# Council Decision of 23 September 2013 on the security rules for protecting EU classified information (2013/488/EU), Division 3: Physical security measures shall be selected on the basis of a threat assessment made by the competent authorities. The GSC and Member States shall each apply a risk management process for protecting EUCI on their premises to ensure that a commensurate level of physical protection is afforded against the assessed risk. The risk management process shall take account of all relevant factors, in particular:

Extent: E+W+S+N.I.

(a) the classification level of EUCI;
(b) the form and volume of EUCI, bearing in mind that large quantities or a compilation of EUCI may require more stringent protective measures to be applied;
(c) the surrounding environment and structure of the buildings or areas housing EUCI; and
(d) the assessed threat from intelligence services which target the Union or Member States and from sabotage, terrorist, subversive or other criminal activities.

---
Source: https://www.legislation.gov.uk/eudn/2013/488/annex/II/division/II/division/3 (the official version)
Page: https://openlegislation.uk/eu-decision-2013-488/annex-II/division-II/division-3
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.