Commission Decision (EU, Euratom) 2017/46Dangos y teitl llawn

CHAPTER 2 ORGANISATION AND RESPONSIBILITIES

Article 4 Corporate Management Board

The Corporate Management Board shall take the overall responsibility for the governance of IT security as a whole within the Commission.

Article 5 Information Security Steering Board (ISSB)

1. The ISSB shall be chaired by the Deputy Secretary-General responsible for IT security governance in the Commission. Its members shall represent business, technology and security interests across the Commission departments and include representatives of the Directorate-General for Informatics, the Directorate-General for Human Resources and Security, the Directorate-General for Budget, and, on a 2-year rotating basis, representatives of four other Commission departments involved where IT security is a major concern for their operations. Membership is at senior management level.

2. The ISSB shall support the Corporate Management Board in its IT-security-related tasks. The ISSB shall take the operational responsibility for the governance of IT security as a whole within the Commission.

3. The ISSB shall recommend the Commission's IT security policy for adoption by the Commission.

4. The ISSB shall review and report biannually to the Corporate Management Board on governance matters as well as on IT-security-related issues, including serious IT security incidents.

5. The ISSB shall monitor and review the overall implementation of this decision and report on it to the Corporate Management Board.

6. On the proposal of the Directorate-General for Informatics, the ISSB shall review, approve and monitor the implementation of the rolling IT security strategy. The ISSB shall report on it to the Corporate Management Board.

7. The ISSB shall monitor, evaluate and control the corporate information risk treatment landscape and shall have the power to issue formal requirements for improvements wherever necessary.

The processes related to these responsibilities and activities shall be further detailed in implementing rules.

Article 6 The Directorate-General for Human Resources and Security

In relation to IT security, the Directorate-General for Human Resources and Security has the following responsibilities. It shall:

(1)

assure alignment between the IT security policy and the Commission's information security policy;

(2)

establish a framework for the authorisation of the use of encrypting technologies for the storage and communication of information by CISs;

(3)

inform the Directorate-General for Informatics about specific threats which could have a significant impact on the security of CISs and the data sets that they process;

(4)

perform IT security inspections to assess the compliance of the Commission's CISs with the security policy, and report the results to the ISSB;

(5)

establish a framework for the authorisation of access and the associated appropriate security rules to Commission CISs from external networks and develop the related IT security standards and guidelines in close cooperation with the Directorate-General for Informatics;

(6)

propose principles and rules for the outsourcing of CISs in order to maintain appropriate control of security of the information;

(7)

develop the related IT security standards and guidelines in relation to Article 6, in close cooperation with the Directorate-General for Informatics.

The processes related to these responsibilities and activities shall be further detailed in implementing rules.

Article 7 The Directorate-General for Informatics

In relation to the overall IT security of the Commission, the Directorate-General for Informatics has the following responsibilities. It shall:

(1)

develop IT security standards and guidelines, except as provided in Article 6, in close cooperation with the Directorate-General for Human Resources and Security, in order to assure consistency between the IT security policy and the Commission's information security policy, and propose them to the ISSB;

(2)

assess the IT security risk management methods, processes and outcomes of all Commission departments and report on this regularly to the ISSB;

(3)

propose a rolling IT security strategy for revision and approval by the ISSB and further adoption by the Corporate Management Board, and propose a programme, including the planning of projects and activities implementing the IT security strategy;

(4)

monitor the execution of the Commission's IT security strategy and report on this regularly to the ISSB;

(5)

monitor the IT security risks and IT security measures implemented in CISs and report on this regularly to the ISSB;

(6)

report regularly on the overall implementation and compliance with this decision to the ISSB;

(7)

after consulting with the Directorate-General for Human Resources and Security, request system owners to take specific IT security measures in order to mitigate IT security risks to Commission's CISs;

(8)

ensure that there is an adequate catalogue of the Directorate-General for Informatics IT security services available for the system owners and data owners to fulfil their responsibilities for IT security and to comply with the IT security policy and standards;

(9)

provide adequate documentation to system and data owners and consult with them, as appropriate, on the IT security measures implemented for their IT services in order to facilitate compliance with the IT security policy and support the system owners in IT risk management;

(10)

organise regular meetings of the LISOs network and supporting LISOs in carrying out their duties;

(11)

define the training needs and coordinate training programmes on IT security in cooperation with the Commission departments, and develop, implement and coordinate awareness-raising campaigns on IT security in close cooperation with the Directorate-General for Human Resources;

(12)

ensure that system owners, data owners and other roles with IT security responsibilities in Commission departments are made aware of the IT security policy;

(13)

inform the Directorate-General for Human Resources and Security on specific IT security threats, incidents and exceptions to the Commission's IT security policy notified by the system owners which could have a significant impact on security in the Commission;

(14)

in respect of its role as an internal IT service provider, deliver to the Commission a catalogue of shared IT services that provide defined levels of security. This shall be done by systematically assessing, managing and monitoring IT security risks to implement the security measures in order to reach the defined security level.

The related processes and more detailed responsibilities shall be further defined in implementing rules.

Article 8 Commission departments

In relation to IT security in their department, each Head of Commission department shall:

(1)

formally appoint a system owner, who is an official or a temporary agent, for each CIS who will be responsible for IT security of that CIS and formally appoint a data owner for each data set handled in a CIS who should belong to the same administrative entity which is the Data Controller for data sets subject to Regulation (EC) No 45/2001;

(2)

formally designate a Local Informatics Security Officer (LISO) who can perform the responsibilities independently from system owners and data owners. A LISO can be designated for one or more Commission departments

(3)

ensure that appropriate IT security risk assessments and IT security plans have been made and implemented

(4)

ensure that a summary of IT security risks and measures is reported on a regular basis to the Directorate-General for Informatics;

(5)

ensure, with the support of the Directorate-General for Informatics, that appropriate processes, procedures and solutions are in place to ensure efficient detection, reporting and resolution of IT security incidents relating to their CISs;

(6)

launch an emergency procedure in case of IT security emergencies;

(7)

hold ultimate accountability for IT security including the responsibilities of the system owner and data owner;

(8)

own the risks relating to their CISs and data sets;

(9)

resolve any disagreements between data owners and system owners and in case of continued disagreement bring the issue before the ISSB for resolution;

(10)

ensure that IT security plans and IT security measures are implemented and the risks are adequately covered.

The processes related to these responsibilities and activities shall be further detailed in implementing rules.

Article 9 System owners

1. The system owner is responsible for the IT security of the CIS, and reports to the Head of the Commission department.

2. In relation to IT security, the system owner shall:

(a) ensure the compliance of the CIS with the IT security policy;

(b) ensure that the CIS is accurately recorded in the relevant inventory;

(c) assess IT security risks and determine the IT security needs for each CIS, in collaboration with the data owners and in consultation with the Directorate-General for Informatics;

(d) prepare a security plan, including, where appropriate, details of the assessed risks and any additional security measures required;

(e) implement appropriate IT security measures, proportionate to the IT security risks identified and follow recommendations endorsed by the ISSB;

(f) identify any dependencies on other CISs or shared IT services and implement security measures as appropriate based on the security levels proposed by those CISs or shared IT services;

(g) manage and monitor IT security risks;

(h) report regularly to the head of the Commission department on the IT security risk profile of their CIS and report to the Directorate-General for Informatics on the related risks, risk management activities and security measures taken;

(i) consult the LISO of the relevant Commission department(s) on aspects of IT Security;

(j) issue instructions for users on the use of the CIS and associated data as well as on the responsibilities of users related to CIS;

(k) request authorisation from the Directorate-General for Human Resources and Security, acting as the Crypto Authority, for any CIS that uses encrypting technology.

(l) consult the Commission Security Authority in advance concerning any system processing EU classified information;

(m) ensure that back-ups of any decryption keys are stored in an escrow account. The recovery of encrypted data shall be carried out only when authorised in accordance with the framework defined by the Directorate-General for Human Resources and Security;

(n) respect any instructions from the relevant Data Controller(s) concerning the protection of personal data and the application of data protection rules on security of the processing;

(o) notify the Directorate-General for Informatics of any exceptions to the Commission's IT security policy including relevant justifications;

(p) report any unresolvable disagreements between the data owner and the system owner to the head of the Commission department, communicate IT security incidents to the relevant stakeholders in a timely manner as appropriate according to their severity as laid down in Article 15;

(q) for outsourced systems, ensure that appropriate IT security provisions are included in the outsourcing contracts and that IT security incidents occurring in the outsourced CIS are reported in accordance with Article 15;

(r) for CIS providing shared IT services, ensure that a defined security level is provided, clearly documented and security measures are implemented for that CIS in order to reach the defined security level.

3. System owners may formally delegate some or all of their IT security tasks but they remain responsible for the IT security of their CIS

The processes related to these responsibilities and activities shall be further detailed in implementing rules.

Article 10 Data owners

1. The data owner is responsible for the IT security of a specific data set to the Head of the Commission department and is accountable for the confidentiality, integrity and availability of the data set.

2. In relation to this data set, the data owner shall:

(a) ensure that all data sets under his or her responsibility are appropriately classified in accordance with Decision (EU, Euratom) 2015/443 and (EU, Euratom) 2015/444;

(b) define the information security needs and inform the relevant system owners of these needs;

(c) participate in the CIS risk assessment;

(d) report any unresolvable disagreements between the data owner and the system owner to the head of the Commission department;

(e) communicate IT security incidents as provided for in Article 15.

3. Data owners may formally delegate some or all of their IT security tasks but they maintain their responsibilities as defined in this Article.

The processes related to these responsibilities and activities shall be further detailed in implementing rules.

Article 11 Local Informatics Security Officers (LISOs)

In relation to IT security, the LISO shall:

(a)

proactively identify and inform system owners, data owners and other roles with IT security responsibilities in Commission department(s) about the IT security policy;

(b)

liaise on IT-security-related issues in Commission department(s) with the Directorate-General for Informatics as part of the LISO network;

(c)

attend the regular LISO meetings;

(d)

maintain an overview of the information security risk management process and of the development and implementation of information system security plans;

(e)

advise data owners, system owners and heads of Commission departments on IT-security-related issues;

(f)

cooperate with the Directorate-General for Informatics in disseminating good IT security practices and propose specific awareness-raising and training programmes;

(g)

report on IT security, identify shortfalls and improvements to the Head of the Commission department(s).

The processes related to these responsibilities and activities shall be further detailed in implementing rules.

Article 12 Users

1. In relation to IT security, users shall:

(a) comply with the IT security policy and the instructions issued by the system owner on the use of each CIS;

(b) communicate IT security incidents as provided for in Article 15.

2. Use of the Commission's CIS in breach of the IT security policy or instructions issued by the system owner may give rise to disciplinary proceedings.

The processes related to these responsibilities and activities shall be further detailed in implementing rules