{
  "url": "https://openlegislation.uk/eu-regulation-2010-912/article-11",
  "json_url": "https://openlegislation.uk/eu-regulation-2010-912/article-11.json",
  "legislation": "eur/2010/912",
  "legislation_title": "Regulation (EU) No 912/2010 of the European Parliament and of the Council of 22 September 2010 setting up the European GNSS Agency, repealing Council Regulation (EC) No 1321/2004 on the establishment of structures for the management of the European satellite radio navigation programmes and amending Regulation (EC) No 683/2008 of the European Parliament and of the Council",
  "legislation_url": "https://openlegislation.uk/eu-regulation-2010-912",
  "path": "article/11",
  "kind": "article",
  "number": "11",
  "heading": "Security Accreditation Board",
  "text": "1. A Security Accreditation Board for European GNSS systems (the ‘ Security Accreditation Board ’ ) is hereby set up to perform the tasks set out in this Article.\n2. The Security Accreditation Board shall perform its tasks without prejudice to the responsibility entrusted to the Commission by Regulation (EU) No 1285/2013, in particular for matters relating to security, and without prejudice to the competences of the Member States as regards security accreditation.\n3. As security accreditation authority, the Security Accreditation Board shall, with regard to security accreditation for the European GNSS systems, be responsible for:\n(a) defining and approving a security accreditation strategy setting out:\n(i) the scope of the activities necessary to perform and maintain the accreditation of the European GNSS systems and their potential interconnection with other systems;\n(ii) a security accreditation process for the European GNSS systems with a degree of detail commensurate with the required level of assurance and clearly stating the approval conditions; that process shall be performed in accordance with the relevant requirements, in particular those referred to in Article 13 of Regulation (EU) No 1285/2013;\n(iii) the role of relevant stakeholders involved in the accreditation process;\n(iv) an accreditation schedule compliant with the phases of the programmes, in particular as regards the deployment of infrastructure, service provision and evolution;\n(v) the principles of the security accreditation for networks connected to the systems and PRS equipment connected to the system established under the Galileo programme to be performed by national entities of the Member States competent in security matters;\n(b) taking security accreditation decisions, in particular on the approval of satellite launches, the authorisation to operate the systems in their different configurations and for the various services up to and including the signal in space, and the authorisation to operate the ground stations. As regards the networks and PRS equipment connected to the system established under the Galileo programme, the Security Accreditation Board shall take decisions only on the authorisation of bodies to develop and manufacture PRS receivers or PRS security modules, taking into account the advice provided by national entities competent in security matters and the overall security risks;\n(c) examining and, except as regards documents which the Commission is to adopt under Article 13 of Regulation (EU) No 1285/2013 and Article 8 of Decision No 1104/2011/EU, approving all documentation relating to security accreditation;\n(d) advising, within its field of competence, the Commission in the elaboration of draft texts for acts referred to in Article 13 of Regulation (EU) No 1285/2013 and Article 8 of Decision No 1104/2011/EU, including for the establishment of security operating procedures (SecOps), and providing a statement with its concluding position;\n(e) examining and approving the security risk assessment developed in accordance with the monitoring process referred to in Article 10(h), taking into account compliance with the documents referred to in point (c) of this paragraph and those developed in accordance with Article 13 of Regulation (EU) No 1285/2013 and Article 8 of Decision No 1104/2011/EU; cooperating with the Commission to define risk mitigation measures;\n(f) checking the implementation of security measures in relation to the security accreditation of the European GNSS systems by undertaking or sponsoring security assessments, inspections or reviews, in accordance with Article 12(b)of this Regulation;\n(g) endorsing the selection of approved products and measures which protect against electronic eavesdropping (TEMPEST) and of approved cryptographic products used to provide security for the European GNSS systems;\n(h) approving or, where relevant, participating in the joint approval of, together with the relevant entity competent in security matters, the interconnection of the European GNSS systems with other systems;\n(i) agreeing with the relevant Member State the template for access control referred to in Article 12(c);\n(j) on the basis of the risk reports referred to in paragraph 11 of this Article, informing the Commission of its risk assessment and providing advice to the Commission on residual risk treatment options for a given security accreditation decision;\n(k) assisting, in close liaison with the Commission, the Council in the implementation of Joint Action 2004/552/CFSP upon a specific request of the Council;\n(l) carrying out the consultations which are necessary to perform its tasks.\n4. The Security Accreditation Board shall also:\n(a) prepare and approve that part of the multiannual work programme referred to in Article 8a(1) concerning the operational activities covered by this Chapter and the financial and human resources needed to accomplish those activities, and submit it to the Administrative Board in good time so that it can be incorporated in the multiannual work programme;\n(b) prepare and approve that part of the annual work programme referred to in Article 8a(2) concerning the operational activities covered by this Chapter and the financial and human resources needed to accomplish those activities, and submit it to the Administrative Board in good time so that it can be incorporated in the annual work programme;\n(c) prepare and approve that part of the annual report referred to in point (h) of Article 6(2) concerning the Agency’s activities and prospects covered by this Chapter and the financial and human resources needed to accomplish those activities and prospects, and submit it to the Administrative Board in good time so that it can be incorporated in the annual report;\n(d) adopt and publish its rules of procedure.\n5. The Commission shall keep the Security Accreditation Board continuously informed of the impact of any decisions envisaged by the Security Accreditation Board on the proper conduct of the programmes and of the implementation of residual risk treatment plans. The Security Accreditation Board shall take note of any such opinion of the Commission.\n6. The decisions of the Security Accreditation Board shall be addressed to the Commission.\n7. The Security Accreditation Board shall be composed of one representative of each Member State, a representative of the Commission and a representative of the HR. The Member States, the Commission and the HR shall endeavour to limit the turnover of their respective representatives on the Security Accreditation Board. The term of office of the members of the Security Accreditation Board shall be four years and shall be renewable. A representative of ESA shall be invited to attend the meetings of the Security Accreditation Board as an observer. On an exceptional basis, representatives of third countries or international organisations may also be invited to attend meetings as observers for matters directly relating to those third countries or international organisations. Arrangements for such participation of representatives of third countries or international organisations and the conditions therefor shall be established in the agreements referred to in Article 23(1) and shall comply with the rules of procedure of the Security Accreditation Board.\n8. The Security Accreditation Board shall elect a Chairperson and Deputy Chairperson from among its members by a two-thirds majority of all members with the right to vote. The Deputy Chairperson shall automatically take the place of the Chairperson when the Chairperson is prevented from attending to his/her duties.\nThe Security Accreditation Board shall have the power to dismiss the Chairperson, the Deputy Chairperson or both of them. It shall adopt the decision to dismiss by a two-thirds majority.\nThe term of office of the Chairperson and of the Deputy Chairperson of the Security Accreditation Board shall be two years renewable once. The term of office of either person shall end if he or she ceases to be a member of the Security Accreditation Board.\n9. The Security Accreditation Board shall have access to all the human and material resources required to provide appropriate administrative support functions and to enable it, together with the bodies referred to in paragraph 11, to perform its tasks independently, in particular when handling files, initiating and monitoring the implementation of security procedures and performing system security audits, preparing decisions and organising its meetings. It shall also have access to any information needed for the performance of its tasks in the possession of the Agency, without prejudice to the principles of autonomy and independence referred to in Article 10(i).\n10. The Security Accreditation Board and the Agency staff under its supervision shall perform their work in a manner ensuring autonomy and independence in relation to the other activities of the Agency, in particular operational activities associated with the exploitation of the systems, in accordance with the objectives of the programmes. To that end, an effective organisational division shall be established within the Agency between the staff involved in activities covered by this Chapter and the other staff of the Agency. The Security Accreditation Board shall immediately inform the Executive Director, the Administrative Board and the Commission of any circumstances that could hamper its autonomy or independence. In the event that no remedy is found within the Agency, the Commission shall examine the situation, in consultation with the relevant parties. On the basis of the outcome of that examination, the Commission shall take appropriate mitigation measures to be implemented by the Agency, and shall inform the European Parliament and the Council thereof.\n11. The Security Accreditation Board shall set up special subordinate bodies, acting on its instructions, to deal with specific issues. In particular, while ensuring necessary continuity of work, it shall set up a panel to conduct security analysis reviews and tests to produce the relevant risk reports in order to assist it in preparing its decisions. The Security Accreditation Board may set up and disband expert groups to contribute to the work of the panel.\n12. Without prejudice to the competence of the Member States and of the task of the Agency referred to in point (a)(i) of Article 14(1) of Regulation (EU) No 1285/2013, during the deployment phase of the Galileo programme, a group of experts of the Member States shall be set up under the supervision of the Security Accreditation Board to perform the tasks of the Crypto Distribution Authority (CDA) relating to the management of EU cryptographic material in particular for:\n(i) the management of flights keys and other keys necessary for the functioning of the system established under the Galileo programme;\n(ii) the verification of the establishment and the enforcement of procedures for accounting, secure handling, storage and distribution of PRS keys.\n13. If consensus according to the general principles referred to in Article 10 of this Regulation cannot be reached, the Security Accreditation Board shall take decisions on the basis of majority voting, as provided for in Article 16 of the Treaty on European Union and without prejudice to Article 9 of this Regulation. The representative of the Commission and the representative of the HR shall not vote. The Chairperson of the Security Accreditation Board shall sign, on behalf of the Security Accreditation Board, the decisions adopted by the Security Accreditation Board.\n14. The Commission shall keep the European Parliament and the Council informed, without undue delay, of the impact of the adoption of the security accreditation decisions on the proper conduct of the programmes. If the Commission considers that a decision taken by the Security Accreditation Board may have a significant effect on the proper conduct of the programmes, for example in terms of costs, schedule or performance, it shall immediately inform the European Parliament and the Council.\n15. Taking into account the views of the European Parliament and of the Council, which should be expressed within one month, the Commission may adopt any adequate measures in accordance with Regulation (EU) No 1285/2013.\n16. The Administrative Board shall be periodically kept informed of the evolution of the work of the Security Accreditation Board.\n17. The timetable for the work of the Security Accreditation Board shall respect the annual work programme referred to in Article 27 of Regulation (EU) No 1285/2013.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Substituted by Regulation (EU) No 512/2014 of the European Parliament and of the Council of 16 April 2014 amending Regulation (EU) No 912/2010 setting up the European GNSS Agency."
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eur/2010/912/article/11",
    "retrieved_at": "2026-11-01T14:50:35.106735+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}