52.

The IA Operational Authority for each system shall be responsible for: developing security documentation in line with security policies and security guidelines, in particular the SSRS including the residual risk statement, the SecOPs and the crypto plan within the CIS accreditation process; participating in selecting and testing the system-specific technical security measures, devices and software, to supervise their implementation and to ensure that they are securely installed, configured and maintained in accordance with the relevant security documentation; participating in selecting TEMPEST security measures and devices if required in the SSRS and ensuring that they are securely installed and maintained in cooperation with the TA; monitoring implementation and application of the SecOps and, where appropriate, delegating operational security responsibilities to the system owner; managing and handling cryptographic products, ensuring the custody of crypto and controlled items and, if so required, ensuring the generation of cryptographic variables; conducting security analysis reviews and tests, in particular to produce the relevant risk reports, as required by the SAA; providing CIS-specific IA training; and implementing and operating CIS-specific security measures.

← Information Assurance Operational Authority · All articles · anx_IV__cpt_1__cpt_3__cpt_6__point_52__text_1 →

Source: EUR-Lex (Cellar) · retrieved 2026-11-01 · Text as adopted (Official Journal); later amendments are not incorporated in this text.