Subject matter and scope
1. The subject matter and scope of this Decision are provided in Article 1 of Decision (EU, Euratom) 2017/46.
2. The provisions in this Decision apply to all communication and information systems (CISs). However, the responsibilities defined in this Decision shall not apply to CISs handling EU classified information. The relevant responsibilities for these systems shall be determined by the system owner and the Commission Security Authority in line with Commission Decision (EU, Euratom) 2015/444 ( 3 ) .
3. Chapter 2 of this Decision presents an overview of the practical implementation of the organisation and responsibilities relating to IT security. Chapter 3 of this Decision presents an overview of the processes relating to Article 6 of Decision (EU, Euratom) 2017/46.
Definitions
The definitions in Article 2 of Decision (EU, Euratom) 2017/46 apply to this Decision. For the purposes of this Decision the following definitions shall also apply:
1.
‘Crypto Approval Authority’ (CAA) is a function assumed by the Commission Security Authority that falls under the authority of the Director-General for Human Resources and Security;
2.
‘External network connection’ means any electronic communications connection between the Commission's internal network and any other network, including the internet. This definition excludes third party networks that are provided under contract to be part of the Commission's internal network.
3.
‘Key escrow’ means a procedure for storing copies of cryptographic keys with one or more separate parties, ensuring the segregation of duties, to enable their recovery in case the operational copy is lost. Keys may be split into two or more parts, each of which is lodged with a different party to ensure that no single party possesses the entire key.
4.
‘RASCI’ is an abbreviation for a responsibility assignment based on the following attribution indicators:
(a)
‘responsible’ (R) means having the obligation to act and take decisions to achieve required outcomes;
(b)
‘accountable’ (A) means being answerable for actions, decisions and performance;
(c)
‘supports’ (S) means having the obligation to work with the person responsible to complete the task;
(d)
‘consulted’ (C) means being sought for advice or opinion;
(e)
‘informed’ (I) means being kept up to date with relevant information.
