Decision of the High Representative of the Union for Foreign Affairs and Security Policy of 19 June 2023 on the security rules for the European External Action Service 2023/C 263/04

Article 1

Purpose and scope

This Decision lays down the security rules for the European External Action Service (hereinafter ‘EEAS security rules’).

Pursuant to Article 10(1) of Council Decision 2010/427/EU, it shall apply to all EEAS staff and all staff in Union Delegations, regardless of their administrative status or origin, and it shall establish the general regulatory framework for managing effectively the risks to staff placed under the responsibility of the EEAS as referred to in Article 2, to EEAS premises, physical assets, information, and visitors.

Article 2

Definitions

For the purpose of this decision, the following definitions apply:

• (a) ‘EEAS staff’ means EEAS officials and other servants of the European Union, including personnel from the diplomatic services of the Member States employed as temporary agents, and seconded national experts, as defined in Article 6 (2) and (3) of Council Decision 2010/427/EU, respectively.

• (b) ‘Staff placed under the responsibility of the EEAS’ means the EEAS staff at Headquarters and in Union Delegations and all other staff in Union Delegations, regardless of their administrative status or origin, as well as, in the context of this decision, the High Representative and, as appropriate, other staff resident in EEAS Headquarters premises.

• (c) ‘Eligible dependants’ means the members of the family of the staff member placed under the responsibility of the EEAS in Union Delegations forming part of their respective household as notified to the Ministry for Foreign Affairs of the receiving State, and actually residing with him/her at the place of employment at the time of the country evacuation.

• (d) ‘EEAS premises’ means all EEAS establishments, including buildings, offices, rooms and other areas, as well as areas housing communication and information systems (including those handling EUCI), where the EEAS conducts permanent or temporary activities.

• (e) ‘EEAS security interests’ means the staff placed under the responsibility of the EEAS, EEAS premises, dependants, physical assets, including communication and information systems, information, and visitors.

• (f) ‘EUCI’ means any information or material designated by an EU security classification, the unauthorised disclosure of which could cause varying degrees of prejudice to the interests of the European Union or of one or more of the Member States.

• (g) ‘Union Delegation’ means delegations to third countries and international organisations and EU offices as referred to in Article 1(4) of Council Decision 2010/427/EU and in accordance with Article 5 of Council Decision 2010/427/EU.

Other definitions for the purpose of the present Decision are set out in the relevant Annexes and inAppendix A.

Article 3

Duty of care

It encompasses both security and safety components, including those resulting from emergency situations or crises, whatever their nature.

Article 4

Physical and infrastructure security

Article 5

Alert states and crisis situations

Article 6

The protection of classified information

Article 7

Security incidents, emergencies and crisis response

• — procedures for effectively supporting the decision-making process in relation to threats, security incidents and emergencies involving personnel, including decisions relating to the extraction or the suspension of a mission; and

• — a policy and procedures for personnel recovery - e.g. in the case of missing personnel or kidnap and hostage situations - taking into account the particular responsibilities of the Member States, of the EU Institutions and of the EEAS in this regard. The need for specific capabilities, within the management of such operations in this regard, shall be considered taking into account the resources that could be provided by the Member States.

Article 8

Security of communication and information systems

• (a) an Information Assurance Authority (IAA);

• (b) a TEMPEST Authority (TA);

• (c) a Crypto Approval Authority (CAA);

• (d) a Crypto Distribution Authority (CDA).

• (a) a Security Accreditation Authority (SAA);

• (b) an Information Assurance Operational Authority (IAOA).

Article 9

Security breaches and compromise of classified information

Article 10

Investigation of security incidents, breaches and/or compromises and corrective actions

• (a) in case of potential leakage, mishandling or compromise of EUCI, Euratom Classified Information or sensitive non-classified information;

• (b) to counter hostile intelligence service attacks against the EEAS and its staff;

• (c) to counter terrorist attacks against the EEAS and its staff;

• (d) in case of cyber-incidents;

• (e) in case of other incidents that affect or may affect general security at the EEAS, including suspected criminal offences;

Only staff authorised on the basis of a nominative mandate conferred on them by the EEAS Security Authority, given their current duties, may be entrusted with the power to conduct and coordinate security investigations in the EEAS.

Investigators may take appropriate actions to safeguard the trail of evidence in a manner that is proportionate to the seriousness of the matter under investigation.

Article 11

Security risk management

Article 12

Security awareness and training

Article 13

Organisation of security in the EEAS

Section 1.   General provisions

• (a) security measures are coordinated as necessary with the competent authorities of the Member States, the General Secretariat of the Council and the Commission, and, as appropriate, of third States or international organisations, on all security matters relevant for the EEAS’ activities, including on the nature of risks to the EEAS security interests and the means of protection against them;

• (b) security aspects are fully taken into account from the outset for all EEAS activities;

• (c) access to classified information is only granted to individuals who meet the conditions set out in Article 5 of Annex A;

• (d) appropriate measures are taken to manage the security clearance status of all staff placed under the responsibility of the EEAS and of EEAS contractors;

• (e) a registry system is established in order to ensure that information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above is handled in accordance with this Decision within the EEAS, and when released to EU Member States, EU Institutions, bodies or agencies or other authorised recipients. A separate record shall be kept of all EUCI released by the EEAS to third States or international organisations, and of all classified information received from third States or international organisations;

• (f) security inspections referred to in Article 16 are undertaken;

• (g) investigations are conducted into any actual or suspected breach of security, as well as into any actual or suspected compromise or loss of classified information held by or originated in the EEAS, and that the relevant security authorities are requested to assist in such investigations;

• (h) appropriate incident and consequence management plans and mechanisms are established, in order to provide a timely and effective response to security incidents;

• (i) appropriate measures are taken in the event of failure by individuals to comply with this Decision;

• (j) appropriate physical and organisational measures are in place for the protection of the EEAS security interests.

In this regard, the EEAS Security Authority:

• — sets the security category of the Union Delegations, in consultation with the Commission,

• — sets a crisis response mechanism and defines its tasks and responsibilities;

• — decides, after consulting the HR where appropriate, when Union Delegation staff should be evacuated if the security situation requires it,

• — decides on the measures to be applied for the protection of eligible dependants, when appropriate, taking into account arrangements with EU institutions as referred to in Article 3(3);

• — approves the crypto communication policy, in particular the programme of installation of cryptographic products and mechanism.

• (i) the Director General for Resource Management who is assisted by the Director for HQ security and EEAS information security,

• (ii) the Director of the Crisis Response Centre (CRC), and, as appropriate, by the Deputy Secretary-General for Peace, Security and Defence, in order to ensure consistency with security measures to be taken for CSDP missions and operations.

Whilst remaining responsible as mentioned above, each Head of Department/Division shall designate staff for a Departmental Security Coordinator function. The number of staff with such function shall be proportionate to the amount of EUCI handled by that Department/Division.

Departmental Security Coordinators shall, when and as appropriate, assist and support their Head of Department/Division in performing tasks related to security, such as:

• (a) developing any additional security requirements appropriate to the specific needs of the department/division in consultation with the Directorate responsible for HQ security and EEAS information security;

• (b) complement the periodic security briefings delivered by the Directorate responsible for HQ security and EEAS information security to the members of their Department/Division with information on additional security requirement as referred in point (a);

• (c) ensuring that the need-to-know principle is respected in their Department/Division;

• (d) maintaining up-to-date a list of safe codes and keys, where applicable;

• (e) ensuring, where applicable, that security procedures and security measures are up to date and effective;

• (f) reporting any breaches of security and/or compromise of EUCI both to their Director and to the Directorate responsible for HQ security and EEAS information security;

• (g) debriefing staff who cease to be employed by the EEAS;

• (h) providing regular reports through their hierarchy on Department/Division’s security matters;

• (i) liaising with the Directorate responsible for HQ security and EEAS information security on any security issues .

Any activity or issue that might have an impact on security shall be notified to the Directorate responsible for HQ security and EEAS information security in a timely manner.

Section 2.   Directorate responsible for HQ security and EEAS information security

• (a) Fulfil the duty of care responsibilities of the EEAS at the EEAS Headquarters, and be responsible for all security matters at the EEAS Headquarters, including with regard to Communication and Information Systems (CIS) and information security for Union Delegations;

• (b) manage, coordinate, supervise and/or implement all security measures in all EEAS Headquarters premises;

• (c) ensure coherence and consistency with this decision and with implementing provisions of any activity which may have an impact on protecting EEAS security interests;

• (d) support the activities of the EEAS Security Accreditation Authority by carrying out physical security assessments of the General Security Environment (GSE)/Local Security Environment (LSE) of communication and information systems handling EUCI, and of all EEAS premises to be authorised for handling and storing EUCI.

The Directorate responsible for HQ security and EEAS information security shall be assisted by the relevant services of the Member States, in accordance with Article 10(3) of Council Decision 2010/427/EU.

• (a) ensuring the overall protection of the EEAS security interests in the area of responsibility of the Directorate responsible for HQ security and EEAS information security;

• (b) drafting, reviewing and updating of the security rules, as well as co-ordinating security measures with the Director of the Crisis Response Centre (CRC), the competent authorities of the Member States and, as appropriate, the competent authorities of third States and international organisations linked to the EU by security agreements and/or arrangements;

• (c) being the principal adviser of the HR, of the EEAS Security Authority and of the Deputy Secretary-General for Peace Security and Defence on all matters related to security at the Headquarters, and to EEAS information security;

• (d) managing the security clearance status of all staff placed under the responsibility of the EEAS and of EEAS contractors;

• (e) chairing the EEAS Security Committee in National Security Authorities (NSA) formation, as set out in Article 15(1) of this Decision, upon instruction by the EEAS security authority, and supporting its proceedings;

• (f) liaising with any partners or authorities other than those under (b) above on security matters in the area of responsibility of the Directorate responsible for HQ security and EEAS information security;

• (g) prioritising and making proposals for the management of the budget for security in Headquarters and in Union Delegations, the latter in coordination with the Director of the Crisis Response Centre (CRC).

• (h) ensuring that security breaches and compromises referred to in Article 9 of this Decision are recorded and investigations are launched and undertaken where and when necessary;

• (i) meeting regularly, and whenever necessary, to discuss areas of common interest with the Director of Security of the General Secretariat of the Council and the Director of the Security Directorate of the Directorate General for Human Resources and Security of the Commission.

• — the National Security Authorities (NSAs) and/or the other competent security authorities of Member States, to elicit their assistance in regard to the information it needs to assess such dangers and threats as may face the EEAS, its staff, its activities, its assets and resources and its classified information at its usual place of business;

• — the competent security authorities of the third States with whom the EU has concluded a Security of Information Agreement, or on the territory of which the Union deploys a CSDP mission or operation; the Security Office of the General Secretariat of the Council and the Security Directorate of the Directorate General for Human Resources and Security of the Commission, and, where appropriate the security departments of the other EU institutions, bodies and agencies;

• — the security department of international organisations with whom the EU has concluded a Security of Information Agreement, and;

• — the Member States' NSAs, regarding any matter relating to the protection of EUCI, including Personnel Security Clearances (PSCs).

Section 3.   Directorate responsible for the Crisis Response Centre (CRC)

• (a) Fulfil the duty of care responsibilities of the EEAS in Union Delegations;

• (b) ensure the security of staff placed under the responsibility of the EEAS in the Union Delegations on daily basis, propose measures to be adopted in case of crisis to ensure the business continuity at the Union Delegations and implement the evacuation procedures in close coordination with the Coordination Division in the Directorate General for Resource Management;

• (c) manage, coordinate, supervise and/or implement all security measures in the EEAS premises within the Union Delegations;

• (d) ensure coherence and consistency with this Decision and with implementing provisions of any EEAS activity which may have an impact on the EEAS security interests in the area of responsibility of the CRC;

• (e) support the activities of the EEAS Security Accreditation Authority in carrying out the physical security assessments of the Union Delegations premises to be authorised for handling and storing EUCI;

• (a) ensuring the overall protection of the EEAS security interests in the area of responsibility of the Directorate responsible for the Crisis Response Centre (CRC);

• (b) coordinating security measures and procedures with the competent authorities of the Host States and, as appropriate, with relevant international organisations;

• (c) ensuring the activation and management of the EEAS Crisis Response Mechanism;

• (d) designing and managing EEAS’ deployability capability (Deployable Support Team, including the necessary equipment) and ensuring its readiness at all times;

• (e) being the principal adviser of the HR, of the EEAS Security Authority and of the Deputy Secretary-General for Peace Security and Defence on all matters related to the security of Union Delegations and on the response to crisis affecting them;

• (f) chairing the EEAS Security Committee in Ministers of Foreign Affairs (MFA) formation , as set out in Article 15(1) of this Decision, upon instruction by the EEAS Security Authority, and supporting its proceedings.

• (g) liaising with any partners or authorities other than those under (b) above on security matters, in the area of responsibility the Directorate responsible for the Crisis Response Centre (CRC);

• (h) contributing to prioritising and making proposals for the management of the budget for security in Union Delegations as coordinated by the Director for HQ security and EEAS information security.

• (i) ensuring that security breaches and compromises in the area of responsibility the Directorate responsible for the Crisis Response Centre (CRC) are notified to the Directorate responsible for HQ security and EEAS information security for appropriate follow up;

• — the relevant Departments in the Ministries of Foreign Affairs of the Member States;

• — to the extent necessary, the competent security authorities of the Host States on the territory of which the EU Delegations are established, regarding EEAS security interests;

• — the Security Office of the General Secretariat of the Council and the Security Directorate of the Directorate General for Human Resources and Security of the Commission, and, where appropriate the security departments of the other EU institutions, bodies and agencies, within its area of responsibility;

• — the security departments of international organisations, with a view to any useful co-ordination, within its area of responsibility.

Section 4.   Union Delegations

Under the guidance of the Crisis Response Centre (CRC) and in consultation with the competent authorities of the Host State when necessary, he/she shall take all reasonably practicable measures to ensure that appropriate physical and organisational measures are in place to fulfil his/her duty of care responsibilities.

The Head of Delegation shall draw up security procedures for the protection of the eligible dependants as defined in Article 2(c), when appropriate, taking into account any administrative arrangement, as referred to in Article 3(3).

The Head of Delegation shall report on all duty of care related issues within his/her remit to the Director of the Crisis Response Centre (CRC), and to the Director of the Directorate responsible for HQ security and EEAS information security regarding other security matters.

He/she shall be assisted by the Directorate responsible for the Crisis Response Centre (CRC), by the Union Delegation’s Security Management Team which is composed of staff exercising security tasks and functions, and by security staff where necessary. The Directorate responsible for HQ security and EEAS information security shall provide assistance within its area of responsibility.

The Union Delegation shall establish regular contacts and maintain close cooperation in security matters with Member States’ diplomatic missions.

• — establish, in coordination with the Crisis Response Centre (CRC), detailed Union Delegation security and contingency plans, on the basis of generic standard operating procedures;

• — operate an effective 24/7 system for managing security incidents and emergencies within the Union Delegation scope of operation;

• — ensure that all staff deployed in the Union Delegation are covered by insurance as required by the conditions in the area;

• — ensure that security is part of the Union Delegation induction training to be given to all staff deployed in the Union Delegation upon arriving in the Union Delegation; and

• — ensure that any recommendations made following security assessments are implemented, and provide written reports at regular intervals on their implementation to the Director of the Crisis Response Centre (CRC) and to the Director for HQ security and EEAS information security.

In particular, the following responsibilities may be delegated:

• — coordination of security functions in the Union Delegation;

• — liaising on security issues with competent authorities of the host State and the appropriate counterparts in the Member States embassies and diplomatic missions;

• — implementation of appropriate security management procedures related to the EEAS Security interests, including the protection of EUCI;

• — ensuring compliance with security rules and instructions;

• — briefing staff about the security rules that are applicable to them, and on the particular risks in the host State;

• — submitting requests to the Directorate responsible for HQ security and EEAS information security for security clearances and regarding those positions which require a Personnel Security Clearance (PSC); and

• — keeping the Head of Delegation, the Regional Security Officer (RSO) and the Directorate responsible for the Crisis Response Centre (CRC) continuously informed with regard to incidents or security related developments in the area which have a bearing on the protection of EEAS security interests.

In certain circumstances, where the prevailing security situation dictates, a dedicated RSO may be assigned to a specific Union Delegation as full time resident.

An RSO may be required to relocate to an area outside his/her present area of responsibility, including the Headquarters, or even take up a residential post according to the relevant security situation in any country, and as required by the Directorate responsible for the Crisis Response Centre (CRC).

Article 14

CSDP Operations and EU Special Representatives

The Director for HQ security and EEAS information security and the Director of the Crisis Response Centre (CRC) advise, within the respective areas of responsibility of their Directorates and where necessary, the Managing Director for the Common Security and Defence Policy (CSDP), the Director General of the EU Military Staff (EUMS), also in his/her capacity as Director of the Military Planning and Conduct Capability (MPCC), and the Managing Director for Civilian Planning and Conduct Capability (CPCC), on security aspects of the planning and conduct of CSDP missions and operations, and the EU Special Representatives on security aspects of their mandate, complementary to the specific provisions existing in this regard in the relevant policies adopted by the Council.

Article 15

The EEAS Security Committee

It shall be chaired by the EEAS Security Authority or a designated delegate, and shall meet as instructed by the Chair or at the request of any of its members. The Directorate responsible for HQ security and EEAS information security and the Directorate responsible for the Crisis Response Centre (CRC) shall, within their respective areas of responsibility, support the Chair in this function and provide administrative assistance, as necessary, to the Committee proceedings.

• — each Member State;

• — the Security Office of the General Secretariat of the Council;

• — the Security Directorate of the Directorate General for Human Resources and Security of the Commission.

A Member State delegation to the EEAS Security Committee may consist of members of:

• — the National Security Authority (NSA) and/or the Designated Security Authority (DSA),

• — the Departments in charge of security in the Ministries of Foreign Affairs (MFA).

In particular, without prejudice to paragraph 5 below, the EEAS Security Committee:

• (a) shall be consulted on:
• — security policies, guidelines, concepts or other methodology documents related to security, in particular as regards the protection of classified information and the measures to be taken in the event of a failure by EEAS staff to comply with the security rules;
• — technical security aspects which may influence the HR decision to submit a recommendation to the Council for the opening of negotiations for security of information agreements referred to in Article 10,1(a) of Annex A;
• — any amendments to this decision.

• (b) may be consulted or informed, as appropriate, on issues relating to the security of staff and assets within EEAS Headquarters and Union Delegations, without prejudice to Article 3(3);

• (c) shall be informed of any compromises or losses of EUCI occurred within the EEAS.

• — entering into negotiations of administrative arrangements as referred to in Article 10(1)(b) of Annex A;

• — releasing classified information in the exceptional circumstances referred to in Paragraphs 9, 11 and 12 of Annex A VI

• — assuming the information originator's responsibility in the circumstances referred to in Article 10(6), last sentence, of Annex A.

When a unanimous favourable opinion is required, this condition will be met when no objections are expressed by Member States delegations during the Committee proceedings.

• — The EEAS Security Committee shall meet at least twice a year. Additional meetings, either in its fully fledged configuration or in NSA/DSA or in MFA security format, can be arranged by the Chair or requested by the members of the Committee.

• — The EEAS Security Committee shall organise its activities in such a way that it can make recommendations on specific areas of security. It may establish other expert sub-areas as necessary. It shall draw up terms of reference for such expert sub-areas and receive reports from them on their activities.

• — The Directorate responsible for HQ security and EEAS information security and the Directorate responsible for the Crisis Response Centre (CRC) shall each be responsible for preparing items for discussion under their respective areas of responsibility. The Chair shall draw up the provisional agenda for each meeting. The members of the Committee may propose additional items for discussion.

Article 16

Security inspections

Where necessary, relevant security experts based in Member State Missions in the third States and/or representatives of the diplomatic security departments of the Member States may be invited to participate in the security inspection of the Union Delegation.

Article 17

Assessment visits

Assessment visits shall be arranged to ascertain the effectiveness of the security measures in place in a third State or international organisation for protecting EUCI exchanged under an administrative arrangement as referred to in Article 10(1)(b) of Annex A.

The Directorate responsible for HQ security and EEAS information security may designate contributing experts to participate in assessment visits to third States or international organisations with which the EU has concluded a Security of Information Agreement as referred to in Article 10(1)(a) of Annex A.

Article 18

Business continuity planning

The Directorate responsible for HQ security and EEAS information security and the Directorate responsible for the Crisis Response Centre (CRC) shall assist the EEAS Security Authority in managing the security-related aspects of EEAS business continuity processes as part of the overall Business Continuity Planning of the EEAS.

Article 19

Travel advice for missions outside the EU

The Directorate responsible for the Crisis Response Centre (CRC) shall ensure the availability of travel advice regarding missions of staff placed under the responsibility of the EEAS outside the EU, drawing upon the resources of all relevant services of the EEAS - in particular the INTCEN, the counter intelligence cell of the Directorate General for Resource Management, the geographical departments and the Union Delegations.

The Directorate responsible for the Crisis Response Centre (CRC) shall provide, on request, and drawing upon aforementioned resources, specific travel advice regarding missions by staff placed under the responsibility of the EEAS to third States presenting a high risk or an increased risk level.

Article 20

Health and Safety

The EEAS security rules complement the EEAS rules for the protection of health and safety, as adopted by the High Representative.

Article 21

Implementation and review

Article 22

Replacement of previous decisions

This decision shall repeal and replace the Decision ADMIN (2017)10 of the High Representative of the Union for Foreign Affairs and Security Policy of 19 September 2017 on the security rules for the European External Action Service ([^E0003]).

Article 23

Final provisions

This decision shall enter into force on the date of its signature.

It shall be published in the Official Journal of the European Union.

The EEAS Security Authority shall duly and timely inform all staff falling within the scope of this decision and its annexes, on the content, entry into force and any subsequent modifications thereof.

ANNEX A

PRINCIPLES AND STANDARDS FOR PROTECTING EUCI

Article 1

Purpose, scope and definitions

Article 2

Definition of EUCI, security classifications and markings

• (a) TRES SECRET UE/EU TOP SECRET: information and material the unauthorised disclosure of which could cause exceptionally grave prejudice to the essential interests of the European Union or of one or more of the Member States.

• (b) SECRET UE/EU SECRET: information and material the unauthorised disclosure of which could seriously harm the essential interests of the European Union or of one or more of the Member States.

• (c) CONFIDENTIEL UE/EU CONFIDENTIAL: information and material the unauthorised disclosure of which could harm the essential interests of the European Union or of one or more of the Member States.

• (d) RESTREINT UE/EU RESTRICTED: information and material the unauthorised disclosure of which could be disadvantageous to the interests of the European Union or of one or more of the Member States.

Article 3

Classification management

Article 4

Protection of classified information

The EEAS shall establish appropriate procedures to maintain accurate records as to the originator of the

• — classified information EEAS receives; and

• — source material included in classified information originated by the EEAS.

The EEAS Security Committee shall be informed of these procedures.

Article 5

Personnel security for handling EU classified information

• — a need-to-know;

• — for access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above, been security cleared to the relevant level, or are otherwise duly authorised by virtue of their functions in accordance with national laws and regulations; and

• — been briefed on their responsibilities.

Article 6

Physical security of EU classified information

Article 7

Management of classified information

• (a) as a general rule, EUCI shall be transmitted by electronic means protected by cryptographic products approved in accordance with Article 7(5) of this Decision and according to clearly defined Security Operational Procedures (SecOPs);

• (b) when the means referred to in point (a) are not used, EUCI shall be carried either:
• (i) on electronic media (e.g. USB sticks, CDs, hard drives) protected by cryptographic products approved in accordance with Article 8(5) of this Decision; or
• (ii) in all other cases, as prescribed by the EEAS Security Authority in accordance with the relevant protective measures laid down in Annex A III, Section V.

Article 8

Protection of EUCI handled in communication and information systems

• (a) an IA Authority (IAA);

• (b) a TEMPEST Authority (TA);

• (c) a Crypto Approval Authority (CAA);

• (d) a Crypto Distribution Authority (CDA).

• (a) a Security Accreditation Authority (SAA);

• (b) an IA Operational Authority (IAOA).

Article 9

Industrial security

Article 10

Exchange of classified information with third States and International Organisations

• (a) a security of information agreement between the EU and that third State or international organisation, concluded in accordance with Article 37 TEU and Article 218 TFEU, is in force; or

• (b) an administrative arrangement between the HR and the competent security authorities of that third State or international organisation, for the exchange of information classified, in principle, no higher than RESTREINT UE/EU RESTRICTED, concluded in accordance with the procedure set out in Article 15(5) of this Decision, has taken effect; or

• (c) a framework or ad-hoc participation agreement between the EU and that third State in the context of a CSDP crisis management operation, concluded in accordance with Article 37 TEU and Article 218 TFEU, is applicable, and the conditions set out in that instrument have been met. Exceptions to the general rule above are set out in Annex A VI, Section V.

Information exchanged on the basis of agreements referred to in paragraph 1(c) shall be limited to information concerning CSDP operations in which the third state in question participates on the basis of these agreements and in accordance with their provisions.

The EEAS shall seek the written consent of any entity which has provided classified information as source material for EUCI which the EEAS has originated, to establish that there are no objections to release.

If the originator of the classified information for which release is desired is not the EEAS, the EEAS shall first seek the originator’s written consent to release.

If, however, the EEAS cannot establish the originator, the EEAS security authority shall assume the originator’s responsibility after having obtained the unanimous favourable opinion of the Member States as represented in the EEAS Security Committee.

Article 11

Breaches of security and compromise of classified information

• (a) safeguard evidence;

• (b) ensure that the case is investigated by personnel not immediately concerned with the breach or compromise in order to establish the facts;

• (c) immediately inform the originator or any other entity concerned;

• (d) take appropriate measures to prevent a recurrence;

• (e) assess the potential damage caused to the interests of the EU or of the Member States; and

• (f) notify the appropriate authorities of the effects of the actual or suspected compromise and of the action taken.

Any individual who is responsible for the compromise or loss of classified information shall be liable to disciplinary and/or legal action in accordance with the applicable laws, rules and regulations.

ANNEX A I

PERSONNEL SECURITY

I. INTRODUCTION

• 1.This Annex sets out provisions for implementing Article 5 of Annex A. It lays down in particular the criteria that the EEAS shall apply for determining whether an individual, taking into account his loyalty, trustworthiness and reliability, may be authorised to have access to EUCI, and the investigative and administrative procedures to be followed to that effect.

• 2.The ‘Personnel Security Clearance’ (PSC) for access to EUCI is a statement by a competent authority of a Member State which is made following completion of a security investigation conducted by the competent authorities of a Member State and which certifies that an individual may, provided his ‘need-to-know’ has been determined, be granted access to EUCI up to a specified level (CONFIDENTIEL UE/EU CONFIDENTIAL or above) until a specified date; the individual thus described is said to be ‘security cleared’.

• 3.The ‘Personnel Security Clearance Certificate’ (PSCC) is a certificate issued by the EEAS Security authority establishing that an individual is security cleared, and which shows the level of EUCI to which that individual may be granted access, the date of validity of the relevant PSC and the date of the expiry of the certificate itself.

• 4.The ‘Authorisation to access EUCI’ is an authorisation by the EEAS Security Authority which is taken in accordance with this Decision after a PSC has been issued by the competent authorities of a Member State, and which certifies that an individual may, provided his ‘need-to-know’ has been determined, be granted access to EUCI up to a specified level (CONFIDENTIEL UE/EU CONFIDENTIAL or above) until a specified date; the individual thus described is said to be ‘security cleared’.

II.   AUTHORISING ACCESS TO EUCI

• 5.Access to information classified RESTREINT UE/EU RESTRICTED does not require a security clearance and is granted after:

• (a) the individual's statutory or contractual link to the EEAS has been established,

• (b) the individual's need-to-know has been determined,

• (c) he has been briefed on the security rules and procedures for protecting EUCI and has acknowledged in writing his responsibilities to protect EUCI in accordance with this Decision.

• 6.An individual shall only be authorised to access information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above after:

• (a) the individual's statutory or contractual link to the EEAS has been established;

• (b) his need-to-know has been determined;

• (c) he has been granted a PSC to the relevant level or is otherwise duly authorised by virtue of his functions in accordance with national laws and regulations; and

• (d) he has been briefed on the security rules and procedures for protecting EUCI and has acknowledged in writing his responsibilities with regard to protecting such information.

• 7.EEAS shall identify the positions in its structures which require access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or above and therefore require a PSC to the relevant level, as referred to in paragraph 4 above.

• 8.EEAS Staff shall declare whether they hold the citizenship of more than one country.

PSC request procedures in the EEAS