Secure interconnection of CIS

For the purposes of this Decision, an interconnection shall mean the direct connection of two or more IT systems for the purpose of sharing data and other information resources (e.g. communication) in a unidirectional or multidirectional way. A CIS shall treat any interconnected IT system as untrusted and shall implement protective measures to control the exchange of classified information. For all interconnections of CIS with another IT system the following basic requirements shall be met: business or operational requirements for such interconnections shall be stated and approved by the competent authorities; the interconnection shall undergo a risk management and accreditation process and shall require the approval of the competent SAAs; and Boundary Protection Services (BPS) shall be implemented at the perimeter of all CIS. There shall be no interconnection between an accredited CIS and an unprotected or public network, except where the CIS has approved BPS installed for such a purpose between the CIS and the unprotected or public network. The security measures for such interconnections shall be reviewed by the competent IAA and approved by the competent SAA. When the unprotected or public network is used solely as a carrier and the data is encrypted by a cryptographic product approved in accordance with Article 10, such a connection shall not be deemed to be an interconnection. The direct or cascaded interconnection of a CIS accredited to handle TRÈS SECRET UE/EU TOP SECRET to an unprotected or public network shall be prohibited.

← anx_IV__cpt_1__cpt_2__cpt_8__point_31__text_1 · All articles · 32. →

Source: EUR-Lex (Cellar) · retrieved 2026-11-01 · Text as adopted (Official Journal); later amendments are not incorporated in this text.