OpenLegislation

Commission Decision (EU, Euratom) 2015/444 of 13 March 2015 on the security rules for protecting EU classified information

EU Decision 2015/444 · Adopted 13 March 2015 · Extends to United Kingdom

Original text. legislation.gov.uk does not revise this item, so later amendments are not shown here. Changes made to it are listed under each provision when known.

Commission Decision (EU, Euratom) 2015/444

of 13 March 2015

on the security rules for protecting EU classified information

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249 thereof,

Having regard to the Treaty establishing the European Atomic Energy Community, and in particular Article 106 thereof,

Having regard to the Protocol No 7 on the Privileges and Immunities of the European Union annexed to the Treaties, and in particular Article 18 thereof,

Whereas:

(1)

The Commission's security provisions regarding the protection of European Union Classified Information (EUCI) need to be reviewed and updated, taking into account institutional, organisational, operational and technological developments.

(2)

The European Commission has entered into instruments on security matters for its principal sites with the governments of Belgium, Luxembourg and Italyf1

(3)

The Commission, the Council and the European External Action Service are committed to applying equivalent security standards for protecting EUCI.

(4)

It is important that, where appropriate, the European Parliament and other Union institutions, agencies, bodies or offices, are associated with the principles, standards and rules for protecting classified information which are necessary in order to protect the interests of the Union and its Member States.

(5)

Risk to EUCI shall be managed as a process. This process shall be aimed at determining known security risks, defining security measures to reduce such risks to an acceptable level in accordance with the basic principles and minimum standards set out in this Decision and at applying these measures in line with the concept of defence in depth. The effectiveness of such measures shall be continuously evaluated.

(6)

Within the Commission, physical security aimed at protecting classified information is the application of physical and technical protective measures intended to prevent unauthorised access to EUCI.

(7)

The management of EUCI is the application of administrative measures for controlling EUCI throughout its life-cycle to supplement the measures provided for in Chapters 2, 3 and 5 of this Decision and thereby help deter, detect and recover from deliberate or accidental compromise or loss of such information. Such measures relate in particular to the creation, storage, registration, copying, translation, downgrading, declassification, carriage and destruction of EUCI and they supplement the general rules on document management of the Commission (Decisions 2002/47/ECf2, ECSC, Euratom and 2004/563/EC, Euratomf3).

(8)

The provision of this Decision shall be without prejudice to:

  1. (a)

    Regulation (Euratom) No 3f4;

  2. (b)

    Regulation (EC) No 1049/2001 of the European Parliament and of the Councilf5;

  3. (c)

    Regulation (EC) No 45/2001 of the European Parliament and of the Councilf6;

  4. (d)

    Council Regulation (EEC, Euratom) No 354/83f7,

HAS ADOPTED THIS DECISION:

Annotations to the whole text

Footnotes

f1

Cf. the ‘Arrangement entre le Gouvernement belge et le Parlement européen, le Conseil, la Commission, le Comité économique et social européen, le Comité des régions, la Banque européenne d'investissement en matière de sécurité’ of 31 December 2004, the ‘Accord de sécurité signé entre la Commission et le Gouvernement luxembourgeois’ of 20 January 2007, and the ‘Accordo tra il Governo italiano e la Commissione europea dell'energia atomica (Euratom) per l'istituzione di un Centro comune di ricerche nucleari di competenza generale’ of 22 July 1959.

f2

Commission Decision 2002/47/EC, ECSC, Euratom of 23 January 2002 amending its rules of procedure (OJ L 21, 24.1.2002, p. 23).

f3

Commission Decision 2004/563/EC, Euratom of 7 July 2004 amending its Rules of Procedure (OJ L 251, 27.7.2004, p. 9).

f4

Regulation (Euratom) No 3 of 31 July 1958 implementing Article 24 of the Treaty establishing the European Atomic Energy Community (OJ 17, 6.10.1958, p. 406/58).

f5

Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ L 145, 31.5.2001, p. 43).

f6

Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).

f7

Council Regulation (EEC, Euratom) No 354/83 of 1 February 1983 concerning the opening to the public of the historical archives of the European Economic Community and the European Atomic Energy Community (OJ L 43, 15.2.1983, p. 1).

Contents

  1. Chapter 1: BASIC PRINCIPLES AND MINIMUM STANDARDS
  2. 1Definitions
  3. 2Subject matter and scope
  4. 3Definition of EUCI, security classifications and markings
  5. 4Classification management
  6. 5Protection of classified information
  7. 6Security risk management
  8. 7Implementation of this Decision
  9. 8Breaches of security and compromise of EUCI
  10. Chapter 2: PERSONNEL SECURITY
  11. 9Definitions
  12. 10Basic Principles
  13. 11Security authorisation procedure
  14. 12Security authorisation briefings
  15. 13Temporary security authorisations
  16. 14Attendance at classified meetings organised by the Commission
  17. 15Potential Access to EUCI
  18. Chapter 3: PHYSICAL SECURITY AIMED AT PROTECTING CLASSIFIED INFORMATION
  19. 16Basic principles
  20. 17Physical security requirements and measures
  21. 18Equipment for the physical protection of EUCI
  22. 19Physical protective measures for handling and storing EUCI
  23. 20Management of keys and combinations used for protecting EUCI
  24. Chapter 4: MANAGEMENT OF EU CLASSIFIED INFORMATION
  25. 21Basic principles
  26. 22Classifications and markings
  27. 23Markings
  28. 24Abbreviated classification markings
  29. 25Creation of EUCI
  30. 26Downgrading and declassification of EUCI
  31. 27EUCI registry system in the Commission
  32. 28Registry control officer
  33. 29Registration of EUCI for security purposes
  34. 30Copying and translating EU classified documents
  35. 31Carriage of EUCI
  36. 32Destruction of EUCI
  37. 33Destruction of EUCI in emergencies
  38. Chapter 5: PROTECTION OF EU CLASSIFIED INFORMATION IN COMMUNICATION AND INFORMATION SYSTEMS (CIS)
  39. 34Basic principles of Information Assurance
  40. 35Definitions
  41. 36CIS handling EUCI
  42. 37Accreditation of CIS handling EUCI
  43. 38Emergency circumstances
  44. Chapter 6: INDUSTRIAL SECURITY
  45. 39Basic principles
  46. 40Definitions
  47. 41Procedure for classified contracts or grant agreements
  48. 42Security elements in a classified contract or grant agreement
  49. 43Access to EUCI for contractors' and beneficiaries' staff
  50. 44Facility security clearance
  51. 45Provisions for classified contracts and grant agreements
  52. 46Specific provisions for classified contracts
  53. 47Visits in connection with classified contracts
  54. 48Transmission and carriage of EUCI in connection with classified contracts or classified grant agreements
  55. 49Transfer of EUCI to contractors or grant beneficiaries located in third states
  56. 50Handling of information classified RESTREINT UE/EU RESTRICTED in the context of classified contracts or classified grant agreements
  57. Chapter 7: EXCHANGE OF CLASSIFIED INFORMATION WITH OTHER UNION INSTITUTIONS, AGENCIES, BODIES AND OFFICES, WITH MEMBER STATES, AND WITH THIRD STATES AND INTERNATIONAL ORGANISATIONS
  58. 51Basic principles
  59. 52Exchange of EUCI with other Union institutions, agencies, bodies and offices
  60. 53Exchange of EUCI with Member States
  61. 54Exchange of EUCI with third States and international organisations
  62. 55Security of information agreements
  63. 56Administrative arrangements
  64. 57Exceptional ad hoc release of EUCI
  65. Chapter 8: FINAL PROVISIONS
  66. 58Replacement of previous decision
  67. 59Classified information created before the entry into force of this Decision
  68. 60Implementing rules and security notices
  69. 61Entry into force
  70. Signature
  71. Annex IEQUIVALENCE OF SECURITY CLASSIFICATIONS
  72. Annex IILIST OF ABBREVIATIONS
  73. Annex III: LIST OF NATIONAL SECURITY AUTHORITIES
  74. BELGIUM
  75. BULGARIA
  76. CZECH REPUBLIC
  77. DENMARK
  78. GERMANY
  79. ESTONIA
  80. GREECE
  81. SPAIN
  82. FRANCE
  83. CROATIA
  84. IRELAND
  85. ITALY
  86. CYPRUS
  87. LATVIA
  88. LITHUANIA
  89. LUXEMBOURG
  90. HUNGARY
  91. MALTA
  92. NETHERLANDS
  93. AUSTRIA
  94. POLAND
  95. PORTUGAL
  96. ROMANIA
  97. SLOVENIA
  98. SLOVAKIA
  99. FINLAND
  100. SWEDEN
  101. UNITED KINGDOM