Regulation 2014/512 - Amendment of Regulation (EU) No 912/2010 setting up the European GNSS Agency - Main contents

EN

Official Journal of the European Union

L 150/72

It follows from the combined provisions of Article 14 of Regulation (EU) No 1285/2013 of the European Parliament and of the Council (3) and Article 2 of Regulation (EU) No 912/2010 of the European Parliament and of the Council (4) that the European GNSS Agency (the ‘Agency’) is to ensure the security accreditation of the European satellite navigation systems (the ‘systems’) and, to that end, initiate and monitor the implementation of security procedures and the performance of security audits.

The systems are defined in Article 2 of Regulation (EU) No 1285/2013. They are complex systems and their establishment and operation involve numerous stakeholders with different roles. In this context, it is crucial that EU classified information be handled and protected by all the stakeholders involved in the implementation of the Galileo and EGNOS programmes (the ‘programmes’) in accordance with the basic principles and minimum standards set out in the Commission’s and the Council’s security rules on the protection of EU classified information and that Article 17 of Regulation (EU) No 1285/2013, which guarantees an equivalent level of protection for EU classified information, apply, where appropriate, to all stakeholders involved in implementing the programmes.

The stakeholders participating in and affected by the security accreditation process are Member States, the Commission, relevant Union Agencies and the European Space Agency (ESA) and the parties involved in Council Joint Action 2004/552/CFSP (5).

Considering the specificity and complexity of the systems, the different bodies involved in their implementation and the variety of potential users, security accreditation should be facilitated by appropriate consultation of all relevant parties, such as national authorities of Member States and of third countries operating networks connected to the system established under the Galileo programme for the provision of the Public Regulated Service (PRS), other relevant authorities of Member States, ESA or, if provided for in an international agreement, third countries hosting the ground stations of the systems.

In order to enable the appropriate performance of tasks relating to security accreditation, it is crucial that the Commission provide all the information necessary to perform these tasks. It is also important for security accreditation activities to be coordinated with the work of the bodies responsible for managing the programmes in accordance with Regulation (EU) No 1285/2013 and other entities responsible for implementing security provisions.

The risk assessment and management approach to be applied should follow best practices. It should include applying security measures in accordance with the concept of defence-in-depth. It should take into consideration the likelihood of the occurrence of a risk or feared event. It should also be proportionate, appropriate and cost-effective, taking into account the cost of implementing measures to mitigate risk compared to the subsequent security benefit. Defence-in-depth aims...