Article 15 Specific measures for RESTREINT UE/EU RESTRICTED information on removable storage media

The use of removable storage media shall be controlled and accounted for. Only removable storage media provided by the Commission and encrypted by a product approved by the Commission security authority shall be used. Personal removable storage media and those given freely at conferences, seminars, etc. shall not be used for transferring classified information. Where possible, Tempest-proof removable storage media should be used, in accordance with the guidance from the Commission security authority.

Where a classified document is handled or stored electronically on removable storage media, such as USB sticks, CDs or memory cards, the classification marking shall be clearly visible on the displayed information itself, as well as in the filename and on the removable storage medium.

Staff shall bear in mind that when large amounts of classified information are stored on removable storage media the device may warrant a higher classification level.

Only CIS that have been appropriately accredited shall be used to transfer RESTREINT UE/EU RESTRICTED information onto or from removable storage media.

When downloading RESTREINT UE/EU RESTRICTED information on removable storage media, particular care shall be taken to ensure that the media does not contain viruses or malware prior to the transfer of the data.

Where applicable, removable storage media shall be handled in accordance with any security operating procedures relating to the encryption system used.

Documents on removable storage media that are either no longer required, or have been transferred onto an appropriate CIS, shall be securely removed or deleted using approved products or methods. Unless stored in appropriate locked office furniture, removable storage media shall be destroyed when no longer needed. Any destruction or deletion shall use a method that is in accordance with the Commission security rules. An inventory shall be kept of the removable media, and their destruction shall be recorded.