{
  "url": "https://openlegislation.uk/eu-decision-2013-488/annex-IV/division-II/division-2/division-4",
  "json_url": "https://openlegislation.uk/eu-decision-2013-488/annex-IV/division-II/division-2/division-4.json",
  "legislation": "eudn/2013/488",
  "legislation_title": "Council Decision of 23 September 2013 on the security rules for protecting EU classified information (2013/488/EU)",
  "legislation_url": "https://openlegislation.uk/eu-decision-2013-488",
  "path": "annex/IV/division/II/division/2/division/4",
  "kind": "division",
  "number": "4",
  "heading": null,
  "text": "Security risk management shall be an integral part of defining, developing, operating and maintaining CIS. Risk management (assessment, treatment, acceptance and communication) shall be conducted as an iterative process jointly by representatives of the system owners, project authorities, operating authorities and security approval authorities, using a proven, transparent and fully understandable risk assessment process. The scope of the CIS and its assets shall be clearly defined at the outset of the risk management process.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eudn/2013/488/annex/IV/division/II/division/2/division/4",
    "retrieved_at": "2026-11-01T15:15:00.335921+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}