OpenLegislation

Article 1

United Kingdom

Original text. Later amendments are not shown.

Regulation (EC) No 1663/95 is amended as follows:

  1. 1..

    Article 1 is amended as follows:

    1. (a)

      In the second phrase of the second subparagraph of paragraph 3, the terms ‘the security of computer systems’ are replaced by the terms ‘the security of information system’.

    2. (b)

      In the first subparagraph of paragraph 7, the following indent is added:

      • ‘the provisions concerning the security of information systems’.

  2. 2..

    In Article 3(1), the following subparagraphs are added:

    ‘As of financial year 2008 at the latest, the certifying body shall further provide, before the date referred to in the third subparagraph, a statement as to the information systems security measures put in place by the paying agency. The statement shall be based on a version applicable in the financial year concerned of the chosen internationally accepted security standards referred to in point 6(vi) of the Annex to this Regulation, serving as the basis for the security measures, and shall indicate whether, for the financial year concerned, effective security measures were in place.

    For the financial years preceding that for which the first statement on the security of the paying agency’s information systems is drawn up, the certifying body shall, in its report of its findings, include comments and provisional conclusions, using a scoring mechanism, as to the information systems security measures put in place by the paying agency. The report shall be based on a version applicable in the financial year concerned of the chosen internationally accepted security standards referred to in point 6(vi) of the Annex to the present Regulation, serving as the basis for the security measures, and shall indicate as to what extent, for the financial year concerned, effective security measures were in place’.

  3. 3..

    Article 4(2) is replaced by the following:

    ‘2.

    The documents and the accounting information referred to in paragraph 1 shall be sent to the Commission by 10 February of the year following the end of the financial year which it concerns. The documents referred to in points (a) and (b) of paragraph 1 shall be sent in one copy together with an electronic copy’.

  4. 4..

    The Annex is amended in accordance with the Annex to this Regulation.