Exchange of Classified Information with the European Union

Introduction

Following on from the conclusion of negotiations with the European Union regarding how classified information is shared with the EU, the Cabinet Office has released a Security Notice (GSG-SN-012 dated 29 December 2020) that informs Security Advisers (SAs) of the outcome of negotiations with the European Union (EU) regarding the exchange of classified information.

As Security Notice GSG-SN-012 is graded OFFICIAL-SENSITIVE it is not replicated within this ISN, however, this ISN summarises the pertinent actions expected to be followed by Industry for all releases of classified information with EU institutions.
Issue

Issue

This ISN provides security procedures for the exchange of MOD classified information or material, in any form, with the EU institutions.
Action by Industry

Action by industry

Members of the UK Defence Supply Base shall follow the security controls and processes below, in respect to the exchange of classified information/material between the UK and EU institutions.

This ISN does not apply to any bilateral classified exchanges between the UK and individual EU Member States.

Security Controls and Processes:

Requirements for exchange

UK MOD classified information shall only be provided to EU institutions where a business requirement exists that is endorsed by MOD.

Equivalent level of Protection

The security classifications of UK and EU shall correspond as follows:

All EU information/material must be afforded the same level of protection as the corresponding UK security classification. A summary of the minimum requirements for protecting international classified information can be found in International Classified Exchanges: Annex B, covering Personnel security and access control; Physical security; Information Management; Information Assurance; and Disclosure and release.

Exchange of classified information/material

All exchanges of classified information/material between the EU and UK must be made through the registries in Brussels:

• MOD classified information or material being provided to an EU institution must be submitted via the UK Mission to the EU (UKMis); and

• EU classified information/material being provided to the Defence Supply Base will be routed via UKMis, who will then send the information/material to the intended UK recipient.

Local registration

It is mandatory for all EU classified information/material to be recorded as follows:

• EU information/material ‘RESTREINT UE/EU RESTRICTED’ must be recorded in an Information Asset Register (IAR), or local equivalent, for the lifecycle of that information/material.

• EU information/material classified as ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ and/or above, must be recorded in a Protected Document Register (PDR), such MOD Form 102 or local equivalent, for the lifecycle of that information/material.

All IARs and PDRs (or equivalents) must be kept up to date and be available for assessment, upon request, by the EU, UK National Security Authority (UK NSA) or MOD (for example, in the event of an EU assessment visit or a security incident).

Incident reporting

All incidents concerning EU material must be reported to Def Ind WARP and managed in accordance with ‘Security incidents involving international classified information’. Where applicable, MOD will onward report to UK NSA.

Validity/Expiry date

This ISN is valid with immediate effect and will remain so until further notice.

The point of contact in respect of the content of this ISN is:

Info & Info-Cyber Policy Team
Directorate of Cyber Defence & Risk (CyDR)
Ministry of Defence
tel: +44-20-721-83746 (PSTN)
email: [email protected] (Multiuser)