Appointment of the LSO
1. The LSO and deputy LSOs shall be officials or temporary agents.
2. All LSOs and deputy LSOs shall hold a valid security authorisation to access EUCI up to the level of SECRET UE/EU SECRET, and up to the level of TRES SECRET UE/EU TOP SECRET where necessary. The LSO or deputy LSO shall obtain the security authorisation before their appointment.
3. Commission Representations may request the CSA to grant an exception to the requirements set out in paragraphs 1 and 2.
Security operating procedures for Secured Areas
1. The LSO of the Commission department concerned shall draw up SecOPs for each Secured Area under their responsibility.
2. The LSO shall ensure that the SecOPs include the following requirements:
(a)
only staff members with a valid security authorisation and an established need to access documents classified as CONFIDENTIEL UE/EU CONFIDENTIAL or higher shall be permitted unescorted access to a Secured Area during office hours;
(b)
unescorted access to a Secured Area out of office hours shall only be granted to the LSO of the department, the RCO(s) of the Secured Area, their deputies, and authorised staff from the Security Directorate of the Directorate-General for Human Resources and Security;
(c)
recording and communication devices such as mobile phones, computers, cameras or other smart devices shall not be allowed inside Secured Areas without prior authorisation from the CSA; any derogation shall be requested from the CSA in advance; the LSO shall act as the point of contact;
(d)
all internal or external personnel who require access to a Secured Area but do not fulfil the criteria set out in point (a) above shall be escorted and supervised at all times by a duly authorised staff member; all such access to a Secured Area shall be recorded in a log book kept at the entrance to the Secured Area;
(e)
the LSO shall ensure that the intrusion detection systems monitoring a Secured Area are active and properly functioning at all times, and shall manage all related passwords, keys, PINs or other access and authentication mechanisms.
(f)
alarms in a Secured Area shall be reported to the Security Directorate of the Directorate-General for Human Resources and Security, which shall immediately notify the LSO;
(g)
the LSO of the department where the Secured Area is located shall keep a record of each intervention following an alarm or a security incident;
(h)
procedures shall be in place to cover the event of an alarm or other emergency situation inside the Secured Area, including evacuation of personnel and ensuring a rapid response from an emergency team under the authority of the CSA and external emergency services as necessary;
(i)
the LSO shall immediately report any breach of security that occurs inside or involving a Secured Area to the CSA in order to determine the appropriate response;
(j)
individual offices, rooms and safes within a Secured Area shall be kept locked whenever they are left unattended;
(k)
staff shall avoid discussing classified information in corridors or other common areas of the Secured Area when non-authorised individuals are in the vicinity.
Security keys and combinations
1. The LSO shall have overall responsibility for ensuring the proper handling and storage of keys and combinations used in or to access Secured Areas. Keys and combinations shall be stored in a security container and shall be protected to at least the same level as the material to which they give access.
2. The LSO shall maintain a register of security containers and strong rooms, together with an up-to-date list of all staff members who have unescorted access to them.
3. The LSO shall maintain a register of keys for security containers and strong rooms, including the staff members to whom they are allocated. A receipt shall be kept for each key that is issued, including the key identification, recipient, date and time.
4. Keys and combinations shall only be issued to staff who have a need to know and who have been granted the appropriate authorisation to access EUCI. The LSO shall retrieve any key when those conditions are no longer met.
5. The LSO shall keep spare keys and a written record of each combination setting in individual sealed, opaque, signed and dated envelopes to be provided by the staff member responsible for the keys. Those envelopes shall be kept in a security container that is rated for the highest classification of material that is stored in the relevant container or strong room.
6. If, upon a change of combination or key rotation, an envelope shows evidence of tampering or damage, the LSO shall treat that as a security incident and immediately inform the CSA.
7. Changes to the combination settings of security containers in Secured Areas shall be performed under the supervision of the LSO. Combinations shall be reset at least every 12 months and whenever:
(a)
a new container is received or a new lock is installed (in particular, default combinations shall be changed immediately);
(b)
a compromise is suspected or has occurred;
(c)
access is no longer required by a person possessing a combination.
8. The LSO shall keep a record of the dates of the combination changes referred to in paragraph 7.
EUCI emergency evacuation and destruction plans
1. The LSO shall assist the Head of Department in establishing emergency evacuation and destruction plans for EUCI, based on guidance provided by HR.DS.
2. The LSO shall ensure that any equipment necessary for the operation of the plans provided for in paragraph 1 is readily available and kept in good working order.
3. The LSO, together with the officials nominated in the plans provided for in paragraph 1, shall review the state of preparedness of the plans at least every 12 months and shall take any action necessary to update them.
Security authorisations
1. The LSO shall maintain a record of all posts within the department that require a Commission security authorisation and the staff occupying those posts. The requirement for a security authorisation must be specified in the vacancy notice during the recruitment process and notified to the candidate during the interview.
2. The LSO shall oversee all requests for security authorisations for access to EUCI. The LSO shall be the contact point within the department and shall liaise with the CSA for the security authorisations.
3. The LSO shall initiate the request to launch the security authorisation procedure in respect of the staff member concerned and shall ensure that the staff member returns the national security clearance questionnaire promptly to the CSA.
4. The LSO shall ensure that security cleared staff members in the department follow the mandatory EUCI briefing in order to obtain their security authorisation.
5. The LSO shall regularly liaise with the human resources service of the department for information on all changes to posts requiring a security authorisation and shall inform the CSA immediately of any such change.
6. The LSO shall inform the CSA of the arrival of a new staff member holding an existing security clearance to take up a post that requires a security authorised staff member.
7. The LSO shall ensure that staff members in the department complete the procedure to renew a security clearance by the required deadline. Any staff member who refuses to complete the procedure shall be obliged to transfer to a post that does not require a security authorised staff member.
EUCI registry
1. Where a department operates an EUCI registry, the LSO shall supervise the activities of the RCOs regarding the handling of EUCI and compliance with the security rules on protecting EUCI.
2. The LSO shall perform the following checks at least every 12 months and upon a change of an RCO or deputy RCO:
(a)
a check on a sample of documents in the EUCI registry to confirm their status and the accuracy of the classified documents register;
(b)
a check on a sample of receipts and transmission slips for the distribution of EUCI to and from the EUCI registry;
(c)
a check on a sample of destruction certificates.
3. On at least a monthly basis, the LSO shall perform spot checks on the classified documents register and on classified documents received recently to ensure that documents are being correctly registered.
4. All checks shall be recorded in the log of the classified documents register.
Other security responsibilities
The other security responsibilities of the LSO shall be set out in a security notice covering in particular the physical security of persons, premises and other assets, and information.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
