2013/488/EU: Council Decision of 23 September 2013 on the security rules for… · Lexiara

2013/488/EU: Council Decision of 23 September 2013 on the security rules for protecting EU classified information

law · European Union · 32013D0488

609 provisions in 1668 nodes · 6 provisions hand work to national law

Defined terms · All instruments · EU Member State · access to information · accounting · auditing · competition · computer science · confidentiality · contract

Article 1 Purpose, scope and definitions

Article 2 Definition of EUCI, security classifications and markings

Article 3 Classification management

Article 4 Protection of classified information

Article 5 Security risk management

Article 6 Implementation of this Decision

Article 7 Personnel security

Article 8 Physical security

Article 9 Management of classified information

Article 10 Protection of EUCI handled in communication and information systems

Article 11 Industrial security

Article 12 Sharing EUCI

Article 13 Exchange of classified information with third States and international organisations

Article 14 Breaches of security and compromise of EUCI

Article 15 Responsibility for implementation

Article 16 The organisation of security in the Council

Article 17 Security Committee

Article 18 Replacement of previous decision

Article 19 Entry into force

PERSONNEL SECURITY

I. INTRODUCTION

II. GRANTING ACCESS TO EUCI

III. PERSONNEL SECURITY CLEARANCE REQUIREMENTS

Security investigation criteria

Investigative requirements for access to EUCI

Initial granting of a security clearance

Renewal of a security clearance

Authorisation procedures in the GSC

Records of security clearances and authorisations

Exemptions from the PSC requirement

IV. SECURITY EDUCATION AND AWARENESS

V. EXCEPTIONAL CIRCUMSTANCES

VI. ATTENDANCE AT MEETINGS IN THE COUNCIL

VII. POTENTIAL ACCESS TO EUCI

PHYSICAL SECURITY

I. INTRODUCTION

II. PHYSICAL SECURITY REQUIREMENTS AND MEASURES

III. EQUIPMENT FOR THE PHYSICAL PROTECTION OF EUCI

IV. PHYSICALLY PROTECTED AREAS

V. PHYSICAL PROTECTIVE MEASURES FOR HANDLING AND STORING EUCI

VI. CONTROL OF KEYS AND COMBINATIONS USED FOR PROTECTING EUCI

MANAGEMENT OF CLASSIFIED INFORMATION

I. INTRODUCTION

II. CLASSIFICATION MANAGEMENT

Classifications and markings

Abbreviated classification markings

Creation of EUCI

Downgrading and declassification of EUCI

III. REGISTRATION OF EUCI FOR SECURITY PURPOSES

TRÈS SECRET UE/EU TOP SECRET registries

IV. COPYING AND TRANSLATING EU CLASSIFIED DOCUMENTS

V. CARRIAGE OF EUCI

Within a building or self-contained group of buildings

Within the Union

From within the Union to the territory of a third State

VI. DESTRUCTION OF EUCI

VII. ASSESSMENT VISITS

Conduct of assessment visits

PROTECTION OF EUCI HANDLED IN CIS

I. INTRODUCTION

II. INFORMATION ASSURANCE PRINCIPLES

Security risk management

Security throughout the CIS life-cycle

Defence in depth

Principle of minimality and least privilege

Information Assurance awareness

Evaluation and approval of IT-security products

Transmission within Secured and Administrative Areas

Secure interconnection of CIS

Computer storage media

Emergency circumstances

III. INFORMATION ASSURANCE FUNCTIONS AND AUTHORITIES

Information Assurance Authority

TEMPEST Authority

Crypto Approval Authority

Crypto Distribution Authority

Security Accreditation Authority

Information Assurance Operational Authority

INDUSTRIAL SECURITY

I. INTRODUCTION

II. SECURITY ELEMENTS IN A CLASSIFIED CONTRACT

Security classification guide (SCG)

Security aspects letter (SAL)

Programme/Project Security Instructions (PSI)

III. FACILITY SECURITY CLEARANCE (FSC)

IV. CLASSIFIED CONTRACTS AND SUB-CONTRACTS

V. VISITS IN CONNECTION WITH CLASSIFIED CONTRACTS

VI. TRANSMISSION AND CARRIAGE OF EUCI

VII. TRANSFER OF EUCI TO CONTRACTORS LOCATED IN THIRD STATES

VIII INFORMATION CLASSIFIED RESTREINT UE/EU RESTRICTED

EXCHANGE OF CLASSIFIED INFORMATION WITH THIRD STATES AND INTERNATIONAL ORGANISATIONS

I. INTRODUCTION

II. FRAMEWORKS GOVERNING THE EXCHANGE OF CLASSIFIED INFORMATION

III. SECURITY OF INFORMATION AGREEMENTS

IV. ADMINISTRATIVE ARRANGEMENTS

V. EXCHANGE OF CLASSIFIED INFORMATION IN THE CONTEXT OF CSDP OPERATIONS

VI. EXCEPTIONAL AD HOC RELEASE OF EUCI

VII. AUTHORITY TO RELEASE EUCI TO THIRD STATES OR INTERNATIONAL ORGANISATIONS

EQUIVALENCE OF SECURITY CLASSIFICATIONS

LIST OF NATIONAL SECURITY AUTHORITIES (NSAs)