92/242/EEC: Council Decision of 31 March 1992 in the field of security of information systems

An action in the field of the security of information systems is hereby adopted. It comprises: development of overall strategies for the security of information systems (action plan) for an initial period of 24 months, and setting-up Senior Officials Group with a long-term mandate to advise the Commission on action to be undertaken in the field of the security of information systems, hereinafter referred to as the ‘Committee’.

1 The Commission shall consult the Committee systematically on issues relating to the security of the information systems for the various activities carried out by the Community, in particular on the definition of work strategies and programmes.

2 The action plan, as indicated in the Annex, shall include preparatory work under the following themes: I. development of a strategic framework for the security of information systems; II. identification of user and service provider requirements for the security of information systems; III. solutions for immediate and interim needs of users, suppliers and service providers; IV. development of specifications, standardization, evaluation and certification in respect of the security of information systems; V. technological and Operational developments in the security of information systems; VI. provision of security of information systems.

1 The Community funds estimated as necessary for the execution of the action amount to ECU 12 million for the initial period, including ECU 2 million for 1992 within the 1988-1992 financial perspective. For the subsequent period of application of the programme, the amount will have to be included in the Community financial framework in force.

2 The budgetary authority shall determine the appropriations available for each financial year, taking into account the principles of sound management referred to in Article 2 of the Financial Regulation applicable to the general budget of the European Communities.

An evaluation of the progress achieved during the initial period shall be carried out for the Commission by a group of indepedent experts. This group's report, together with any comments by the Commission, shall be submitted to the European Parliament and the Council.

1 The Commission shall be responsible for implementing the action. It shall be assisted by an advisory committee composed of representatives of the Member States and chaired by the representative of the Commission.

2 The action plan shall be implemented in accordance with the objectives set out in Article 2 and updated where necessary. It shall set out the detailed objectives and types of actions to be undertaken, and the financial arrangements to be made for them. The Commission shall make calls for proposals on the basis of the action plan.

3 The action plan shall be implemented in close collaboration with the sector actors. It shall take into account, promote and complement the European and international standardization activities under way in this field.

1 The procedure laid down in Article 7 shall apply to: measures relating to Community policy in the field of the security of information systems;

2 The procedure laid down in Article 8 shall apply to: the preparation and updating of the action plan referred to in Article 5; the contents of the calls for proposals, the assessment of proposals and the estimated amount of the Community's contribution to measures where this amount exceeds ECU 200000; the cooperation in any activity under this Decision of non-Community organizations; arrangements for the dissemination, protection and exploitation of the results of the measures; the measures to be undertaken to evaluate the action.

3 Where the amount of the Community contribution to the measures is less than, or equal to, ECU 200000, the Commission shall consult the Committee on the measures to be taken and inform the Committee of the outcome of its assessment.

The representative of the Commission shall submit to the Committee a draft of the measures to be taken. The Committee shall deliver its opinion on the draft, within a time limit which the Chairman may lay down according to the urgency of the matter, if necessary by taking a vote. The opinion shall be recorded in the minutes; in addition, each Member State shall have the right to ask to have its position recorded in the minutes. The Commission shall take the utmost account of the opinion delivered by the Committee. It shall inform the Committee of the manner in which its opinion has been taken into account.

The representative of the Commission shall submit to the Committee a draft of the measures to be taken. The Committee shall deliver its opinion on the draft within a time limit which the Chairman may lay down according to the urgency of the matter. The opinion shall be delivered by the majority laid down in Article 148 (2) of the Treaty in the case of decisions which the Council is required to adopt on a proposal from the Commission. The votes of the representatives of the Member States within the Committee shall be weighted in the manner set out in that Article. The Chairman shall not vote. The Commission shall adopt the measures envisaged if they are in accordance with the opinion of the Committee. If the measures envisaged are not in accordance with the opinion of the Committee, of if no opinion is delivered, the Commission shall, without delay, submit to the Council a proposal relating to the measures to be taken. The Council shall act by a qualified majority. If, on the expiry of a period of three months from the date of referral to it the Council has not acted, the proposed measures shall be adopted by the Commission, save where the Council has decided against the said measures by a simple majority.