III. INFORMATION ASSURANCE FUNCTIONS AND AUTHORITIES

The following IA functions shall be established in the Member States and the GSC. These functions do not require single organisational entities. They shall have separate mandates. However, these functions, and their accompanying responsibilities, may be combined or integrated in the same organisational entity or split into different organisational entities, provided that internal conflicts of interests or tasks are avoided. The IAA shall be responsible for: developing IA security policies and security guidelines and monitoring their effectiveness and pertinence; safeguarding and administering technical information related to cryptographic products; ensuring that IA measures selected for protecting EUCI comply with the relevant policies governing their eligibility and selection; ensuring that cryptographic products are selected in compliance with policies governing their eligibility and selection; coordinating training and awareness on IA; consulting with the system provider, the security actors and representatives of users in respect to IA security policies and security guidelines; and ensuring appropriate expertise is available in the expert sub-area of the Security Committee for IA issues. The TEMPEST Authority (TA) shall be responsible for ensuring compliance of CIS with TEMPEST policies and guidelines. It shall approve TEMPEST countermeasures for installations and products to protect EUCI to a defined level of classification in its operational environment. The Crypto Approval Authority (CAA) shall be responsible for ensuring that cryptographic products comply with national cryptographic policy or the Council’s cryptographic policy. It shall grant the approval of a cryptographic product to protect EUCI to a defined level of classification in its operational environment. As regards the Member States, the CAA shall in addition be responsible for evaluating cryptographic products. The Crypto Distribution Authority (CDA) shall be responsible for: managing and accounting for EU crypto material; ensuring that appropriate procedures are enforced and channels established for accounting, secure handling, storage and distribution of all EU crypto material; and ensuring the transfer of EU crypto material to or from individuals or services using it. The SAA for each system shall be responsible for: ensuring that CIS comply with the relevant security policies and security guidelines, providing a statement of approval for CIS to handle EUCI to a defined level of classification in its operational environment, stating the terms and conditions of the accreditation, and criteria under which re-approval is required; establishing a security accreditation process, in accordance with the relevant policies, clearly stating the approval conditions for CIS under its authority; defining a security accreditation strategy setting out the degree of detail for the accreditation process commensurate with the required level of assurance; examining and approving security-related documentation, including risk management and residual risk statements, system-specific security requirement statements (‘SSRSs’), security implementation verification documentation and security operating procedures (‘SecOPs’), and ensuring that it complies with the Council’s security rules and policies; checking implementation of security measures in relation to the CIS by undertaking or sponsoring security assessments, inspections or reviews; defining security requirements (e.g. personnel clearance levels) for sensitive positions in relation to the CIS; endorsing the selection of approved cryptographic and TEMPEST products used to provide security for a CIS; approving, or where relevant, participating in the joint approval of the interconnection of a CIS to other CIS; and consulting the system provider, the security actors and representatives of the users with respect to security risk management, in particular the residual risk, and the terms and conditions of the approval statement. The GSC SAA shall be responsible for accrediting all CIS operating within the remit of the GSC. The relevant SAA of a Member State shall be responsible for accrediting CIS and components thereof operating within the remit of a Member State. A joint Security Accreditation Board (SAB) shall be responsible for accrediting CIS within the remit of both the GSC SAA and Member States’ SAAs. It shall be composed of an SAA representative from each Member State and be attended by an SAA representative of the Commission. Other entities with nodes on a CIS shall be invited to attend when that system is under discussion. The SAB shall be chaired by a representative of the GSC SAA. It shall act by consensus of SAA representatives of institutions, Member States and other entities with nodes on the CIS. It shall make periodic reports on its activities to the Security Committee and shall notify all accreditation statements to it. The IA Operational Authority for each system shall be responsible for: developing security documentation in line with security policies and security guidelines, in particular the SSRS including the residual risk statement, the SecOPs and the crypto plan within the CIS accreditation process; participating in selecting and testing the system-specific technical security measures, devices and software, to supervise their implementation and to ensure that they are securely installed, configured and maintained in accordance with the relevant security documentation; participating in selecting TEMPEST security measures and devices if required in the SSRS and ensuring that they are securely installed and maintained in cooperation with the TA; monitoring implementation and application of the SecOps and, where appropriate, delegating operational security responsibilities to the system owner; managing and handling cryptographic products, ensuring the custody of crypto and controlled items and, if so required, ensuring the generation of cryptographic variables; conducting security analysis reviews and tests, in particular to produce the relevant risk reports, as required by the SAA; providing CIS-specific IA training; and implementing and operating CIS-specific security measures.

← anx_IV__cpt_1__cpt_2__cpt_11__point_42__text_1 · All articles · 43. →

Source: EUR-Lex (Cellar) · retrieved 2026-11-01 · Text as adopted (Official Journal); later amendments are not incorporated in this text.