SECURITY ASPECTS LETTER Lot N. 2

Transcription

1 SECURITY ASPECTS LETTER Lot N. 2 ANNEX IV.VI.B to Draft Framework Contract Participants: Page 1 of 12

2 Without Appendix X and X to Annex X to the contract XXXX NOT CLASSIFIED Table of Contents 1 Introduction 3 2 Background 3 3 Classification level 4 4 Security Instructions for Classified Information General Principles Release of contract information Security plan in event of termination International Visits Reporting and maintenance of security information Transmission of sensitive and/or classified information Encryption Transportation plans Security violations 8 5 Security-related notices or communication 9 6 Applicable documents 9 7 Reference documents 9 8 Appendix A: List of security cleared companies 10 9 Appendix B: Access to the 's premises Appendix C: Security Classification Guide (SCG) 12 Page 2 of 12 European GNSS Agency. Rue de la Loi, 56, B-1049 Brussels, Belgium. Telephone: (32-2) ,

3 1 Introduction This document is a Security Aspects Letter (SAL) issued by the as part of contract XXXX. It defines the security contractual conditions issued by the. These conditions form an integral part of the contract under which classified information shall be accessed or generated. This document identifies those elements of the contract which involve classified information which requires protection and identifies the essential security requirements. This SAL applies to any legal entity involved through this contract by contractual or pre-contractual activity. A lists of security cleared companies and sites involved in the contract are at Appendix A. For a list of security authorities and National Project Offices refer to AD 2 European GNSS PSI. This document includes a Security Classification Guide (SCG), distributed as appendix to this SAL, which describes the classified elements of the Contract and specifies the applicable security classification levels. The SGC for contract XXX is XXX (Standalone Galileo Security Classification Guide/supplement specific to contract XXX, Appendix X to the present SAL). The SCG may be amended throughout the life of the Contract and the elements it contains may be reclassified or downgraded. This document is intended to provide an overview of the essential security requirements that the contractor must implement. These security provisions which are based on the European GNSS PSI provide additional security requirements matching a specific contract. AD 2, the European GNSS PSI shall be considered as an applicable document for the present contract providing guidance for the European GNSS programmes on the interpretation and application of the security policies found in Commission Decision 2006/548 and more specifically in paragraph 27 which deals with the Common Minimum Standards on Industrial Security. In situations where provisions in national legislation and regulations differ from the provisions in this SAL, the provisions in national legislation and regulations may be applied provided that they are not less stringent than the provisions set out in this SAL. In all such cases the contractor shall inform the of the revised security procedures. The is responsible for the approval of this SAL and any future modifications. Comments or questions on the interpretation of this SAL should be directed to the or to the contractor s NSA/DSA. 2 Background Regulation (EU) No 912/ article 22, states "The Agency shall apply the security principles contained in Commission Decision 2001/844/EC, ECSC, Euratom ". The Commission's Common Minimum Standards on Industrial Security, RD 1 Commission Decision 2006/548, paragraph 27 states that all classified contracts must include a SAL and a SCG. 1 Regulation (EU) No 912/2010 of the European Parliament and of the Council of 22 September 2010 setting up the European GNSS Agency, repealing Council Regulation (EC) No 1321/2004 on the establishment of structures for the management of the European satellite radio navigation programmes and amending Regulation (EC) No 683/2008 of the European Parliament and of the Council (OJ L 276, 20.10, p 11) Page 3 of 12

4 3 Classification level Referring to article 27.2 (i) of Commission Decision 2001/844 (RD 1), the overall level of security classification of the contract is up to (XXX) as contractor s staff may access security areas accredited at the level (XXX) or access or provide information or material classified up to (XXX), some of them being possibly marked CRYPTO, while performing their tasks. 4 Security Instructions for Classified Information 4.1 General Principles - [REQ 1] The contractor and sub-contractor (if any) shall be registered in a European GNSS PSI Participant (EU Member States, Norway and Switzerland). Each contractor and sub-contractor (if any) for whom an access to the classified information provided by the ESA GalileoSat programme is required must further be registered in a Participant of the GalileoSat PSI. The participants to the GalileoSat Programme Security Instruction are Austria, Belgium, Denmark, Finland, France, Germany, Ireland, Italy, Luxembourg, The Netherlands, Norway, Portugal, Spain, Sweden, Switzerland, and the United Kingdom. - [REQ 2] 's personnel as well as subcontractors' personnel involved in work under this Contract shall be nationals of an European GNSS PSI Participant unless otherwise agreed in advance with the, and shall hold an appropriate valid PSC for accessing EU and, national classified information at the level of SECRET, should the need arise to access such national classified information. Whenever applicable they shall also be the holder of an appropriate CRYPTO authorisation. Whenever an access to the classified information provided by the ESA GalileoSat programme is required, they must further be nationals of a Participant of the GalileoSat PSI. - [REQ 3] The as well as subcontractors shall provide a list of those personnel in its offer including surname, first name, date of birth and nationality (including multiple nationalities). - [REQ 4] The documents referenced in section 6, Applicable Documents, in their latest version shall be applicable to the contractor and subcontractors and the security principles they contain shall govern the execution of the contract. The documents referenced in section 7, Reference Documents, in their latest version are additional guidance to the applicable documents. - [REQ 5] Information generated by the contractor or any subcontractor which requires classification shall be marked using the EU security classification markings and, if needed, a double marking detailed in the European GNSS PSI in accordance with the SCG at Appendix X. When required a CRYPTO or CCI marking shall be added in accordance with AD 3 Galileo COMSEC Security Instructions. - [REQ 6] When a doubt arises about the classification level of information generated under contractual activity, the contractor or subcontractor(s) involved shall ask the in writing about the classification level to adopt. While waiting for the reply of the, the information shall be classified SECRET UE and all parties shall handle it accordingly until the has decided on the actual classification level and communicated it in writing to the contractor and/or subcontractor(s). Page 4 of 12

5 - [REQ 7] The contractor shall handle and protect classified information or material provided to them or generated by the contractor pursuant to this Contract in accordance with its classification as described in AD 2, The European GNSS PSI or, provided they are no less stringent, in accordance with national regulations. - [REQ 8] If the contractor's responsible NSA/DSA identifies a failure by the contractor to observe the security provisions described and Regulations referred to under this SAL, it shall inform the. If this failure is of such a nature as to result in the withdrawal of the contractor's Facility Security Clearance (FSC) to handle classified documents as necessary for the execution of the Contract, the shall have the right to terminate the Contract with immediate effect in accordance with the relevant provisions of the General Terms and Conditions for Contracts awarded by the, without prejudice to criminal and civil proceedings against the contractor. - [REQ 9] If the responsible NSA/DSA has identified such a failure to comply with the relevant security Regulations by any subcontractor resulting in the withdrawal of the subcontractor's FSC, the shall be entitled to require the contractor to terminate the subcontract with immediate effect, without prejudice to the 's right to terminate the contract with immediate effect and/or to initiate criminal and/or civil proceedings against the subcontractor. - [REQ 10] For work performed on the 's premises, the contractor and its personnel shall comply with the security requirements as described in Appendix B: Access to the 's premises. - [REQ 11] For work performed on other locations than the and the contractor s premises, the contractor and its personnel shall comply with the local safety and security rules provided they are not less stringent than those of AD 2, the European GNSS PSI. - [REQ 12] The contractor shall not transmit any classified information or material to a subcontractor without the prior written consent of the originator and the. - [REQ 13] The ultimate responsibility for protecting classified information within industrial or other entities rests with the management of those entities. - [REQ 14] It may be necessary for the contractor to negotiate classified subcontracts with subcontractors at various levels. The contractor is responsible for ensuring that all subcontracting activities are undertaken in accordance with the common minimum standards contained in this SAL. The procedures for subcontracting in AD 2, The European GNSS PSI will be applied to all potential subcontracts. - [REQ 15] A Security Classification Guide (SCG) shall also be a part of each classified subcontract, describing the specific elements which are classified and specifying the applicable security classification levels. The provisions of both the SAL and SCG shall not be less stringent that the ones applicable to the prime contactor. - [REQ 16] Classified information released to the contractor or subcontractor or generated under contractual activity shall not be used for purposes other than those defined by the classified contract and shall not be disclosed to third parties without the prior written consent of the originator and of the. Page 5 of 12

6 - [REQ 17] All industrial or other entities participating in classified contracts which involve access to information classified CONFIDENTIEL UE or above shall hold a FSC. The FSC is granted by the NSA/DSA of the participating State in which it is located to confirm that a facility can afford and guarantee adequate security protection of classified information to the appropriate classification level. Questions regarding FSC s should be addressed to the participant's NSA/DSA, details of which can be found in AD 2, the European GNSS PSI. - [REQ 18] If changes to the security requirements emerge during the performance of the contract and if such changes significantly deviate from the initial arrangements, the contract shall be amended accordingly or terminated, as appropriate. - [REQ 19] Where changes of security requirements result in additional security measures to be taken or investments to be made by the contractor, a contract amendment shall be negotiated on a fair and reasonable basis. - [REQ 20] In case the contractor cannot comply with increased security requirements, the contract shall be terminated. However, any contract termination resulting from changes of the security requirements shall not be by default the responsibility of the contractor, and the contractor may be entitled to compensation by the. - [REQ 21] The NSA/DSA of the participant in which the contractor is registered shall be informed by the contractor and by the Security Department separately of the award of a classified contract. - [REQ 22] When a classified contract or a classified subcontract is terminated, the contractor and the Security Department shall notify separately this termination in less than one month to the NSA/DSA of the participants in which the contractor and subcontractors are registered. - [REQ 23] Throughout the life of the classified contract, compliance with all its security provisions shall be monitored by the, in conjunction with the relevant NSA/DSA. Any security incidents shall be reported, in accordance with the provisions laid down in the European GNSS PSI. Any change to or withdrawal of an FSC shall immediately be communicated to the Security Department. - [REQ 24] The contractor shall - under penalty of termination of the contract - comply with any security requirements prescribed by the Contracting Authority as detailed in this Security Aspects Letter. 4.2 Release of contract information The unilateral release of classified information or material used by or issued from the Contract to other than SAL participants' authorities and contractors is prohibited without the specific written approval of the originator of the information and the. Requests for release shall be handled in accordance with the procedures outlined in AD 2, The European GNSS PSI. The fact that any information related to the Contract is not marked with a security classification does not mean that it can be released to the public. Any release of information requires the written authorisation of the originator and the and shall be done according to the provisions of this section. Page 6 of 12

7 4.3 Security plan in event of termination In the event of the contract being terminated by either party, the procedures described in AD 2, The European GNSS PSI for the disposal of classified information shall be implemented. 4.4 International Visits Procedures for international visits contained in AD 2, The European GNSS PSI shall be applied to all visits necessary in the performance of this contract. The contractor and subcontractor if any are invited to make maximum use of recurrent and collective Requests For Visit (RFV s) when appropriate. 4.5 Reporting and maintenance of security information - [REQ 25] The contractor shall describe its security organisation in its bid and provide as well the details of the Contract Manager and the company Security Officer 2. - [REQ 26] The details of the Contract Manager and the company Security Officer will be published in the European GNSS PSI on behalf of the. - [REQ 27] Any subsequent changes shall be communicated in writing to the using NSA/DSA s channels within 30 days of their occurrence. 4.6 Transmission of sensitive and/or classified information - [REQ 28] The procedures for transmission of classified information contained in AD 2, The European GNSS PSI shall be applied to any transmission of classified information as a result of contractual activities. - [REQ 29] In addition to the prescriptions of AD 2, The European GNSS PSI, classified information, whenever stored on a digital media for transmission and whatever its classification level, will be encrypted. - [REQ 30] Any sensitive information related to the contract execution will preferably be encrypted before transmission. - [REQ 31] Details of transmission arrangements of classified information at the level CONFIDENTIEL UE or above are considered as sensitive and shall be encrypted when sent by e- mail. 4.7 Encryption 2 The main function of Local Security Officer is to monitor the correct implementation of security rules applicable to its organisation. In particular, he/she ensures a proper handling, processing, storage and destruction of national or EU classified information in line with applicable national or EU legislation. It means that this classified information has to be handled, processed, stored and destroyed in a facility to which a Facility Security Clearance (FSC) has been delivered by the National Security Authority (NSA) of the Member State on the territory of which the company is established. He/she is also ensuring that access to this classified information is only authorised to persons with demonstrated need to know and with valid Personnel Security Clearance (PSC) certificate delivered by the National Security Authority. Page 7 of 12

8 - [REQ 32] Unless otherwise agreed in writing, the tool Chiasmus for Windows developed by the BSI shall be used for encryption - [REQ 33] The shall ensure they are licensed by the BSI to use the tool. BSI s details: Bundesamt für Sicherheit in der Informationstechnik (BSI) Refereat Z5 / Vertrieb Postfach Bonn GERMANY Phone: or 212 Fax: vertrieb@bsi.bund.de - [REQ 34] All parties involved in contractual activities shall handle the encryption tool and the generated encrypted documents in accordance with the Security Operating Procedures (SecOPS) of the Authority providing the encryption tool or, provided they are not less stringent, in accordance with national regulations. 4.8 Transportation plans - [REQ 35] In addition to the requirements of AD 2, The European GNSS PSI and AD 3, Galileo COMSEC Security Instructions regarding transportation, the shall submit a transportation plan for any shipment of CCI and/or CRYPTO information or material even when the shipment occurs only within one country. - [REQ 36] In addition to the submission of the transportation plan to the appropriate NSA s or DSA s, the shall send at the same time a copy of the plan to the for information. - [REQ 37] For shipments within one country, the submission of the transportation plan to the NSA/DSA shall be in accordance with national rules but, in any case, a plan shall be established and sent to the at least 48 hours prior to the shipment. - [REQ 38] Transportation plans within the framework of this contract are considered sensitive and shall be encrypted when sent by or transmitted on a digital media. They shall be classified as appropriate. 4.9 Security violations - [REQ 39] Security violations shall be handled as prescribed in in AD 2, The European GNSS PSI. - [REQ 40] Reports of security violations shall be sent to the too. - [REQ 41] Reports of security violations shall be classified as appropriate and transmitted accordingly. Should the classification of the report be higher than RESTREINT UE (or equivalent), a sanitized report allowing a classification at the level RESTREINT UE of lower shall be established in order to allow a quick transmission of it using appropriate channels and tools. Page 8 of 12

9 5 Security-related notices or communication Any security-related notices or communication to the shall be addressed to "European GNSS Agency (), Security Department for the attention of the Local Security Officer, Rue de la Loi 56, B-1049 Brussels Belgium fax-mail: fax phone number: Telephone: Applicable documents AD 1 Regulation (EU) No 912/2010 of the European Parliament and of the Council of 22 September 2010 setting up the European GNSS Agency, repealing Council Regulation (EC) No 1321/2004 on the establishment of structures for the management of the European satellite radio navigation programmes and amending Regulation (EC) No 683/2008 of the European Parliament and of the Council (OJ L 276, 20.10, p 11) AD 2 AD 3 AD 4 AD 5 The European GNSS PSI issued by the GNSS Security Board (GNSS SB); current version: Issue 2.0 Rev 1 dated Galileo COMSEC Security Instructions issue 3.0, 28 June 2007 (RESTRICTED) (currently under review) Galileo Stand alone Security Classification guide v2.1, 12 June 2008 (RESTREINT UE) Decision No 1104/2011/EU of the European Parliament and of the Council of 25 October 2011 on the rules for access to the Public Regulated Service provided by the Global Navigation Satellite System established under the Galileo programme (OJ L 287, ) 7 Reference documents RD 1 Commission Decision 2001/844/EC, ECSC, Euratom published in OJ L 317 of as last amended by Commission Decision 2006/548/EC, Euratom published in OJ L 215 p.38 of , amending its internal Rules of Procedure (COMMISSION PROVISIONS ON SECURITY) Amendments to Commission Decision 2001/844/EC, ECSC, Euratom Commission Decision 2005/94/EC, Euratom, of 3 February 2005 published in OJ L 31 of amending Decision 2001/844/EC, ECSC, Euratom Commission Decision 2006/70/EC, Euratom, of 31 January 2006 published in OJ L 34 of amending Decision 2001/844/EC, ECSC, Euratom Page 9 of 12

10 Commission Decision 2006/548/EC, Euratom, of 2 August 2006 published in OJ L 215 of amending Decision 2001/844/EC, ECSC, Euratom RD 2 User Segment Classification Guide, V1.0, 18 January 2012 RESTREINT UE 8 Appendix A: List of security cleared companies To be completed after contract awarding Country Company Name Address Security Officer (Name, Tel, Fax, ) Project Leader (Name, Tel, Fax, ) Page 10 of 12

11 9 Appendix B: Access to the 's premises 1. s or subcontractors and their personnel shall comply with the 's internal security and safety rules and Regulations and shall follow any instructions given by the 's Security Department. They will be briefed accordingly by the Local Security Officer. They shall grant their full co-operation to prevent and report any (security) incident. 2. Any failure to comply with the 's security or safety instructions may result in access to the premises being denied or the personnel being expelled from the premises. 3. Unless otherwise agreed with the, contractor or subcontractor personnel performing work on the 's premises, except attendance at meetings with the representatives, shall hold the nationality of an EU Member State and shall hold a security clearance at SECRET UE level issued by the contractor's or subcontractor's responsible national security authority. 4. The may temporarily authorise, on a case-by-case basis, contractor or subcontractor personnel to perform work on its premises for whom initial security checks have revealed no adverse information and the security clearance procedure has been initiated or is still in progress. 5. Any information or material provided to the contractor's or subcontractor's personnel shall be treated as if supplied officially by the. 6. The contractor shall notify the 's Security Department at least 5 working days in advance of any visit with the names, dates of birth and nationalities together with a certification of the individual's security clearance and where appropriate the details of vehicles, for all contractor or subcontractor personnel temporary performing work on the 's premises using the procedure laid down in paragraph 4.4 of the SAL. 7. The shall be entitled to refuse access to its premises to any contractor or subcontractor personnel without giving justification, as deemed necessary for security reasons. Page 11 of 12

12 10 Appendix C: Security Classification Guide (SCG) 1. The Security Classification Guide (SCG), for contract XXX is threefold: it is composed by AD 4, Standalone Galileo Security Classification Guide, Appendix X to this SAL, by RD 2, User Segment Security Classification Guide, and of the supplement specific to contract XXXX, Appendix XX to this SAL. The SCG may be amended throughout the life of the Contract and the elements it contains may be reclassified or downgraded. 2. All the parts of the SCG are provided as separate appendixes Page 12 of 12