ANNEX VSupplementary provisions
ANNEX V INDUSTRIAL SECURITY I. INTRODUCTION 1. This Annex sets out provisions for implementing Article 11. It lays down general security provisions applicable to industrial or other entities in pre-contract negotiations and throughout the life-cycle of classified contracts let by the GSC. 2. The Council shall approve guidelines on industrial security outlining in particular detailed requirements regarding FSCs, Security Aspects Letters (SALs), visits, transmission and carriage of EUCI. II. SECURITY ELEMENTS IN A CLASSIFIED CONTRACT Security classification guide (SCG) 3. Prior to launching a call for tender or letting a classified contract, the GSC, as the contracting authority, shall determine the security classification of any information to be provided to bidders and contractors, as well as the security classification of any information to be created by the contractor. For that purpose, the GSC shall prepare an SCG to be used for the performance of the contract. 4. In order to determine the security classification of the various elements of a classified contract, the following principles shall apply: (a) in preparing an SCG, the GSC shall take into account all relevant security aspects, including the security classification assigned to information provided and approved to be used for the contract by the originator of the information; (b) the overall level of classification of the contract may not be lower than the highest classification of any of its elements; and (c) where relevant, the GSC shall liaise with the Member States’ NSAs/DSAs or any other competent security authority concerned in the event of any changes regarding the classification of information created by or provided to contractors in the performance of a contract and when making any subsequent changes to the SCG. Security aspects letter (SAL) 5. The contract-specific security requirements shall be described in a SAL. The SAL shall, where appropriate, contain the SCG and shall be an integral part of a classified contract or sub-contract. 6. The SAL shall contain the provisions requiring the contractor and/or subcontractor to comply with the minimum standards laid down in this Decision. Non-compliance with these minimum standards may constitute sufficient grounds for the contract to be terminated. Programme/Project Security Instructions (PSI) 7. Depending on the scope of programmes or projects involving access to or handling or storage of EUCI, specific PSI may be prepared by the contracting authority designated to manage the programme or project. The PSI shall require the approval of the Member States’ NSAs/DSAs or any other competent security authority participating in the PSI and may contain additional security requirements. III. FACILITY SECURITY CLEARANCE (FSC) 8. An FSC shall be granted by the NSA or DSA or any other competent security authority of a Member State to indicate, in accordance with national laws and regulations, that an industrial or other entity can protect EUCI at the appropriate classification level (CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET) within its facilities. It shall be presented to the GSC, as the contracting authority, before a contractor or subcontractor or potential contractor or subcontractor may be provided with or granted access to EUCI. 9. When issuing an FSC, the relevant NSA or DSA shall, as a minimum: (a) evaluate the integrity of the industrial or other entity; (b) evaluate ownership, control, or the potential for undue influence that may be considered a security risk; (c) verify that the industrial or any other entity has established a security system at the facility which covers all appropriate security measures necessary for the protection of information or material classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET in accordance with the requirements laid down in this Decision; (d) verify that the personnel security status of management, owners and employees who are required to have access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET has been established in accordance with the requirements laid down in this Decision; and (e) verify that the industrial or any other entity has appointed a Facility Security Officer who is responsible to its management for enforcing the security obligations within such an entity. 10. Where relevant, the GSC, as the contracting authority, shall notify the appropriate NSA/DSA or any other competent security authority that an FSC is required in the pre-contractual stage or for performing the contract. An FSC or PSC shall be required in the pre-contractual stage where EUCI classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET has to be provided in the course of the bidding process. 11. The contracting authority shall not award a classified contract with a preferred bidder before having received confirmation from the NSA/DSA or any other competent security authority of the Member State in which the contractor or subcontractor concerned is registered that, where required, an appropriate FSC has been issued. 12. The NSA/DSA or any other competent security authority which has issued an FSC shall notify the GSC as contracting authority about changes affecting the FSC. In the case of a sub-contract, the NSA/DSA or any other competent security authority shall be informed accordingly. 13. Withdrawal of an FSC by the relevant NSA/DSA or any other competent security authority shall constitute sufficient grounds for the GSC, as the contracting authority, to terminate a classified contract or exclude a bidder from the competition. IV. CLASSIFIED CONTRACTS AND SUB-CONTRACTS 14. Where EUCI is provided to a bidder at the pre-contractual stage, the invitation to bid shall contain a provision obliging the bidder which fails to submit a bid or which is not selected to return all classified documents within a specified period of time. 15. Once a classified contract or sub-contract has been awarded, the GSC, as the contracting authority, shall notify the contractor’s or subcontractor’s NSA/DSA or any other competent security authority about the security provisions of the classified contract. 16. When such contracts are terminated, the GSC, as the contracting authority (and/or the NSA/DSA or any other competent security authority, as appropriate, in the case of a sub-contract) shall promptly notify the NSA/DSA or any other competent security authority of the Member State in which the contractor or subcontractor is registered. 17. As a general rule, the contractor or subcontractor shall be required to return to the contracting authority, upon termination of the classified contract or sub-contract, any EUCI held by it. 18. Specific provisions for the disposal of EUCI during the performance of the contract or upon its termination shall be laid down in the SAL. 19. Where the contractor or subcontractor is authorised to retain EUCI after termination of a contract, the minimum standards contained in this Decision shall continue to be complied with and the confidentiality of EUCI shall be protected by the contractor or subcontractor. 20. The conditions under which the contractor may subcontract shall be defined in the call for tender and in the contract. 21. A contractor shall obtain permission from the GSC, as the contracting authority, before sub-contracting any parts of a classified contract. No subcontract may be awarded to industrial or other entities registered in a non-EU Member State which has not concluded a security of information Agreement with the Union. 22. The contractor shall be responsible for ensuring that all sub-contracting activities are undertaken in accordance with the minimum standards laid down in this Decision and shall not provide EUCI to a subcontractor without the prior written consent of the contracting authority. 23. With regard to EUCI created or handled by the contractor or subcontractor, the rights incumbent on the originator shall be exercised by the contracting authority. V. VISITS IN CONNECTION WITH CLASSIFIED CONTRACTS 24. Where the GSC, contractors’ or subcontractors’ personnel require access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET in each other’s premises for the performance of a classified contract, visits shall be arranged in liaison with the NSAs/DSAs or any other competent security authority concerned. However, in the context of specific projects, the NSAs/DSAs may also agree on a procedure whereby such visits can be arranged directly. 25. All visitors shall hold an appropriate PSC and have a ‘need-to-know’ for access to the EUCI related to the GSC contract. 26. Visitors shall be given access only to EUCI related to the purpose of the visit. VI. TRANSMISSION AND CARRIAGE OF EUCI 27. With regard to the transmission of EUCI by electronic means, the relevant provisions of Article 10 and Annex IV shall apply. 28. With regard to the carriage of EUCI, the relevant provisions of Annex III shall apply, in accordance with national laws and regulations. 29. For the transport of classified material as freight, the following principles shall be applied when determining security arrangements: (a) security shall be assured at all stages during transportation from the point of origin to the final destination; (b) the degree of protection afforded to a consignment shall be determined by the highest classification level of material contained within it; (c) an FSC at the appropriate level shall be obtained for companies providing transportation. In such cases, personnel handling the consignment shall be security cleared in accordance with Annex I; (d) prior to any cross-border movement of material classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET, a transportation plan shall be drawn up by the consignor and approved by the NSA/DSAs or any other competent security authority concerned; (e) journeys shall be point to point to the extent possible, and shall be completed as quickly as circumstances permit; and (f) whenever possible, routes should be only through Member States. Routes through States other than Member States should only be undertaken when authorised by the NSA/DSA or any other competent security authority of the States of both the consignor and the consignee. VII. TRANSFER OF EUCI TO CONTRACTORS LOCATED IN THIRD STATES 30. EUCI shall be transferred to contractors and subcontractors located in third States in accordance with security measures agreed between the GSC, as the contracting authority, and the NSA/DSA of the concerned third State where the contractor is registered. VIII INFORMATION CLASSIFIED RESTREINT UE/EU RESTRICTED 31. In liaison, as appropriate, with the NSA/DSA of the Member State the GSC, as the contracting authority, shall be entitled to conduct inspections of contractors’/subcontractors’ facilities on the basis of contractual provisions in order to verify that the relevant security measures for the protection of EUCI at the level RESTREINT UE/EU RESTRICTED as required under the contract have been put in place. 32. To the extent necessary under national laws and regulations, NSAs/DSAs or any other competent security authority shall be notified by the GSC as the contracting authority of contracts or subcontracts containing information classified RESTREINT UE/EU RESTRICTED. 33. An FSC or a PSC for contractors or subcontractors and their personnel shall not be required for contracts let by the GSC containing information classified RESTREINT UE/EU RESTRICTED. 34. The GSC, as the contracting authority, shall examine the responses to invitations to tender for contracts which require access to information classified RESTREINT UE/EU RESTRICTED, notwithstanding any requirement relating to FSC or PSC which may exist under national laws and regulations. 35. The conditions under which the contractor may subcontract shall be in accordance with paragraph 21. 36. Where a contract involves handling information classified RESTREINT UE/EU RESTRICTED in a CIS operated by a contractor, the GSC as contracting authority shall ensure that the contract or any subcontract specifies the necessary technical and administrative requirements regarding accreditation of the CIS commensurate with the assessed risk, taking account of all relevant factors. The scope of accreditation of such CIS shall be agreed between the contracting authority and the relevant NSA/DSA.