ANNEX XIISupplementary provisions
ANNEX XII SECURE AND CONFIDENTIAL TREATMENT OF ELECTRONIC REPORTS AND MESSAGES A. Minimum security requirements: (a) System access control: The system shall withstand a break-in attempt from unauthorised persons; (b) Authenticity and data access control: The system shall be able to limit the access of authorised parties to a predefined set of data only; (c) Communication security: It shall be guaranteed that the reports and messages are securely communicated; (d) Data security: It shall be guaranteed that all reports and messages that enter the system are securely stored for the required time and that they will not be tampered with; (e) Security procedures: Security procedures shall be designed addressing access to the system (both hardware and software), system administration and maintenance, backup and general usage of the system. B. Minimum requirements to be met for the computer system: (a) A stringent password and authentication system. Each user of the system shall be assigned a unique user identification and associated password. Each time the user logs on to the system he/she shall provide the correct password. Even when successfully logged on the user shall have access only to those functions and data that he/she is configured to have access to. Only a privileged system administrator shall have access to all the data. (b) Physical access to the computer system shall be controlled. (c) Auditing; selective recording of events for analysis and detection of security breaches. (d) Time-based access control; access to the system can be specified in terms of times of day and days of week that each user is allowed to log in to the system. (e) Terminal access control; specifying for each workstation which users are allowed to access.