MANAGEMENT OF CLASSIFIED INFORMATION

This Annex sets out provisions for implementing Article 9. It lays down the administrative measures for controlling EUCI throughout its life-cycle in order to help deter and detect deliberate or accidental compromise or loss of such information. Information shall be classified where it requires protection with regard to its confidentiality. The originator of EUCI shall be responsible for determining the security classification level, in accordance with the relevant classification guidelines, and for the initial dissemination of the information. The classification level of EUCI shall be determined in accordance with Article 2(2) and by reference to the security policy to be approved in accordance with Article 3(3). The security classification shall be clearly and correctly indicated, regardless of whether the EUCI is on paper, oral, electronic or in any other form. Individual parts of a given document (i.e. pages, paragraphs, sections, annexes, appendices, attachments and enclosures) may require different classifications and shall be marked accordingly, including when stored in electronic form. The overall classification level of a document or file shall be at least as high as that of its most highly classified component. When information from various sources is collated, the final product shall be reviewed to determine its overall security classification level, since it may warrant a higher classification than its component parts. To the extent possible, documents containing parts with different classification levels shall be structured so that parts with a different classification level may be easily identified and detached if necessary. The classification of a letter or note covering enclosures shall be as high as the highest classification of its enclosures. The originator shall indicate clearly at which level it is classified when detached from its enclosures by means of an appropriate marking, e.g.: CONFIDENTIEL UE/EU CONFIDENTIAL Without attachment(s) RESTREINT UE/EU RESTRICTED In addition to one of the security classification markings set out in Article 2(2), EUCI may bear additional markings, such as: an identifier to designate the originator; any caveats, code-words or acronyms specifying the field of activity to which the document relates, a particular distribution on a need-to-know basis or restrictions on use; releasability markings; or where applicable, the date or specific event after which it may be downgraded or declassified. Standardised abbreviated classification markings may be used to indicate the classification level of individual paragraphs of a text. Abbreviations shall not replace the full classification markings. The following standard abbreviations may be used within EU classified documents to indicate the classification level of sections or blocks of text of less than a single page: TRÈS SECRET UE/EU TOP SECRET TS-UE/EU-TS SECRET UE/EU SECRET S-UE/EU-S CONFIDENTIEL UE/EU CONFIDENTIAL C-UE/EU-C RESTREINT UE/EU RESTRICTED R-UE/EU-R When creating an EU classified document: each page shall be marked clearly with the classification level; each page shall be numbered; the document shall bear a reference number and a subject, which is not itself classified information, unless it is marked as such; the document shall be dated; and documents classified SECRET UE/EU SECRET or above shall bear a copy number on every page, if they are to be distributed in several copies. Where it is not possible to apply paragraph 13 to EUCI, other appropriate measures shall be taken in accordance with security guidelines to be established pursuant to Article 6(2). At the time of its creation, the originator shall indicate, where possible, and in particular for information classified RESTREINT UE/EU RESTRICTED, whether EUCI can be downgraded or declassified on a given date or following a specific event. The GSC shall regularly review EUCI held by it to ascertain whether the classification level still applies. The GSC shall establish a system to review the classification level of EUCI which it has originated no less frequently than every five years. Such a review shall not be necessary where the originator has indicated from the outset that the information will automatically be downgraded or declassified and the information has been marked accordingly. For every organisational entity within the GSC and Member States’ national administrations in which EUCI is handled, a responsible registry shall be identified to ensure that EUCI is handled in accordance with this Decision. Registries shall be established as Secured Areas as defined in Annex II. For the purposes of this Decision, registration for security purposes (‘registration’) means the application of procedures which record the life-cycle of material, including its dissemination and destruction. All material classified CONFIDENTIEL UE/EU CONFIDENTIAL and above shall be registered in designated registries when it arrives at or leaves an organisational entity. The Central Registry within the GSC shall keep a record of all classified information released by the Council and the GSC to third States and international organisations, and of all classified information received from third States or international organisations. In the case of a CIS, registration procedures may be performed by processes within the CIS itself. The Council shall approve a security policy on the registration of EUCI for security purposes. A registry shall be designated in the Member States and in the GSC to act as the central receiving and dispatching authority for information classified TRÈS SECRET UE/EU TOP SECRET. Where necessary, subordinate registries may be designated to handle such information for registration purposes. Such subordinate registries may not transmit TRÈS SECRET UE/EU TOP SECRET documents directly to other subordinate registries of the same central TRÈS SECRET UE/EU TOP SECRET registry or externally without the express written approval of the latter. TRÈS SECRET UE/EU TOP SECRET documents shall not be copied or translated without the prior written consent of the originator. Where the originator of documents classified SECRET UE/EU SECRET and below has not imposed caveats on their copying or translation, such documents may be copied or translated on instruction from the holder. The security measures applicable to the original document shall apply to copies and translations thereof. Carriage of EUCI shall be subject to the protective measures set out in paragraphs 30 to 41. When EUCI is carried on electronic media, and notwithstanding Article 9(4), the protective measures set out below may be supplemented by appropriate technical countermeasures prescribed by the competent security authority so as to minimise the risk of loss or compromise. The competent security authorities in the GSC and in Member States shall issue instructions on the carriage of EUCI in accordance with this Decision. EUCI carried within a building or self-contained group of buildings shall be covered in order to prevent observation of its contents. Within a building or self-contained group of buildings, information classified TRÈS SECRET UE/EU TOP SECRET shall be carried in a secured envelope bearing only the addressee’s name. EUCI carried between buildings or premises within the Union shall be packaged so that it is protected from unauthorised disclosure. The carriage of information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET within the Union shall be by one of the following means: military, government or diplomatic courier, as appropriate; hand carriage, provided that: EUCI does not leave the possession of the bearer, unless it is stored in accordance with the requirements set out in Annex II; EUCI is not opened en route or read in public places; individuals are briefed on their security responsibilities; and individuals are provided with a courier certificate where necessary; postal services or commercial courier services, provided that: they are approved by the relevant NSA in accordance with national laws and regulations; and they apply appropriate protective measures in accordance with minimum requirements to be laid down in security guidelines pursuant to Article 6(2). In the case of carriage from one Member State to another, the provisions of point (c) shall be limited to information classified up to CONFIDENTIEL UE/EU CONFIDENTIAL. Information classified RESTREINT UE/EU RESTRICTED may also be carried by postal services or commercial courier services. A courier certificate is not required for the carriage of such information. Material classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET (e.g. equipment or machinery) which cannot be carried by the means referred to in paragraph 33 shall be transported as freight by commercial carrier companies in accordance with Annex V. The carriage of information classified TRÈS SECRET UE/EU TOP SECRET between buildings or premises within the Union shall be by military, government or diplomatic courier, as appropriate. EUCI carried from within the Union to the territory of a third State shall be packaged in such a way that it is protected from unauthorised disclosure. The carriage of information classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET from within the Union to the territory of a third State shall be by one of the following means: military or diplomatic courier; hand carriage, provided that: the package bears an official seal, or is packaged so as to indicate that it is an official consignment and should not undergo customs or security scrutiny; individuals carry a courier certificate identifying the package and authorising them to carry the package; EUCI does not leave the possession of the bearer, unless it is stored in accordance with the requirements set out in Annex II; EUCI is not opened en route or read in public places; and individuals are briefed on their security responsibilities. The carriage of information classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET released by the Union to a third State or international organisation shall comply with the relevant provisions under a security of information Agreement or an administrative arrangement in accordance with Article 13(2)(a) or (b). Information classified RESTREINT UE/EU RESTRICTED may also be carried by postal services or commercial courier services. The carriage of information classified TRÈS SECRET UE/EU TOP SECRET from within the Union to the territory of a third State shall be by military or diplomatic courier. EU classified documents which are no longer required may be destroyed, without prejudice to the relevant rules and regulations on archiving. Documents subject to registration in accordance with Article 9(2) shall be destroyed by the responsible registry on instruction from the holder or from a competent authority. The logbooks and other registration information shall be updated accordingly. For documents classified SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET, destruction shall be performed in the presence of a witness who shall be cleared to at least the classification level of the document being destroyed. The registrar and the witness, where the presence of the latter is required shall sign a destruction certificate, which shall be filed in the registry. The registry shall keep destruction certificates of TRÈS SECRET UE/EU TOP SECRET documents for a period of at least 10 years and of documents CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET for a period of at least five years. Classified documents, including those classified RESTREINT UE/EU RESTRICTED, shall be destroyed by methods which meet relevant Union or equivalent standards or which have been approved by Member States in accordance with national technical standards so as to prevent reconstruction in whole or in part. The destruction of computer storage media used for EUCI shall be in accordance with paragraph 37 of Annex IV. In the event of an emergency, if there is an imminent risk of unauthorised disclosure EUCI shall be destroyed by the holder in such a way that it cannot be reconstructed in whole or in part. The originator and originating registry shall be informed of the emergency destruction of registered EUCI. The term ‘assessment visit’ shall be used hereinafter to designate any: inspections or assessment visits in accordance with Article 9(3) and points (e), (f) and (g) of Article 16(2); or assessment visit in accordance with Article 13(5); to evaluate the effectiveness of measures implemented for protecting EUCI. Assessment visits shall be carried out, inter alia, to: ensure that the required minimum standards for protecting EUCI laid down in this Decision are respected; emphasise the importance of security and effective risk management within the entities inspected; recommend countermeasures to mitigate the specific impact of loss of confidentiality, integrity or availability of classified information; and reinforce security authorities’ ongoing security education and awareness programmes. Before the end of each calendar year, the Council shall adopt the assessment visit programme foreseen in point (c) of Article 16(1) for the following year. The actual dates for each assessment visit shall be determined in agreement with the Union body or agency, Member State, third State or international organisation concerned. Assessment visits shall be conducted in order to check the relevant rules, regulations and procedures in the visited entity and verify whether the entity’s practices comply with the basic principles and minimum standards laid down in this Decision and in the provisions governing the exchange of classified information with that entity. Assessment visits shall be conducted in two phases. Prior to the visit itself a preparatory meeting shall be organised, if necessary, with the entity concerned. After this preparatory meeting the assessment team shall establish, in agreement with the entity concerned, a detailed assessment visit programme covering all areas of security. The assessment visit team should have access to any location where EUCI is handled, in particular registries and CIS points of presence. Assessment visits to Member States’ national administrations, third States and international organisations shall be conducted in full cooperation with the officials of the entity, third State or international organisation being visited. Assessment visits to Union bodies, agencies and entities which apply this Decision or the principles thereof shall be conducted with assistance from experts of the NSA on whose territory the body or agency is located. In the case of assessment visits to Union bodies, agencies and entities which apply this Decision or the principles thereof, and to third States and international organisations, assistance and contributions from NSA experts may be requested in accordance with detailed arrangements to be agreed by the Security Committee. At the end of the assessment visit the main conclusions and recommendations shall be presented to the visited entity. Thereafter, a report on the assessment visit shall be drawn up. Where corrective action and recommendations have been proposed, sufficient details shall be included in the report to support the conclusions reached. The report shall be forwarded to the appropriate authority of the visited entity. For assessment visits conducted in Member States’ national administrations: the draft assessment report will be forwarded to the NSA concerned to verify that it is factually correct and that it contains no information classified higher than RESTREINT UE/EU RESTRICTED; and unless the Member State NSA in question requests general distribution to be withheld, assessment reports shall be circulated to the Security Committee The report shall be classified RESTREINT UE/EU RESTRICTED. A regular report shall be prepared under the responsibility of the GSC Security Authority (Security Office) to highlight the lessons learned from the assessment visits conducted in Member States over a specified period and examined by the Security Committee. For assessment visits of third States and international organisations, the report shall be distributed to the Security Committee. The report shall be classified at least RESTREINT UE/EU RESTRICTED. Any corrective action shall be verified during a follow-up visit and reported to the Security Committee. For assessment visits to any Union bodies, agencies and entities which apply this Decision or the principles thereof, assessment visit reports shall be distributed to the Security Committee. The draft assessment visit report shall be forwarded to the agency or body concerned to verify that it is factually correct and that it contains no information classified higher than RESTREINT UE/EU RESTRICTED. Any corrective action shall be verified during a follow up visit and reported to the Security Committee. The GSC Security Authority shall conduct regular inspections of organisational entities in the GSC for the purposes laid down in paragraph 50. The GSC Security Authority (Security Office) shall draw up and update a checklist of items to be verified in the course of an assessment visit. This checklist shall be forwarded to the Security Committee. The information to complete the checklist shall be obtained in particular during the visit from the security management of the entity being inspected. Once completed with the detailed responses, the checklist shall be classified in agreement with the inspected entity. It shall not form part of the inspection report.

← ANNEX III · All articles · I. INTRODUCTION →

Source: EUR-Lex (Cellar) · retrieved 2026-11-01 · Text as adopted (Official Journal); later amendments are not incorporated in this text.