OpenLegislation

Council Decision of 23 September 2013 on the security rules for protecting EU classified information (2013/488/EU)

EU Decision 2013/488 · Adopted 23 September 2013 · Extends to United Kingdom

Original text. legislation.gov.uk does not revise this item, so later amendments are not shown here. Changes made to it are listed under each provision when known.

Council Decision

of 23 September 2013

on the security rules for protecting EU classified information

(2013/488/EU)

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 240(3) thereof,

Having regard to Council Decision 2009/937/EU of 1 December 2009 adopting the Council’s Rules of Proceduref1, and in particular Article 24 thereof,

Whereas:

(1)

In order to develop Council activities in all areas which require handling classified information, it is appropriate to establish a comprehensive security system for protecting classified information covering the Council, its General Secretariat and the Member States.

(2)

This Decision should apply where the Council, its preparatory bodies and the General Secretariat of the Council (GSC) handle EU classified information (EUCI).

(3)

In accordance with national laws and regulations and to the extent required for the functioning of the Council, the Member States should respect this Decision where their competent authorities, personnel or contractors handle EUCI, in order that each may be assured that an equivalent level of protection is afforded to EUCI.

(4)

The Council, the Commission and the European External Action Service (EEAS) are committed to applying equivalent security standards for protecting EUCI.

(5)

The Council underlines the importance of associating, where appropriate, the European Parliament and other Union institutions, bodies, offices or agencies with the principles, standards and rules for protecting classified information which are necessary in order to protect the interests of the Union and its Member States.

(6)

The Council should determine the appropriate framework for sharing EUCI held by the Council with other Union institutions, bodies, offices or agencies, as appropriate, in accordance with this Decision and interinstitutional arrangements in force.

(7)

Union bodies and agencies established under Title V, Chapter 2, of the Treaty on European Union (TEU), Europol and Eurojust should apply, in the context of their internal organisation, the basic principles and minimum standards laid down in this Decision for protecting EUCI, where so provided in the act establishing them.

(8)

Crisis management operations established under Title V, Chapter 2, of the TEU and their personnel should apply the security rules adopted by the Council for protecting EUCI where so provided in the Council act establishing them.

(9)

EU Special Representatives and the members of their teams should apply the security rules adopted by the Council for protecting EUCI where so provided in the relevant Council act.

(10)

This Decision is taken without prejudice to Articles 15 and 16 of the Treaty on the Functioning of the European Union (TFEU) and to instruments implementing them.

(11)

This Decision is taken without prejudice to existing practices in Member States with regard to informing their national Parliaments about the activities of the Union.

(12)

In order to ensure the application of the security rules for protecting EUCI in a timely manner as regards the accession of the Republic of Croatia to the European Union, this Decision should enter into force on the date of its publication,

HAS ADOPTED THIS DECISION:

Annotations to the whole text

Footnotes

f1

OJ L 325, 11.12.2009, p. 35.

Contents

  1. 1Purpose, scope and definitions
  2. 2Definition of EUCI, security classifications and markings
  3. 3Classification management
  4. 4Protection of classified information
  5. 5Security risk management
  6. 6Implementation of this Decision
  7. 7Personnel security
  8. 8Physical security
  9. 9Management of classified information
  10. 10Protection of EUCI handled in communication and information systems
  11. 11Industrial security
  12. 12Sharing EUCI
  13. 13Exchange of classified information with third States and international organisations
  14. 14Breaches of security and compromise of EUCI
  15. 15Responsibility for implementation
  16. 16The organisation of security in the Council
  17. 17Security Committee
  18. 18Replacement of previous decision
  19. 19Entry into force
  20. Annex I: PERSONNEL SECURITY
  21. INTRODUCTION
  22. 1Division 1
  23. GRANTING ACCESS TO EUCI
  24. 2An individual shall only be granted access to classified information after:
  25. 3Division 3
  26. PERSONNEL SECURITY CLEARANCE REQUIREMENTS
  27. 4Division 4
  28. 5Division 5
  29. 6Division 6
  30. Security investigation criteria
  31. 7The loyalty, trustworthiness and reliability of an individual for the purposes of being security cleared for access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above shall be determined by means of a security investigation. The competent national authority shall make an overall assessment based on the findings of such a security investigation. The principal criteria used for that purpose include, to the extent possible under national laws and regulations, an examination of whether the individual:
  32. 8Division 8
  33. 9Division 9
  34. Investigative requirements for access to EUCI
  35. Initial granting of a security clearance
  36. 10The initial security clearance for access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET shall be based on a security investigation covering at least the last 5 years, or from age 18 to the present, whichever is the shorter, which shall include the following:
  37. 11The initial security clearance for access to information classified TRÈS SECRET UE/EU TOP SECRET shall be based on a security investigation covering at least the last 10 years, or from age 18 to the present, whichever is the shorter. If interviews are conducted as stated in point (e), investigations shall cover at least the last 7 years, or from age 18 to the present, whichever is the shorter. In addition to the criteria indicated in paragraph 7 above, the following elements shall be investigated, to the extent possible under national laws and regulations, before granting a TRÈS SECRET UE/EU TOP SECRET PSC; they may also be investigated before granting a CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET PSC, where required by national laws and regulations:
  38. 12Division 12
  39. Renewal of a security clearance
  40. 13Division 13
  41. 14Division 14
  42. 15Division 15
  43. Authorisation procedures in the GSC
  44. 16Division 16
  45. 17Division 17
  46. 18Following completion of the security investigation, the relevant NSA shall notify the GSC Security Authority of the outcome of such an investigation, using the standard format for the correspondence prescribed by the Security Committee.
  47. 19Division 19
  48. 20Division 20
  49. 21Division 21
  50. 22Division 22
  51. 23Division 23
  52. 24Division 24
  53. 25Division 25
  54. Records of security clearances and authorisations
  55. 26Division 26
  56. 27Division 27
  57. Exemptions from the PSC requirement
  58. 28Division 28
  59. SECURITY EDUCATION AND AWARENESS
  60. 29Division 29
  61. 30Division 30
  62. 31Division 31
  63. EXCEPTIONAL CIRCUMSTANCES
  64. 32Division 32
  65. 33Division 33
  66. 34When an individual is to be assigned to a position that requires a security clearance at one level higher than that currently possessed by the individual, the assignment may be made on a provisional basis, provided that:
  67. 35Division 35
  68. 36Division 36
  69. 37Division 37
  70. 38Division 38
  71. 39Division 39
  72. 40Division 40
  73. ATTENDANCE AT MEETINGS IN THE COUNCIL
  74. 41Division 41
  75. 42Division 42
  76. POTENTIAL ACCESS TO EUCI
  77. 43Division 43
  78. Annex II: PHYSICAL SECURITY
  79. INTRODUCTION
  80. 1Division 1
  81. 2Physical security measures shall be designed to prevent unauthorised access to EUCI by:
  82. PHYSICAL SECURITY REQUIREMENTS AND MEASURES
  83. 3Physical security measures shall be selected on the basis of a threat assessment made by the competent authorities. The GSC and Member States shall each apply a risk management process for protecting EUCI on their premises to ensure that a commensurate level of physical protection is afforded against the assessed risk. The risk management process shall take account of all relevant factors, in particular:
  84. 4The competent security authority, applying the concept of defence in depth, shall determine the appropriate combination of physical security measures to be implemented. These can include one or more of the following:
  85. 5Division 5
  86. 6Division 6
  87. 7Division 7
  88. EQUIPMENT FOR THE PHYSICAL PROTECTION OF EUCI
  89. 8Division 8
  90. 9Division 9
  91. 10Division 10
  92. 11Division 11
  93. PHYSICALLY PROTECTED AREAS
  94. 12Two types of physically protected areas, or the national equivalents thereof, shall be established for the physical protection of EUCI:
  95. 13Division 13
  96. 14For Administrative Areas:
  97. 15For Secured Areas:
  98. 16Where entry into a Secured Area constitutes, for all practical purposes, direct access to the classified information contained in it, the following additional requirements shall apply:
  99. 17Secured Areas protected against eavesdropping shall be designated technically Secured Areas. The following additional requirements shall apply:
  100. 18Division 18
  101. 19Division 19
  102. 20Division 20
  103. 21Security operating procedures shall be drawn up for each Secured Area stipulating:
  104. 22Division 22
  105. PHYSICAL PROTECTIVE MEASURES FOR HANDLING AND STORING EUCI
  106. 23EUCI which is classified RESTREINT UE/EU RESTRICTED may be handled:
  107. 24Division 24
  108. 25EUCI which is classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET may be handled:
  109. 26Division 26
  110. 27Division 27
  111. 28EUCI which is classified TRÈS SECRET UE/EU TOP SECRET shall be stored in a Secured Area under one of the following conditions:
  112. 29Division 29
  113. CONTROL OF KEYS AND COMBINATIONS USED FOR PROTECTING EUCI
  114. 30Division 30
  115. 31Combination settings shall be committed to memory by the smallest possible number of individuals needing to know them. Combination settings for security containers and strong rooms storing EUCI shall be changed:
  116. Annex III: MANAGEMENT OF CLASSIFIED INFORMATION
  117. INTRODUCTION
  118. 1Division 1
  119. CLASSIFICATION MANAGEMENT
  120. Classifications and markings
  121. 2Division 2
  122. 3Division 3
  123. 4Division 4
  124. 5Division 5
  125. 6Division 6
  126. 7Division 7
  127. 8Division 8
  128. 9The classification of a letter or note covering enclosures shall be as high as the highest classification of its enclosures. The originator shall indicate clearly at which level it is classified when detached from its enclosures by means of an appropriate marking, e.g.:
  129. Markings
  130. 10In addition to one of the security classification markings set out in Article 2(2), EUCI may bear additional markings, such as:
  131. Abbreviated classification markings
  132. 11Division 11
  133. 12The following standard abbreviations may be used within EU classified documents to indicate the classification level of sections or blocks of text of less than a single page:
  134. Creation of EUCI
  135. 13When creating an EU classified document:
  136. 14Division 14
  137. Downgrading and declassification of EUCI
  138. 15Division 15
  139. 16Division 16
  140. REGISTRATION OF EUCI FOR SECURITY PURPOSES
  141. 17Division 17
  142. 18Division 18
  143. 19Division 19
  144. 20Division 20
  145. 21Division 21
  146. 22Division 22
  147. TRÈS SECRET UE/EU TOP SECRET registries
  148. 23Division 23
  149. 24Division 24
  150. COPYING AND TRANSLATING EU CLASSIFIED DOCUMENTS
  151. 25Division 25
  152. 26Division 26
  153. 27Division 27
  154. CARRIAGE OF EUCI
  155. 28Division 28
  156. 29Division 29
  157. Within a building or self-contained group of buildings
  158. 30Division 30
  159. 31Division 31
  160. Within the Union
  161. 32Division 32
  162. 33The carriage of information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET within the Union shall be by one of the following means:
  163. 34Division 34
  164. 35Division 35
  165. 36Division 36
  166. From within the Union to the territory of a third State
  167. 37Division 37
  168. 38The carriage of information classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET from within the Union to the territory of a third State shall be by one of the following means:
  169. 39Division 39
  170. 40Division 40
  171. 41Division 41
  172. DESTRUCTION OF EUCI
  173. 42Division 42
  174. 43Division 43
  175. 44Division 44
  176. 45Division 45
  177. 46Division 46
  178. 47Division 47
  179. 48Division 48
  180. ASSESSMENT VISITS
  181. 49The term ‘assessment visit’ shall be used hereinafter to designate any:
  182. 50Assessment visits shall be carried out, inter alia, to:
  183. 51Division 51
  184. Conduct of assessment visits
  185. 52Division 52
  186. 53Division 53
  187. 54Division 54
  188. 55Division 55
  189. 56Division 56
  190. Reports
  191. 57Division 57
  192. 58For assessment visits conducted in Member States’ national administrations:
  193. 59Division 59
  194. 60Division 60
  195. 61Division 61
  196. Checklist
  197. 62Division 62
  198. 63Division 63
  199. Annex IV: PROTECTION OF EUCI HANDLED IN CIS
  200. INTRODUCTION
  201. 1Division 1
  202. 2The following IA properties and concepts are essential for the security and correct functioning of operations on CIS:
  203. INFORMATION ASSURANCE PRINCIPLES
  204. 3Division 3
  205. Security risk management
  206. 4Division 4
  207. 5Division 5
  208. 6Division 6
  209. 7Division 7
  210. Security throughout the CIS life-cycle
  211. 8Division 8
  212. 9Division 9
  213. 10Division 10
  214. 11Division 11
  215. 12Division 12
  216. Best practice
  217. 13Division 13
  218. 14Division 14
  219. 15Division 15
  220. Defence in depth
  221. 16To mitigate risk to CIS, a range of technical and non-technical security measures, organised as multiple layers of defence, shall be implemented. These layers shall include:
  222. 17The NSA or other competent authority shall ensure that:
  223. Principle of minimality and least privilege
  224. 18Division 18
  225. 19Division 19
  226. 20Division 20
  227. Information Assurance awareness
  228. 21Awareness of the risks and available security measures is the first line of defence for the security of CIS. In particular all personnel involved in the life-cycle of CIS, including users, shall understand:
  229. 22Division 22
  230. Evaluation and approval of IT-security products
  231. 23Division 23
  232. 24Division 24
  233. 25Division 25
  234. 26Division 26
  235. 27Division 27
  236. 28Division 28
  237. 29Division 29
  238. 30Division 30
  239. Transmission within Secured and Administrative Areas
  240. 31Division 31
  241. Secure interconnection of CIS
  242. 32Division 32
  243. 33Division 33
  244. 34For all interconnections of CIS with another IT system the following basic requirements shall be met:
  245. 35There shall be no interconnection between an accredited CIS and an unprotected or public network, except where the CIS has approved BPS installed for such a purpose between the CIS and the unprotected or public network. The security measures for such interconnections shall be reviewed by the competent IAA and approved by the competent SAA.
  246. 36Division 36
  247. Computer storage media
  248. 37Division 37
  249. 38Division 38
  250. Emergency circumstances
  251. 39Division 39
  252. 40EUCI may be transmitted using cryptographic products which have been approved for a lower classification level or without encryption with the consent of the competent authority if any delay would cause harm clearly outweighing the harm entailed by any disclosure of the classified material and if:
  253. 41Division 41
  254. 42Division 42
  255. INFORMATION ASSURANCE FUNCTIONS AND AUTHORITIES
  256. 43Division 43
  257. Information Assurance Authority
  258. 44The IAA shall be responsible for:
  259. TEMPEST Authority
  260. 45Division 45
  261. Crypto Approval Authority
  262. 46Division 46
  263. Crypto Distribution Authority
  264. 47The Crypto Distribution Authority (CDA) shall be responsible for:
  265. Security Accreditation Authority
  266. 48The SAA for each system shall be responsible for:
  267. 49Division 49
  268. 50Division 50
  269. 51A joint Security Accreditation Board (SAB) shall be responsible for accrediting CIS within the remit of both the GSC SAA and Member States’ SAAs. It shall be composed of an SAA representative from each Member State and be attended by an SAA representative of the Commission. Other entities with nodes on a CIS shall be invited to attend when that system is under discussion.
  270. Information Assurance Operational Authority
  271. 52The IA Operational Authority for each system shall be responsible for:
  272. Annex V: INDUSTRIAL SECURITY
  273. INTRODUCTION
  274. 1Division 1
  275. 2Division 2
  276. SECURITY ELEMENTS IN A CLASSIFIED CONTRACT
  277. Security classification guide (SCG)
  278. 3Division 3
  279. 4In order to determine the security classification of the various elements of a classified contract, the following principles shall apply:
  280. Security aspects letter (SAL)
  281. 5Division 5
  282. 6Division 6
  283. Programme/Project Security Instructions (PSI)
  284. 7Division 7
  285. FACILITY SECURITY CLEARANCE (FSC)
  286. 8Division 8
  287. 9When issuing an FSC, the relevant NSA or DSA shall, as a minimum:
  288. 10Division 10
  289. 11Division 11
  290. 12Division 12
  291. 13Division 13
  292. CLASSIFIED CONTRACTS AND SUB-CONTRACTS
  293. 14Division 14
  294. 15Division 15
  295. 16Division 16
  296. 17Division 17
  297. 18Division 18
  298. 19Division 19
  299. 20Division 20
  300. 21Division 21
  301. 22Division 22
  302. 23Division 23
  303. VISITS IN CONNECTION WITH CLASSIFIED CONTRACTS
  304. 24Division 24
  305. 25Division 25
  306. 26Division 26
  307. TRANSMISSION AND CARRIAGE OF EUCI
  308. 27Division 27
  309. 28Division 28
  310. 29For the transport of classified material as freight, the following principles shall be applied when determining security arrangements:
  311. TRANSFER OF EUCI TO CONTRACTORS LOCATED IN THIRD STATES
  312. 30Division 30
  313. INFORMATION CLASSIFIED RESTREINT UE/EU RESTRICTED
  314. 31Division 31
  315. 32Division 32
  316. 33Division 33
  317. 34Division 34
  318. 35Division 35
  319. 36Division 36
  320. Annex VI: EXCHANGE OF CLASSIFIED INFORMATION WITH THIRD STATES AND INTERNATIONAL ORGANISATIONS
  321. INTRODUCTION
  322. 1Division 1
  323. FRAMEWORKS GOVERNING THE EXCHANGE OF CLASSIFIED INFORMATION
  324. 2Where the Council determines that a long-term need exists to exchange classified information,
  325. 3Where EUCI generated for the purposes of a CSDP operation is to be provided to third States or international organisations participating in such an operation, and where neither of the frameworks referred to in paragraph 2 exists, the exchange of EUCI with the contributing third State or international organisation shall be regulated, in accordance with Section V, under:
  326. 4Division 4
  327. SECURITY OF INFORMATION AGREEMENTS
  328. 5Division 5
  329. 6Division 6
  330. 7Division 7
  331. 8Division 8
  332. 9In order to assess the effectiveness of the security regulations, structures and procedures in the third State or international organisation concerned, assessment visits shall be conducted in mutual agreement with the third State or international organisation concerned. Such assessment visits shall be conducted in accordance with the relevant provisions of Annex III and shall evaluate:
  333. 10Division 10
  334. 11Division 11
  335. 12Division 12
  336. 13Division 13
  337. 14Division 14
  338. 15Follow-up assessment visits shall be conducted as necessary, in particular if:
  339. 16Division 16
  340. ADMINISTRATIVE ARRANGEMENTS
  341. 17Division 17
  342. 18Division 18
  343. 19Division 19
  344. 20Division 20
  345. 21Division 21
  346. EXCHANGE OF CLASSIFIED INFORMATION IN THE CONTEXT OF CSDP OPERATIONS
  347. 22Division 22
  348. 23Division 23
  349. 24Division 24
  350. 25Division 25
  351. 26Division 26
  352. 27Division 27
  353. 28Division 28
  354. 29Division 29
  355. 30Division 30
  356. 31Division 31
  357. EXCEPTIONAL AD HOC RELEASE OF EUCI
  358. 32Where no framework is in place in accordance with Sections III to V, and where the Council or one of its preparatory bodies determines the exceptional need to release EUCI to a third State or international organisation, the GSC shall:
  359. 33Division 33
  360. 34If the Security Committee’s recommendation is not in favour of releasing the EUCI:
  361. 35Division 35
  362. 36Division 36
  363. AUTHORITY TO RELEASE EUCI TO THIRD STATES OR INTERNATIONAL ORGANISATIONS
  364. 37Division 37
  365. 38Division 38
  366. 39Division 39
  367. Attachment
  368. Attachment
  369. DEFINITIONS
  370. Attachment
  371. Attachment
  372. Attachment