# Commission Decision (EU, Euratom) 2018/559 of 6 April 2018 laying down implementing rules for Article 6 of Decision (EU, Euratom) 2017/46 on the security of communication and information systems in the European Commission, Article 10: Standards

Extent: E+W+S+N.I.

1. The provisions of this Decision shall, where necessary, be further detailed in standards and/or guidelines to be adopted in line with Decision (EU, Euratom) 2017/46 and with Decision C(2017) 7428. IT security standards and guidelines shall provide further details on these implementing rules and Decision (EU, Euratom) 2017/46 for specific security domains according to ISO 27001:2013 Annex A. These standards and guidelines are based on industry best practices and are selected to suit the Commission's IT environment.
2. Standards shall, where necessary, be developed according to ISO 27001:2013 Annex A in the following domains:
(1) organisation of information security;
(2) human resources security;
(3) asset management;
(4) access control;
(5) cryptography;
(6) physical and environmental security;
(7) operational security;
(8) communications security;
(9) system acquisition, development and maintenance;
(10) supplier relationships;
(11) information security incident management;
(12) information security aspects of business continuity management;
(13) compliance.
3. The ISSB shall approve the standards mentioned under paragraph 1 and 2 of this Article before their adoption.
4. The implementing rules to Decision C(2006) 3602 related to the scope of this Decision are hereby repealed.
5. The standards and guidelines adopted under Decision C(2006) 3602 of 16 August 2006 shall remain in effect, insofar as they do not conflict with these implementing rules, until they are repealed or replaced by standards or guidelines to be adopted under Article 13 of Decision (EU, Euratom) 2017/46.

---
Source: https://www.legislation.gov.uk/eudn/2018/559/article/10 (the official version)
Page: https://openlegislation.uk/eu-decision-2018-559/article-10
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.