Security considerations
Article 5
1. The web portal shall be designed and implemented to ensure the confidentiality, integrity and availability of the services and to ensure non-repudiation of transactions, by applying at minimum the following application security principles: (a) defense in depth (layered security mechanisms); (b) positive security model (defines what is allowed and rejects everything else); (c) fail securely (handles errors securely); (d) run with least privilege; (e) keep security simple (avoid complex architectures when a simpler approach would be faster and simpler); (f) detect and prevent intrusions (logging and managing all security relevant information) by applying proactive controls on the protection of the web portal information and Member State contact details from cyber-attacks and information leakage; (g) do not trust infrastructure (the application needs to authenticate and authorise every action from surrounding systems); (h) do not trust services (all external systems shall not be trusted); (i) establish secure defaults (software and operating systems environments must be hardened according to best practices and industry standards). 2. The web portal shall also be designed and implemented to ensure the availability and integrity of logs recorded. 3. For security and data protection purposes, the web portal shall include a notice informing the users of the rules governing the usage of the web portal and of the consequences of providing incorrect information. The notice shall include an acceptance form of the rules governing the usage of the web portal that the user shall be required to submit before being allowed to use the web portal. The technical and organisational implementation of the web portal shall be compliant with the security plan, the business continuity plan and a disaster recovery plan referred to in Article 42(3) of Regulation (EU) 2019/818.