Authentication scheme and access management
Article 3
1. With the exception of access to watchlist entries, which shall be accessed in accordance with Commission Implementing Decision laying down measures for the application of Regulation (EU) 2018/1240 of the European Parliament and of the Council as regards the technical specification of ETIAS watchlist and of the impact assessment tool ( 14 ) , data stored in the ETIAS Central System shall be accessed, by users from the ETIAS Central Unit, the ETIAS National Units and Europol, through the software referred to in Article 6(2), point (m), of Regulation (EU) 2018/1240 (‘the software’). 2. When developing the software, eu-LISA shall: (a) establish an authentication scheme to log-into the software; (b) make available standard permissions, roles and job profiles to the ETIAS Central Unit, ETIAS National Units and Europol. 3. The software shall provide the ETIAS Central Unit, ETIAS National Units and Europol with the technical means: (a) to create new roles and amend or erase existing ones; (b) to set up access credentials enabling the users to carry out data processing operations in accordance with assigned roles; (c) to regulate, within their organisations, the assignment and management of standard roles to users. 4. The roles created or amended by the ETIAS Central Unit, ETIAS National Units and Europol shall only be visible to the ETIAS Central Unit, the ETIAS National Unit or to Europol respectively. 5. The software shall prevent the assignment of incompatible roles to users. It shall ensure that users having several job profiles are able to use only one job profile at a time and are able to switch between job profiles without having to log out. 6. The ETIAS Central Unit, ETIAS National Units and Europol shall be responsible for assigning job profiles via the software to users within their organisation. Each job profile, role or permission may be assigned to several users within the same organisation. 7. Users may use pseudonyms. Those pseudonyms shall be traceable to the users’ official identities at national level or within Europol. 8. The authentication scheme, and the standard permissions, roles and job profiles referred to in paragraph 2 of this Article, and the prevention of the assignment of incompatible roles, as referred to in paragraph 5 of this Article, shall be part of the technical specifications provided for in Article 73(3) of Regulation (EU) 2018/1240.