VII. ASSESSMENT VISITS

The term ‘assessment visit’ shall be used hereinafter to designate any: inspections or assessment visits in accordance with Article 9(3) and points (e), (f) and (g) of Article 16(2); or assessment visit in accordance with Article 13(5); to evaluate the effectiveness of measures implemented for protecting EUCI. Assessment visits shall be carried out, inter alia, to: ensure that the required minimum standards for protecting EUCI laid down in this Decision are respected; emphasise the importance of security and effective risk management within the entities inspected; recommend countermeasures to mitigate the specific impact of loss of confidentiality, integrity or availability of classified information; and reinforce security authorities’ ongoing security education and awareness programmes. Before the end of each calendar year, the Council shall adopt the assessment visit programme foreseen in point (c) of Article 16(1) for the following year. The actual dates for each assessment visit shall be determined in agreement with the Union body or agency, Member State, third State or international organisation concerned. Assessment visits shall be conducted in order to check the relevant rules, regulations and procedures in the visited entity and verify whether the entity’s practices comply with the basic principles and minimum standards laid down in this Decision and in the provisions governing the exchange of classified information with that entity. Assessment visits shall be conducted in two phases. Prior to the visit itself a preparatory meeting shall be organised, if necessary, with the entity concerned. After this preparatory meeting the assessment team shall establish, in agreement with the entity concerned, a detailed assessment visit programme covering all areas of security. The assessment visit team should have access to any location where EUCI is handled, in particular registries and CIS points of presence. Assessment visits to Member States’ national administrations, third States and international organisations shall be conducted in full cooperation with the officials of the entity, third State or international organisation being visited. Assessment visits to Union bodies, agencies and entities which apply this Decision or the principles thereof shall be conducted with assistance from experts of the NSA on whose territory the body or agency is located. In the case of assessment visits to Union bodies, agencies and entities which apply this Decision or the principles thereof, and to third States and international organisations, assistance and contributions from NSA experts may be requested in accordance with detailed arrangements to be agreed by the Security Committee. At the end of the assessment visit the main conclusions and recommendations shall be presented to the visited entity. Thereafter, a report on the assessment visit shall be drawn up. Where corrective action and recommendations have been proposed, sufficient details shall be included in the report to support the conclusions reached. The report shall be forwarded to the appropriate authority of the visited entity. For assessment visits conducted in Member States’ national administrations: the draft assessment report will be forwarded to the NSA concerned to verify that it is factually correct and that it contains no information classified higher than RESTREINT UE/EU RESTRICTED; and unless the Member State NSA in question requests general distribution to be withheld, assessment reports shall be circulated to the Security Committee The report shall be classified RESTREINT UE/EU RESTRICTED. A regular report shall be prepared under the responsibility of the GSC Security Authority (Security Office) to highlight the lessons learned from the assessment visits conducted in Member States over a specified period and examined by the Security Committee. For assessment visits of third States and international organisations, the report shall be distributed to the Security Committee. The report shall be classified at least RESTREINT UE/EU RESTRICTED. Any corrective action shall be verified during a follow-up visit and reported to the Security Committee. For assessment visits to any Union bodies, agencies and entities which apply this Decision or the principles thereof, assessment visit reports shall be distributed to the Security Committee. The draft assessment visit report shall be forwarded to the agency or body concerned to verify that it is factually correct and that it contains no information classified higher than RESTREINT UE/EU RESTRICTED. Any corrective action shall be verified during a follow up visit and reported to the Security Committee. The GSC Security Authority shall conduct regular inspections of organisational entities in the GSC for the purposes laid down in paragraph 50. The GSC Security Authority (Security Office) shall draw up and update a checklist of items to be verified in the course of an assessment visit. This checklist shall be forwarded to the Security Committee. The information to complete the checklist shall be obtained in particular during the visit from the security management of the entity being inspected. Once completed with the detailed responses, the checklist shall be classified in agreement with the inspected entity. It shall not form part of the inspection report.

← anx_III__cpt_1__cpt_6__point_48__text_1 · All articles · 49. →

Source: EUR-Lex (Cellar) · retrieved 2026-11-01 · Text as adopted (Official Journal); later amendments are not incorporated in this text.