Decision of the Bureau of the European Parliament of 15 April 2013 concerning the rules governing the treatment of confidential information by the European Parliament

Article 1

Objective

This Decision governs the management and handling of confidential information by the European Parliament, including the creation, reception, forwarding and storage of such information, with a view to the appropriate protection of its confidential nature. It implements, the Interinstitutional Agreement and the Framework Agreement, in particular Annex II thereto.

Article 2

Definitions

For the purposes of this Decision:

• (a) ‘information’ means any written or oral information, whatever the medium and whoever the author may be;

• (b) ‘confidential information’ means ‘classified information’, and non-classified ‘other confidential information’;

• (c) ‘classified information’ means ‘EU classified information’ and ‘equivalent classified information’;

• (d) ‘EU classified information’ (EUCI) means any information and material, classified as ‘TRÈS SECRET UE/EU TOP SECRET’, ‘SECRET UE/EU SECRET’, ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ or ‘RESTREINT UE/EU RESTRICTED’, unauthorised disclosure of which could cause varying degrees of prejudice to Union interests or to those of one or more of its Member States, whether or not such information originates within the institutions, bodies, offices or agencies established by virtue or on the basis of the Treaties. In this regard, information and material classified at the level:
• — ‘TRÈS SECRET UE/EU TOP SECRET’ is information and material the unauthorised disclosure of which could cause exceptionally grave prejudice to the essential interests of the Union or of one or more of the Member States;
• — ‘SECRET UE/EU SECRET’ is information and material the unauthorised disclosure of which could seriously harm the essential interests of the Union or of one or more of the Member States;
• — ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ is information and material the unauthorised disclosure of which could harm the essential interests of the Union or of one or more of the Member States;
• — ‘RESTREINT UE/EU RESTRICTED’ is information and material the unauthorised disclosure of which could be disadvantageous to the interests of the Union or of one or more of the Member States;

• (e) ‘equivalent classified information’ means classified information issued by Member States, third States or international organisations which bears a security classification marking equivalent to one of the security classification markings used for EUCI and which has been forwarded to the European Parliament by the Council or the Commission;

• (f) ‘other confidential information’ means any other non-classified confidential information, including information covered by data protection rules or by the obligation of professional secrecy, created in the European Parliament or forwarded to the European Parliament by other institutions, bodies, offices and agencies established by virtue or on the basis of the Treaties or by Member States;

• (g) ‘document’ means any recorded information, regardless of its physical form or characteristics;

• (h) ‘material’ means any document or item of machinery or equipment, either manufactured or in the process of manufacture;

• (i) ‘need to know’ means the need of a person to have access to confidential information in order to be able to perform an official function or a task;

• (j) ‘authorisation’ means a decision adopted by the President, if it concerns Members of the European Parliament, or by the Secretary-General, if it concerns officials of the European Parliament and other European Parliament employees working for political groups, to grant an individual access to classified information up to a specific level, on the basis of a positive result of a security screening (vetting) carried out by a national authority under national law and pursuant to the provisions laid down in Annex I, Part 2;

• (k) ‘downgrading’ means a reduction in the level of classification;

• (l) ‘declassification’ means the removal of any classification;

• (m) ‘marking’ means a sign affixed to ‘other confidential information’ intended to identify predefined specific instructions about its handling or the field covered by a given document. It may also be affixed to classified information, in order to impose additional requirements for its handling;

• (n) ‘unmarking’ means the removal of any marking;

• (o) ‘originator’ means the duly authorised author of confidential information;

• (p) ‘security notices’ means the implementing measures laid down in Annex II;

• (q) ‘handling instructions’ means technical instructions issued to the European Parliament's services concerning the management of confidential information.

Article 3

Basic principles and minimum standards

The processing of confidential information by means of automated communication and information systems (CIS) of the European Parliament shall be implemented in accordance with the concept of information assurance (IA), as provided for in security notice 3.

• (a) they have been security-cleared in accordance with Annex I, Part 2, of this Decision, or

• (b) a notification has been received from a competent national authority that the Members concerned are duly authorised by virtue of their functions in accordance with national law.

Article 4

Creation of confidential information and administrative handling by the European Parliament

Article 5

Reception of confidential information by the European Parliament

• (a) information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’: to the secretariat of the parliamentary body/office-holder which submitted the request therefor, or directly to the CIU;

• (b) information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET or its equivalent: to the CIU.

Article 6

Communication of classified information by the European Parliament to third parties

The European Parliament may, subject to the prior written consent of the originator or the Union Institution, which has communicated the classified information to the European Parliament, as the case may be, forward such classified information to third parties, on condition that they ensure that, when such information is handled, rules equivalent to those laid down in this Decision are respected within their services and premises.

Article 7

Secure facilities

Article 8

Registration, handling and storage of confidential information

• (a) documents shall be handed over in person to the head of the secretariat, who shall register them and provide an acknowledgement of receipt;

• (b) when not actually being used, such documents shall be kept in a locked location, under the responsibility of the secretariat;

• (c) in no case may the information be saved on another medium or transmitted to any person. Such documents may only be duplicated by means of appropriately accredited equipment as defined in the security notices;

• (d) access to such information shall be restricted to those designated by the originator or by the Union Institution which communicated the information to the European Parliament, in accordance with the arrangements referred to in Article 4(2) or Article 5(3), (4) and (5);

• (e) the secretariat of the parliamentary body/office-holder shall keep a record of the persons who have consulted the information, and of the date and time of such consultation, and shall transmit the record to the CIU at the time when the information is deposited with the CIU.

Article 9

Access to secure facilities

• (a) persons who, pursuant to Article 3(4) to (7), are authorised to consult the information held there and who have submitted an application pursuant to Article 10(1);

• (b) persons who, pursuant to Article 4(1), are authorised to create classified information and who have submitted an application pursuant to Article 10(1);

• (c) the European Parliament's officials of the CIU;

• (d) the European Parliament officials responsible for managing the CIS;

• (e) European Parliament officials responsible for security and fire safety, when necessary;

• (f) cleaning staff, but only in the presence of, and under close surveillance by, an official of the CIU.

• (a) Members of the European Parliament, officials of the European Parliament and other European Parliament employees working for political groups, duly identified for the purposes of consultation or creation of confidential information;

• (b) the European Parliament officials responsible for managing the CIS, officials of the secretariat of the parliamentary body/office-holder which received the information, and officials of the CIU;

• (c) where necessary, European Parliament officials responsible for security and fire safety;

• (d) cleaning staff, but only in the presence of, and under close surveillance by, an official working in the secretariat of the parliamentary body/office-holder or in the CIU, as the case may be.

Article 10

Consultation or creation of confidential information in secure facilities

Article 11

Minimum standards for consultation of confidential information at a meeting in camera outside secure facilities

• (a) only the persons designated by the chair of the competent committee or body to participate in the meeting are allowed to enter the meeting room;

• (b) all documents are numbered, distributed at the beginning of the meeting and collected again at the end, and no notes of those documents and no photocopies or photographs thereof are taken;

• (c) the minutes of the meeting make no mention of the content of the discussion of the information considered. Only the relevant decision, if any, may be recorded;

• (d) confidential information provided orally to recipients in the European Parliament is subject to a level of protection equivalent to that applied to confidential information in written form;

• (e) no additional stock of documents is held in meeting rooms;

• (f) copies of documents are distributed only in the requisite numbers to participants and interpreters at the start of the meeting;

• (g) the classification/marking status of the documents is made clear by the chair of the meeting at the start of the meeting;

• (h) participants do not remove documents from the meeting room;

• (i) all copies of documents are collected and accounted for at the end of the meeting by the secretariat of the parliamentary body/office-holder; and

• (j) no electronic communication devices or other electronic devices are taken into the meeting room where the confidential information in question is consulted or discussed.

Article 12

Archiving of confidential information

• (a) only those persons identified by name, by function or by office in the accompanying document drawn up when the confidential information was deposited shall be authorised to consult that information;

• (b) the application to consult confidential information shall be submitted to the CIU, which shall transfer the document in question to the Secure Reading Room; and

• (c) the procedures and conditions governing the consultation of confidential information set out in Article 10 shall apply.

Article 13

Downgrading, declassification and unmarking of confidential information

Article 14

Breaches of security, loss or compromise of confidential information

Article 15

Adaptation of this Decision and its implementing rules and annual reporting on the application of this Decision

Article 16

Transitional and final provisions

Article 17

Entry into force

This Decision shall enter into force on the day of its publication in the Official Journal of the European Union.

ANNEX I

Part 1

BASIC PRINCIPLES AND MINIMUM STANDARDS OF SECURITY FOR THE PROTECTION OF CONFIDENTIAL INFORMATION

1. INTRODUCTION

These provisions set out the basic principles and minimum standards of security for the protection of confidential information to be respected and/or complied with by the European Parliament in all its places of employment, including by all recipients of, classified information and ‘other confidential information’ so that security is safeguarded and all persons concerned may be assured that a common standard of protection is established. These provisions are supplemented by the security notices contained in Annex II and by other provisions governing the treatment of confidential information by parliamentary committees and other parliamentary bodies/office-holders.

2. BASIC PRINCIPLES

The European Parliament's security policy forms an integral part of its general internal management policy and is thus based on the principles governing that general policy. Those principles include legality, transparency, accountability, subsidiarity and proportionality.

Legality entails the need to remain strictly within the legal framework in the performance of security functions, and to conform to the applicable legal requirements. Furthermore, responsibilities in the field of security must be based on proper legal provisions. The provisions of the Staff Regulations, in particular Article 17 thereof on the obligation of staff to refrain from any unauthorised disclosure of information received in the line of duty and Title VI thereof on disciplinary measures, are fully applicable. Finally, breaches of security within the responsibility of the European Parliament shall be dealt with in a manner consistent with its Rules of Procedure and its policy on disciplinary measures.

Transparency entails the need for clarity regarding all security rules and provisions, for a balance between the different services and the different domains (physical security as compared to the protection of information, etc.), and for a consistent and structured security awareness policy. Moreover, clear written guidelines are necessary for the implementation of security measures.

Accountability means that responsibilities in the field of security must be clearly defined. Moreover, it entails the need regularly to monitor whether those responsibilities have been properly fulfilled.

Subsidiarity means that security must be organised at the lowest possible level and as closely as possible to the European Parliament's Directorates-General and services.

Proportionality means that security activities must be strictly limited to those which are absolutely necessary and that security measures must be proportional to the interests to be protected as well as to the actual or potential threat to those interests, so as to enable those interests to be defended in a manner ensuring the least possible disruption.

3. FOUNDATIONS OF INFORMATION SECURITY

The foundations of sound information security are:

• (a) proper communication and information systems (CIS). These fall within the responsibility of the European Parliament's Security Authority (as defined in security notice 1);

• (b) within the European Parliament, the Information Assurance Authority (as defined in security notice 1) responsible for working with the Security Authority to provide information and advice on technical threats to CIS and the means of protecting against those threats;

• (c) close cooperation between the European Parliament's responsible services and the security services of the other Union institutions;

4. PRINCIPLES OF INFORMATION SECURITY

4.1.   Objectives

The principle objectives of information security are as follows:

• (a) to safeguard confidential information against espionage, compromise or unauthorised disclosure;

• (b) to safeguard classified information handled in communications and information systems and networks against threats to its confidentiality, integrity and availability;

• (c) to safeguard European Parliament premises housing classified information against sabotage and malicious wilful damage;

• (d) in the event of a security failure, to assess the damage caused, limit the consequences, conduct security investigations and adopt any necessary remedial measures.

4.2.   Classification

• 4.2.1. Where confidentiality is concerned, care and experience are needed in the selection of the information and material to be protected as well as in assessing the degree of protection required. It is essential that the degree of protection should correspond to the sensitivity, in terms of security, of the individual item of information or material to be safeguarded. In order to ensure the smooth flow of information, both over-classification and under-classification shall be avoided.

• 4.2.2. The classification system is the instrument for putting into effect the principles set out in this section. A similar classification system shall be followed in planning and organising ways to counter espionage, sabotage, terrorism and other threats, in order to ensure maximum protection for the most important premises housing classified information and the most sensitive points within those premises.

• 4.2.3. Responsibility for classifying information lies solely with the originator of the information concerned.

• 4.2.4. The level of classification may be based solely on the content of the information concerned.

• 4.2.5. Where several items of information are grouped together, their classification shall be at least as high as the highest classification level assigned to one of its individual items. However, a collection of information may be assigned a higher classification than its constituent parts.

• 4.2.6. Classifications shall be assigned only when necessary and for as long as necessary.

4.3.   Aims of security measures

The security measures shall:

• (a) extend to all persons having access to classified information, media carrying classified information and ‘other confidential information’, as well as all premises containing such information and important installations;

• (b) be designed in such a way as to identify persons whose position (in terms of access, relationships or otherwise) might jeopardise the security of such information and of important installations housing such information, and provide for their exclusion or removal;

• (c) prevent unauthorised persons from having access to such information or to installations containing it;

• (d) ensure that such information is disseminated solely on the basis of the need-to-know principle, which is fundamental to all aspects of security;

• (e) ensure the integrity (by preventing corruption, unauthorised alteration or unauthorised deletion) and the availability (to those needing and authorised to have access thereto) of confidential information, especially where it is stored, processed or transmitted in electromagnetic form.

5. COMMON MINIMUM STANDARDS

The European Parliament shall ensure that common minimum standards of security are observed by all recipients of classified information, both inside the institution and under its competence, namely all its services and contractors, so that such information can be passed on in the confidence that it will be handled with equal care. Such minimum standards shall include criteria for the security clearance of officials of the European Parliament and other Parliament employees working for political groups, and procedures for the protection of confidential information.

The European Parliament shall allow third parties access to such information only when such third parties guarantee that it is handled in accordance with provisions that are at least strictly equivalent to these common minimum standards.

Such common minimum standards shall also be applied when, pursuant to a contract or grant, the European Parliament entrusts to industrial or other entities tasks involving confidential information.

6. SECURITY AS REGARDS OFFICIALS OF THE EUROPEAN PARLIAMENT AND OTHER PARLIAMENT EMPLOYEES WORKING FOR POLITICAL GROUPS

6.1.   Security instructions as regards officials of the European Parliament and other Parliament employees working for political groups

Officials of the European Parliament and other Parliament employees working for political groups in positions where they could have access to classified information shall be given thorough instructions, both on taking up their duties and at regular intervals thereafter, on the need for security and the procedures involved. Such persons shall be required to confirm in writing that they have read and fully understand the applicable security provisions.

6.2.   Management responsibilities

It must be part of the duties of managers to know which of their staff are engaged in work on classified information or have access to secure communication or information systems, and to record and report any incidents or apparent vulnerabilities which are likely to affect security.

6.3.   Security status of officials of the European Parliament and other Parliament employees working for political groups

Procedures shall be established to ensure that, when adverse information becomes known concerning an official of the European Parliament or other Parliament employee working for a political group, steps are taken to determine whether that individual's work brings him or her into contact with classified information or whether he or she has access to secure communication or information systems, and that the European Parliament's responsible service is informed. If the competent National Security Authority indicates that such an individual constitutes a security risk, he or she shall be barred or removed from assignments where he or she might endanger security.

7. PHYSICAL SECURITY

‘Physical security’ means the application of physical and technical protective measures to prevent unauthorised access to classified information.

7.1.   Need for protection

The degree of physical security measures to be applied to ensure the protection of classified information shall be proportionate to the classification and volume of, and the threat to, the information and material held. All holders of classified information shall follow uniform practices regarding classification of such information and must meet common standards of protection regarding the custody, transmission and disposal of information and material requiring protection.

7.2.   Checking

Before leaving areas containing classified information unattended, persons having custody thereof shall ensure that it is securely stored and that all security devices have been activated (locks, alarms, etc.). Further independent checks shall be carried out after working hours.

7.3.   Security of buildings

Buildings housing classified information or secure communication and information systems shall be protected against unauthorised access.

The nature of the protection afforded to classified information, e.g. barring of windows, locks for doors, guards at entrances, automated access control systems, security checks and patrols, alarm systems, intrusion detection systems and guard dogs, shall depend on:

• (a) the classification, volume and location within the building of the information and material to be protected;

• (b) the quality of the security containers for the information and material concerned; and

• (c) the physical nature and location of the building.

The nature of the protection afforded to communication and information systems shall depend on an assessment of the value of the assets at stake and of the potential damage if security were to be compromised, on the physical nature and location of the building in which the system is housed, and on the location of that system within the building.

7.4.   Contingency plans

Detailed plans shall be in place in advance to ensure the protection of classified information in the event of an emergency.

8. SECURITY DESIGNATORS, MARKINGS, AFFIXING AND CLASSIFICATION MANAGEMENT

8.1.   Security designators

No classifications other than those defined in point (d) of Article 2 of this Decision are permitted.

An agreed security designator may be used to set limits to the validity of a classification (for classified information signifying automatic downgrading or declassification).

Security designators shall only be used in combination with a classification.

Security designators are further regulated in security notice 2 and defined in the handling instructions.

8.2.   Markings

A marking is used to specify predefined specific instructions about the handling of confidential information. Markings may also indicate the field covered by a given document, a particular distribution on a need-to-know basis, or (for non-classified information) to signify the end of an embargo.

A marking is not a classification and shall not be used in lieu of one.

Markings are further regulated in security notice 2 and defined in the handling instructions.

8.3.   Affixing of classifications and of security designators

Affixing of classifications and security designators and markings shall be done in accordance with security notice 2, section E, and the handling instructions.

8.4.   Classification management

8.4.1   General

Information shall be classified only when necessary. The classification shall be clearly and correctly indicated, and shall be maintained only as long as the information requires protection.

The responsibility for classifying information and for any subsequent downgrading or declassification rests solely with the originator.

Officials of the European Parliament shall classify, downgrade or declassify information on instructions from, or pursuant to a delegation from, the Secretary-General.

The detailed procedures for the treatment of classified documents shall be so framed as to ensure that they are afforded protection appropriate to the information which they contain.

The number of persons authorised to originate information classified at the level TRÈS SECRET UE/EU TOP SECRET' shall be kept to a minimum, and their names shall be recorded on a list drawn up by the CIU.

8.4.2   Application of classification

The classification of a document shall be determined by the level of sensitivity of its contents in accordance with the definitions contained in point (d) of Article 2. It is important that classifications be assigned correctly and used sparingly.

The classification of a letter or note containing enclosures shall be at least as high as the highest classification assigned to one of its enclosures. The originator shall indicate clearly the level at which the letter or note should be classified when detached from its enclosures.

The originator of a document that is to be given a classification shall follow the rules set out above and shall avoid over-classification or under-classification.

Individual pages, paragraphs, sections, annexes, appendices, attachments and enclosures of a given document may require different classifications and shall be classified accordingly. The classification of the document as a whole shall be that of its most highly classified part.

9. INSPECTIONS

Periodic internal inspections of security arrangements for the protection of classified information shall be carried out by the European Parliament's Directorate for Security and Risk Assessment, which may request assistance from the Security Authorities of the Council or of the Commission.

The Security Authorities and competent services of the Union Institutions may carry out, as part of an agreed process initiated by either side, peer evaluations of the security arrangements for the protection of classified information exchanged under the relevant interinstitutional agreements.

10. DECLASSIFICATION AND UNMARKING PROCEDURES

• 10.1. The CIU shall examine confidential information contained in its Register and seek the consent of the originator to the declassification or unmarking of a document by no later than the 25th anniversary of its creation. Documents not declassified or unmarked at the first examination shall be re-examined periodically and at least every five years. In addition to being applied to documents actually located in the secure archives in the Secure Area and duly classified, the unmarking process may also cover other confidential information held either in the parliamentary body/officeor in the service in charge of the Parliament's historical archives.

• 10.2 The decision with regard to the declassification or unmarking of a document shall, as a general rule, be taken solely by the originator or, exceptionally, in cooperation with the parliamentary body/office-holder of such information, before the information which it contains is transferred to the service in charge of the Parliament's historical archives. Classified information may only be declassified or unmarked with the prior written consent of the originator. In the case of ‘other confidential information’, the secretariat of the parliamentary body/office-holder of such information shall, in cooperation with the originator, decide whether the document can be unmarked.

• 10.3. On behalf of the originator, the CIU shall be responsible for informing the addressees of the document of the change to the classification or marking, and they in turn shall be responsible for informing any subsequent addressees to whom they have sent or copied the document.

• 10.4. Declassification shall not affect any security designators or markings which may appear on the document.

• 10.5. In the case of declassification, the original classification at the top and bottom of every page shall be crossed out. The first (cover) page of the document shall be stamped and completed with the reference of the CIU. In the case of unmarking, the original marking at the top of every page shall be crossed out.

• 10.6. The text of the declassified or unmarked document shall be attached to the electronic fiche or equivalent system where it has been registered.

• 10.7. In the case of documents covered by the exception relating to privacy and the integrity of the individual or commercial interests of a natural or legal person, and in the case of sensitive documents, Article 2 of Regulation (EEC, Euratom) No 354/83 shall apply.

• 10.8. In addition to the provisions of points 10.1 to 10.7, the following rules shall apply:

• (a) as regards third-party documents, the CIU shall consult the third party concerned before proceeding to carry out the declassification or unmarking;

• (b) as regards the exception relating to privacy and the integrity of the individual, the declassification or unmarking procedure shall take into account, in particular, the agreement of the person concerned or, as the case may be, the impossibility of identifying the person concerned;

• (c) as regards the exception relating to commercial interests of a natural or legal person, the person concerned may be notified via publication in the Official Journal of the European Union and given four weeks from the date of that publication in which to submit remarks.

Part 2

SECURITY CLEARANCE PROCEDURE

11. SECURITY CLEARANCE PROCEDURE FOR MEMBERS OF THE EUROPEAN PARLIAMENT

• 11.1. In order to have access to information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL or its equivalent, Members of the European Parliament shall have been authorised either in accordance with the procedure referred to in points 11.3 and 11.4 of this Annex or on the basis of a solemn declaration of non-disclosure pursuant to Article 3(4) of this Decision.

• 11.2 In order to have access to information classified at the level SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET or its equivalent, Members of the European Parliament shall have been authorised in accordance with the procedure referred to in points 11.3 and 11.14.

• 11.3. Authorisation shall be granted only to Members of the European Parliament who have undergone security screening by the competent national authorities of the Member States in accordance with the procedure referred to in points 11.9 to 11.14. The President shall be responsible for granting the authorisation for Members.

• 11.4 The President may grant written authorisation after obtaining the opinion of the competent national authorities of the Member States on the basis of security screening carried out in accordance with points 11.8 to 11.13.

• 11.5. The European Parliament's Directorate for Security and Risk Assessment shall maintain an up-to-date list of all Members of the European Parliament who have been granted authorisation, including provisional authorisation within the meaning of point 11.15.

• 11.6. Authorisation shall be valid for a period of five years or for the duration of the tasks in respect of which it was granted, whichever is the shorter. It may be renewed in accordance with the procedure laid down in point 11.4.

• 11.7. Authorisation shall be withdrawn by the President where he/she considers that there are justified grounds for such withdrawal. Any decision to withdraw authorisation shall be notified to the Member of the European Parliament concerned, who may ask to be heard by the President before the withdrawal takes effect, and to the competent national authority.

• 11.8. Security screening shall be carried out with the assistance of the Member of the European Parliament concerned and at the request of the President. The competent national authority for screening shall be that of the Member State of which the Member concerned is a national.

• 11.9. As part of the screening procedure, the Member of the European Parliament concerned shall be required to complete a personal information form.

• 11.10. The President shall specify in his/her request to the competent national authority the level of classified information to be made available to the Member of the European Parliament concerned, so that it may carry out the screening process.

• 11.11 The entire security-screening process carried out by the competent national authority, together with the results obtained, shall be in accordance with the relevant rules and regulations in force in the Member State concerned, including those concerning appeals.

• 11.12. Where the competent national authority gives a positive opinion, the President may grant the Member of the European Parliament concerned authorisation.

• 11.13. A negative opinion by the competent national authority shall be notified to the Member of the European Parliament concerned, who may ask to be heard by the President. Should he/she consider it necessary, the President may ask the competent national authority for further clarification. If the negative opinion is confirmed, authorisation shall not be granted.

• 11.14. All Members of the European Parliament who are granted authorisation within the meaning of point 11.3 shall, at the time when the authorisation is granted and at regular intervals thereafter, receive any necessary guidelines concerning the protection of classified information and the means of ensuring such protection. Such Members shall sign a declaration acknowledging receipt of those guidelines.

• 11.15. In exceptional circumstances, the President may, after notifying the competent national authority and provided that no reaction is received from that authority within one month, grant provisional authorisation to a Member of the European Parliament for a period not exceeding six months, pending the outcome of the screening referred to in point 11.11. Provisional authorisations thus granted shall not give access to information classified at the level TRÈS SECRET UE/EU TOP SECRET or its equivalent.

12. SECURITY CLEARANCE PROCEDURE FOR OFFICIALS OF THE EUROPEAN PARLIAMENT AND OTHER PARLIAMENT EMPLOYEES WORKING FOR POLITICAL GROUPS

• 12.1. Only officials of the European Parliament and other Parliament employees working for political groups who, by reason of their duties and the requirements of the service, need to have knowledge of, or to use, classified information may have access thereto.

• 12.2. In order to have access to information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET, or TRÈS SECRET UE/EU TOP SECRET, or its equivalent, the officials of the European Parliament and other Parliament employees working for political groups concerned shall have been authorised in accordance with the procedure laid down in points 12.3 and 12.4.

• 12.3. Authorisation shall be granted only to the persons referred to in point 12.1 who have undergone security screening by the competent national authorities of the Member States in accordance with the procedure referred to in points 12.9 to 12.14. The Secretary-General shall be responsible for granting the authorisation for officials of the European Parliament and other Parliament employees working for political groups.

• 12.4 The Secretary-General may grant written authorisation after obtaining the opinion of the competent national authorities of the Member States on the basis of security screening carried out in accordance with points 12.8 to 12.13.

• 12.5. The European Parliament's Directorate for Security and Risk Assessment shall maintain an up-to-date list of all posts requiring a security clearance, as provided by the relevant European Parliament services, and of all persons who have been granted authorisation, including provisional authorisation within the meaning of point 12.15.

• 12.6. Authorisation shall be valid for a period of five years or for the duration of the tasks in respect of which it was granted, whichever is the shorter. It may be renewed in accordance with the procedure referred to in point 12.4.

• 12.7. Authorisation shall be withdrawn by the Secretary-General where he/she considers that there are justifiable grounds for such withdrawal. Any decision to withdraw authorisation shall be notified to the official of the European Parliament or other Parliament employee working for a political group concerned, who may ask to be heard by the Secretary-General before the withdrawal takes effect, and to the competent national authority.

• 12.8. Security screening shall be carried out with the assistance of the official of the European Parliament or other Parliament employee working for political groups concerned and at the request of the Secretary-General. The competent national authority for screening shall be that of the Member State of which the person concerned is a national. Where permissible under national laws and regulations, the competent national authorities may conduct investigations in respect of non-nationals who require access to information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET.

• 12.9. As part of the screening procedure, the official of the European Parliament or other Parliament employee working for a political group concerned shall be required to complete a personal information form.

• 12.10. The Secretary-General shall specify in his/her request to the competent national authority the level of classified information to be made available to the official of the European Parliament or other Parliament employee working for political groups concerned, so that it may carry out the screening process and give its opinion as to the level of authorisation appropriate to be granted to that person.

• 12.11. The entire security-screening process carried out by the competent national authority, together with the results obtained, shall be in accordance with the relevant rules and regulations in force in the Member State concerned, including those concerning appeals.

• 12.12. Where the competent national authority gives a positive opinion, the Secretary-General may grant the official of the European Parliament or other Parliament employee working for political groups concerned authorisation.

• 12.13. A negative opinion by the competent national authority shall be notified to the official of the European Parliament or other Parliament employee working for a political group concerned, who may ask to be heard by the Secretary-General. Should he/she consider it necessary, the Secretary-General may ask the competent national authority for further clarification. If the negative opinion is confirmed, authorisation shall not be granted.

• 12.14. All officials of the European Parliament and other Parliament employees working for political groups who are granted authorisation within the meaning of points 12.4 and 12.5 shall, at the time when the authorisation is granted and at regular intervals thereafter, receive any necessary instructions concerning the protection of classified information and the means of ensuring such protection. Such officials and employees shall sign a declaration acknowledging receipt of those instructions and give an undertaking to obey them.

• 12.15. In exceptional circumstances, the Secretary-General may, after notifying the competent national authority and provided that no reaction is received from that authority within one month, grant provisional authorisation to an official of the European Parliament or other Parliament employee working for a political group for a period not exceeding six months, pending the outcome of the screening referred to in point 12.11. Provisional authorisations thus granted shall not give access to information classified at the level TRÈS SECRET UE/EU TOP SECRET or its equivalent.

ANNEX II

INTRODUCTION

These provisions lay down the security notices governing and ensuring the secure treatment and management of confidential information by the European Parliament. Those security notices, together with the handling instructions, constitute the European Parliament's information security management system (ISMS) referred to in Article 3(2) of this Decision:

SECURITY NOTICE 1

The organisation of security in the European Parliament for the protection of confidential information

SECURITY NOTICE 2

Management of confidential information

SECURITY NOTICE 3

The processing of confidential information by means of automated communication information systems (CIS)

SECURITY NOTICE 4

Physical security

SECURITY NOTICE 5

Industrial security

SECURITY NOTICE 6

Breaches of security, loss or compromise of confidential information

SECURITY NOTICE 1

THE ORGANISATION OF SECURITY IN THE EUROPEAN PARLIAMENT FOR THE PROTECTION OF CONFIDENTIAL INFORMATION

• 1. The Secretary-General shall be responsible for the overall and consistent implementation of this Decision.

The Secretary-General shall take all necessary measures to ensure that, for the purposes of handling or storing confidential information, this Decision is applied in Parliament's premises, by Members of the European Parliament, by officials of the European Parliament, by other Parliament employees working for political groups and by contractors.

• 1. The Secretary-General is the Security Authority (SA). In this capacity, the Secretary-General shall be responsible for:

• 2.1. coordinating all matters of security relating to Parliament's activities in relation to the protection of confidential information;

• 2.2. approving the installation of a Secure Area, Secure Reading Rooms and secure equipment;

• 2.3. implementing decisions authorising, pursuant to Article 6 of this Decision, the transmission of classified information by Parliament to third parties;

• 2.4. investigating or ordering an investigation into any leakage of confidential information which prima facie has occurred within Parliament, in liaison with the President of the European Parliament, where a Member of the European Parliament is concerned;

• 2.5. maintaining close contact with the security authorities of other Union Institutions and with National Security Authorities in the Member States with a view to ensuring optimal coordination of security policy related to classified information;

• 2.6. keeping Parliament's security policy and procedures constantly under review and issuing appropriate recommendations resulting therefrom;

• 2.7. reporting to the National Security Authority (NSA) which has carried out the security screening procedure, in accordance with Annex I, Part 2, point 11.3, in cases involving any adverse information which may affect that authority.

• 1. Where a Member of the European Parliament is concerned, the Secretary-General shall discharge his/her responsibilities in close liaison with the President of the European Parliament.

• 1. In fulfilling his/her responsibilities under paragraphs 2 and 3, the Secretary-General shall be assisted by the Deputy Secretary-General, the Directorate for Security and Risk Assessment, the Directorate for Information Technologies (DIT) and the Classified Information Unit (CIU).

• 4.1. The Directorate for Security and Risk Assessment shall be responsible for personal protection measures and, in particular, for the security clearance procedure, as laid down in Annex I, Part 2. The Directorate for Security and Risk Assessment shall also:

• (a) be the point of contact for the security authorities of the other Union Institutions and for the NSAs, in matters relating to security clearance procedures for Members of the European Parliament, officials of the European Parliament and other Parliament employees working for political groups;

• (b) provide the necessary general security briefing on the obligation to protect classified information and on the consequences of any failure to do so;

• (c) monitor the operation of the Secure Area and the Secure Reading Rooms within Parliament's premises, in cooperation, where appropriate, with the security services of the other Union Institutions and the NSAs;

• (d) audit, in cooperation with the security authorities of the other Union Institutions and the NSAs, the procedures for the management and storage of classified information, the Secure Area and the Secure Reading Rooms within Parliament's premises where classified information is handled;

• (e) propose the appropriate handling instructions to the Secretary-General.

• 4.2. The DIT shall be responsible for handling of confidential information by secure IT systems at the European Parliament.

• 4.3. The CIU shall be responsible for:

• (a) identifying the security needs for the effective protection of confidential information, in close cooperation with the Directorate for Security and Risk Assessment and DITand with the Security Authorities of the other Union Institutions;

• (b) identifying all aspects of the management and storage of confidential information within Parliament, as laid down in the handling instructions;

• (c) the operation of the Secure Area;

• (d) the management or consultation of confidential information in the Secure Area or in the CIU's Secure Reading Room, in accordance with paragraghs (2) and (3) of Article 7 of this Decision;

• (e) the management of the CIU Register;

• (f) reporting to the SA any proven or suspected breach of security, loss or compromise relating to confidential information deposited at the CIU and held in the Secure Area or in the CIU Secure Reading Room.

• 1. Furthermore, the Secretary-General, as SA, shall appoint the following authorities:

• (a) a Security Accreditation Authority (SAA);

• (b) an Information Assurance Operational Authority (IAOA);

• (c) a Crypto Distribution Authority (CDA);

• (d) a TEMPEST Authority (TA);

• (e) an Information Assurance Authority (IAA).

The exercise of those functions does not require single organisational entities. They shall have separate mandates. However, those functions, and their accompanying responsibilities, may be combined or integrated in the same organisational entity or split into different organisational entities, provided that conflicts of interest and duplication of tasks are avoided.

• 1. The SAA shall advise on all security matters related to the accreditation of each information technology system and network within Parliament by:

• 6.1. ensuring that the CIS comply with the relevant security policies and security guidelines, providing a statement of approval for the handling by the CIS of classified information to a defined level of classification in its operational environment and stating the terms and conditions of the accreditation and the criteria under which re-approval is required;

• 6.2. setting up a security accreditation process, in accordance with the relevant policies, clearly stating the approval conditions for the CIS under its authority;

• 6.3. drawing up a security accreditation strategy which sets out the degree of detail for the accreditation process commensurate with the level of assurance required;

• 6.4. examining and approving security-related documentation, including risk management and residual risk statements, security implementation verification documentation and security operating procedures, and ensuring that it complies with Parliament's security rules and policies;

• 6.5. verifying the implementation of security measures in relation to the CIS by carrying out or sponsoring security assessments, inspections or reviews;

• 6.6. identifying security requirements (e.g. personnel clearance levels) for sensitive positions in relation to the CIS;

• 6.7. approving, or where relevant, participating in, the joint approval of the interconnection of a given CIS to other CIS;

• 6.8. approving the security standards of technical equipment envisaged for the secure handling and protection of classified information;

• 6.9. ensuring that cryptographic products used within Parliament are included in the list of EU approved products; and

• 6.10. consulting the system provider, the security actors and representatives of the users with respect to security risk management, in particular the residual risk, and the terms and conditions of the approval statement.

• 1. The IAOA shall be responsible for:

• 7.1. developing security documentation in line with security policies and security guidelines, in particular including the residual risk statement, the security operating procedures and the crypto plan within the CIS accreditation process;

• 7.2. participating in the selection and testing of the system-specific technical security measures, devices and software, in order to supervise their implementation and to ensure that they are securely installed, configured and maintained in accordance with the relevant security documentation;

• 7.3. monitoring the implementation and application of the security operating procedures and, where appropriate, delegating operational security responsibilities to the system owner, namely the CIU;

• 7.4. managing and handling cryptographic products, ensuring the custody of crypto items and controlled items and, if so required, ensuring the generation of cryptographic variables;

• 7.5. conducting security analysis reviews and tests, in particular for the purposes of producing the relevant risk reports, as required by the SAA;

• 7.6. providing CIS-specific information assurance training;

• 7.7. implementing and operating CIS-specific security measures.

• 1. The CDA shall be responsible for:

• 8.1. managing and accounting for EU crypto material;

• 8.2. ensuring, in close cooperation with the SAA, that appropriate procedures are enforced and that plans are in place for accounting, secure handling, storage and distribution of all EU crypto material; and

• 8.3. ensuring the transfer of EU crypto material to or from individuals or services using it.

• 1. The TA shall be responsible for ensuring compliance by the CIS with TEMPEST policies and handling instructions. It shall approve TEMPEST countermeasures for installations and products to protect classified information to a defined level of classification in its operational environment.

• 1. The IAA shall be responsible for all aspects of the management and handling of confidential information within Parliament and, in particular, for:

• 10.1 developing information assurance security and its security guidelines, and monitoring their effectiveness and pertinence;

• 10.2. safeguarding and administering technical information related to cryptographic products;

• 10.3. ensuring that information assurance measures selected for protecting classified information comply with the relevant policies governing their eligibility and selection;

• 10.4. ensuring that cryptographic products are selected in compliance with policies governing their eligibility and selection;

• 10.5. consulting with the system provider, the security actors and representatives of users with regard to information assurance security;

SECURITY NOTICE 2

MANAGEMENT OF CONFIDENTIAL INFORMATION

A. INTRODUCTION

• 1. This security notice sets out the provisions for the management by Parliament of confidential information.

• 1. When creating confidential information, the originator shall assess the level of confidentiality and take a decision based on the principles set out in this security notice as to the classification or marking of that information.

B. EUCI CLASSIFICATION