Article 8 Outsourcing of CISs
United Kingdom
For the purposes of this Decision, a CIS is considered to be outsourced when it is provided on the basis of a contract with a third party contractor, under which the CIS is housed on non-Commission premises. This includes the outsourcing of individual or multiple CISs or other IT services, data centres on non-Commission premises, and the handling of Commission data sets by external services.
The outsourcing of a CIS shall take into account the sensitivity or classification of the information handled as follows:
CISs handling EUCI shall be accredited in accordance with Decision (EU, Euratom) 2015/444, and the Commission Security Accreditation Authority (SAA) shall be consulted in advance. Systems handling EUCI shall not be outsourced.
The system owner of a CIS handling non-EUCI information shall implement proportionate measures to address the security needs in line with the relevant legal obligations or the sensitivity of the information, taking into account the risks of outsourcing. The Directorate-General for Human Resources and Security may impose additional requirements.
Outsourced development projects shall take into account the sensitivity of the developed code and any test data used during development.
The following principles shall apply to outsourced CIS in addition to those laid down in Article 3 of Decision (EU, Euratom) 2017/46:
outsourcing arrangements shall be designed to avoid dependency on specific suppliers;
outsourcing security arrangements shall minimise the possibilities for third party staff to access or modify Commission information;
third party staff that have access to an outsourced CIS shall provide confidentiality agreements;
the outsourcing of a CIS shall be indicated in the inventory of CISs.
The system owner with the participation of the data owner shall:
assess and document the risks relating to outsourcing;
lay down relevant security requirements;
consult with the system owners of all other connected CISs to ensure that their security requirements are included;
ensure that appropriate security requirements and rights are included in the outsourcing contract;
fulfil any other requirements laid down in the detailed procedure as noted in paragraph 8 of this Article.
These actions shall be completed before the contract or other agreement is signed for the outsourcing of one or more CISs.
System owners shall manage the risks relating to outsourcing during the lifetime of the CIS in order to meet the defined security requirements.
System owners shall ensure that third party contractors are obliged to immediately notify the Commission of all IT security incidents affecting an outsourced Commission CIS.
The system owner is responsible for ensuring the compliance of the CIS, the outsourcing contract and the security arrangements with the Commission's rules on information security and IT security.
The Directorate-General for Human Resources and Security shall lay down the detailed standard related to the responsibilities and activities set out in points (1) to (7) in accordance with Article 10 below.