CIS;
(h) approving, or where relevant, participating in the joint approval of the interconnection of a CIS to other CIS; and
(i) consulting the system provider, the security actors and representatives of the users with respect to security risk management, in particular the residual risk, and the terms and conditions of the approval statement.
48.
The GSC SAA shall be responsible for accrediting all CIS operating within the remit of the GSC.
49.
The relevant SAA of a Member State shall be responsible for accrediting CIS and components thereof operating within the remit of a Member State.
50.
A joint Security Accreditation Board (SAB) shall be responsible for accrediting CIS within the remit of both the GSC SAA and Member States’ SAAs. It shall be composed of an SAA representative from each Member State and be attended by an SAA representative of the Commission. Other entities with nodes on a CIS shall be invited to attend when that system is under discussion.
The SAB shall be chaired by a representative of the GSC SAA. It shall act by consensus of SAA representatives of institutions, Member States and other entities with nodes on the CIS. It shall make periodic reports on its activities to the Security Committee and shall notify all accreditation statements to it.
Information Assurance Operational Authority
51.
The IA Operational Authority for each system shall be responsible for:
(a) developing security documentation in line with security policies and security guidelines, in particular the SSRS including the residual risk statement, the SecOPs and the crypto plan within the CIS accreditation process;
(b) participating in selecting and testing the system-specific technical security measures, devices and software, to supervise their implementation and to ensure that they are securely installed, configured and maintained in accordance with the relevant security documentation;
(c) participating in selecting TEMPEST security measures and devices if required in the SSRS and ensuring that they are securely installed and maintained in cooperation with the TA;
(d) monitoring implementation and application of the SecOps and, where appropriate, delegating operational security responsibilities to the system owner;
(e) managing and handling cryptographic products, ensuring the custody of crypto and controlled items and, if so required, ensuring the generation of cryptographic variables;
(f) conducting security analysis reviews and tests, in particular to produce the relevant risk reports, as required by the SAA;
(g) providing CIS-specific IA training;
(h) implementing and operating CIS-specific security measures.

---
Source: https://www.legislation.gov.uk/eudn/2011/292/annex/annex/IV (the official version)
Page: https://openlegislation.uk/eu-decision-2011-292/annex/annex-IV
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.