NORMS ON THE PROTECTION OF NATO CLASSIFIED …

1 UNOFFICIAL TRANSLATION ROMANIA GOVERNMENT OF ROMANIA GOVERNMENT DECISION no. 353/2002 on NORMS ON THE PROTECTION OF nato CLASSIFIED information IN ROMANIA BUCHAREST - 2002 - 2 A. FUNDAMENTALS 1. In its capacity of candidate to accession and partner state to the North Atlantic Cooperation Council, Romania signed, on 8th July1994, the Security Agreement with the North Atlantic Treaty Organization, hereinafter nato , and on 10th September 1994, the Code of Conduct. 2. By signing the above-mentioned documents, Romania committed itself to protect and safeguard CLASSIFIED information and material of the Alliance and its members, according to the standards provided in the document Security within the North-Atlantic Treaty Organization C-M (55) 15 (Final) and the national legislation. 3. In compliance with the obligations assumed by Romania, the National Security Authority, hereinafter NSA, was established by Government Decree no.

2 864/10th October 2000, and was entrusted with regulation, authorization and control tasks, in compliance with the minimum standards for the PROTECTION of nato CLASSIFIED information . 4. The National Security Authority (NSA) is the national point of contact with the nato Office of Security (NOS) and with other similar security structures of the North Atlantic Alliance. NSA ensures the unitary co-ordination and implementation of the activity for the PROTECTION of nato CLASSIFIED information in Romania. 5. NSA exerts its tasks in the following areas: physical security, personnel security, document security, PROTECTION of information stored within the systems for automatic data processing, hereinafter INFOSEC, industrial security, as well as other areas involving the PROTECTION of nato CLASSIFIED information . To this end, NSA draws up domestic instructions and procedures, in strict observance of the national legislation and nato relevant standards.

3 6. The institutions responsible for the PROTECTION of nato CLASSIFIED information are the following: Romanian Intelligence Service, Foreign Intelligence Service, Ministry of National Defense, Defense Intelligence General Directorate, and Ministry of Foreign Affairs. At the same time, Special Telecommunications Service, Ministry of Interior and Guard and PROTECTION Service shall fulfill specific tasks according to their legal competence. 3 B. DEFINITIONS 7. information means knowledge that can be communicated in any form. 8. CLASSIFIED information means information or material determined to require PROTECTION against unauthorized disclosure, which has been so designated by the security classification. 9. Material includes documents and any item of machinery or equipment, or weapons, either manufactured or in the process of manufacture.

4 10. nato CLASSIFIED information means all CLASSIFIED information , military, political and economic, circulated within nato , whether such information originates in nato commands and agencies, or is received from member nations or from other international organizations. 11. Document means any recorded information , regardless of its physical form or characteristics, including, without limitation, written or printed matter, data processing cards and tapes, maps, charts, photographs, paintings, drawings, engravings, sketches, working notes and papers, carbon copies and ink ribbons, or reproductions by any means of process, and sound, voice, magnetic or electronic, or optical or video recordings, in any form, and portable ADP, equipment with resident computer storage media, and removable computer storage media. 12. nato CLASSIFIED document means any document containing nato CLASSIFIED information .

5 13. Security of nato CLASSIFIED documents means all procedures, instructions and measures for the management and control of nato CLASSIFIED documents. 14. Management of nato CLASSIFIED information means all activities of receiving, recording, drawing up, consultation, verification, dissemination, transmission, transport, copying, destruction, inventory and archiving of nato CLASSIFIED information . 15. Control of nato CLASSIFIED information means all activities that verify how nato CLASSIFIED information is managed. 4 C. ACCESS TO nato CLASSIFIED information 16. Access to nato CLASSIFIED information is granted on the basis of the security clearance certificate, in strict observance of the need-to-know principle. 17. According to the Government Decree 864 , NSA issues the security clearance certificates attesting the right of access to nato CLASSIFIED information and documents.

6 18. Two types of security clearance certificates are issued, as follows: - Type A: nato Personnel Security Clearance Certificate granting access to nato CLASSIFIED information , with a three-year period of validity; - Type B: Certificate of Security Clearance granting to an individual the right to participate in activities organized by the Alliance, where nato CLASSIFIED information is circulated and for which the Alliance requests the issuance of such a document. The certificate is valid only for the period the activity is carried out. A Type B certificate of security clearance requires previous issuance of a Type A personnel security clearance certificate. 19. The level of access granted by the security clearance certificate shall be similar to the classification level of the information to which the individual needs access in fulfilling its duties. 20. Access to nato CLASSIFIED information based on the security clearance certificate shall observe the need-to-know principle, no person is entitled solely by virtue of rank, position or personnel security clearance certificate to have access to nato CLASSIFIED information .

7 The number of individuals having access to nato CLASSIFIED information and documents shall be limited to those whose professional duties require access to such information . 21. The individuals who have been issued security clearance certificates and are going to be granted access to nato CLASSIFIED information will be briefed by the Security Officer (SO) of the organization on the NORMS and regulations for the PROTECTION of such information . The individuals will pledge, in writing, to safeguard nato CLASSIFIED information , and to comply with the provisions of the relevant regulations/security plans, in fulfilling their duties. 5 D. NATIONAL registry SYSTEM (NRS) 22. Institutional structure means any ministry, central body, organization, authority agencies, economic units that handle/will handle nato CLASSIFIED information . 23. Component of the National registry System (CNRS) is that component of an institutional structure responsible for the management and consultation of nato CLASSIFIED information .

8 These are: the central registry , external registries, internal registries, sub-registries and control points. 24. The National registry System consists of all CNRSs. 25. The regulations on physical security, personnel security, document security, INFOSEC and industrial security are unitary implemented within the NRS, in order to ensure the appropriate framework for the management of nato CLASSIFIED information , in accordance with nato security standards. 26. Each institutional structure (military or civilian) which handles nato CLASSIFIED information shall establish its own CNRS. The organizational form of this CNRS shall depend on the amount and classification level of the handled information , and shall be consistent with the existing administrative structure. 27. The central registry is that CNRS established and functioning within the NSA.

9 It is responsible for the management and control of all nato CLASSIFIED information , at national level. 28. An External registry is that CNRS functioning outside the country, subordinated to the central registry , responsible for the management of nato CLASSIFIED information received/released from/to nato and the other security structures of the Alliance. 29. An Internal registry is that CNRS responsible for the management and control of nato CLASSIFIED information , at the level of an institutional structure. 30. A Sub- registry is that CNRS subordinated to a registry , responsible for the management and control of nato CLASSIFIED information , at departmental level. 6 31. A Control Point is that CNRS exerting solely accountability, consultation, dissemination, storage and control tasks of nato CLASSIFIED information . 32. A CNRS shall be organized in relation to the amount and classification level of nato CLASSIFIED information it manages, as well as to the functional tasks it will fulfill.

10 A CNRS is composed of: A. The Document Section, with: a recording section, and a dissemination section; B. The Courier Section. 33. The Document Section has the following main tasks: - to receive, record, keep record of the drawing up and consultation, check, transmit, transport, copy, destroy, make inventory, archive and control nato CLASSIFIED information ; - to disseminate nato CLASSIFIED information collection, checking, wrapping, and dispatching. 34. The Courier Section has the following main tasks: - to collect, check, and transport nato CLASSIFIED documents, in accordance with the national regulations on transport of national CLASSIFIED documents with equivalent classification level, observing nato minimum security standards. 35. Each CNRS shall establish a Document Section. The Courier Section could be included in/ensured by/ the institutional structure it belongs to.