48.

The SAA for each system shall be responsible for: ensuring that CIS comply with the relevant security policies and security guidelines, providing a statement of approval for CIS to handle EUCI to a defined level of classification in its operational environment, stating the terms and conditions of the accreditation, and criteria under which re-approval is required; establishing a security accreditation process, in accordance with the relevant policies, clearly stating the approval conditions for CIS under its authority; defining a security accreditation strategy setting out the degree of detail for the accreditation process commensurate with the required level of assurance; examining and approving security-related documentation, including risk management and residual risk statements, system-specific security requirement statements (‘SSRSs’), security implementation verification documentation and security operating procedures (‘SecOPs’), and ensuring that it complies with the Council’s security rules and policies; checking implementation of security measures in relation to the CIS by undertaking or sponsoring security assessments, inspections or reviews; defining security requirements (e.g. personnel clearance levels) for sensitive positions in relation to the CIS; endorsing the selection of approved cryptographic and TEMPEST products used to provide security for a CIS; approving, or where relevant, participating in the joint approval of the interconnection of a CIS to other CIS; and consulting the system provider, the security actors and representatives of the users with respect to security risk management, in particular the residual risk, and the terms and conditions of the approval statement.

← Security Accreditation Authority · All articles · anx_IV__cpt_1__cpt_3__cpt_5__point_48__text_1 →

Source: EUR-Lex (Cellar) · retrieved 2026-11-01 · Text as adopted (Official Journal); later amendments are not incorporated in this text.