58. Ordinance of the President of the National Council on the handling of classified and non-public information in the National Council and the Federal Council (Information Regulation-InfoV)

On the basis of Art. 30 (6) B-VG, BGBl. No. 1/1930, as last amended by the Federal Act BGBl. I n ° 102/2014, as well as section 26 of the Information Order Act-InfOG, BGBl. I n ° 102/2014, shall be arranged in agreement with the Chairman of the Federal Council:

Scope

§ 1. (1) This Regulation shall apply to the area of the National Council and the Federal Council.

(2) Where reference is made to federal legislation in this Regulation, these are to be applied in their respectively applicable version.

Security documentation

§ 2. (1) Any person who is granted access to classified information on the basis of the InfOG shall be informed about the handling of such information and for threats to security according to the respective classification level. raise awareness. The purpose of the security documentation is to ensure that the safety standards provided for are complied with, so that classified information does not reach people who do not have the right to be authorized in accordance with § § 13, 14 and 16 InfOG.

(2) Persons granted access to EU classified information shall also be informed of compliance with EU rules.

(3) The security instruction shall be made in writing prior to the opening of access to classified information and shall, in any event, be at the beginning of each legislative period of the National Council and in the event of a modification or addition of the relevant Rules and obligations to be repeated. Proof of proof of security shall be recorded in writing.

(4) The security instruction shall also include sanctions in the event of breach of confidentiality rules.

Authorized Person Directory

§ 3. The registries in accordance with § 21 InfOG shall each lead a permanent list of persons to whom access to classified or non-public information is granted on the basis of the InfOG.

Marking

§ 4. (1) Classified information shall be clearly and clearly identifiable with the classification levels set out in § 4 InfOG.

(2) The following information shall be identified as "non-public" if it is not suitable for publication (Section 3 (2) InfOG):

1.		templates, documents, reports, information and communications on projects within the framework of the European Union or within the framework of the European Stability Mechanism, in so far as they do not already have the appropriate labelling;
2.		Requests and communications relating to the administrative prosecution of Members pursuant to Section 10 (2), (3) and (5) of the Law on the Rules of Procedure 1975, BGBl. No 410/1975, requests from authorities pursuant to Art. 63 (2) B-VG, as well as requests for the authorisation to prosecuate persons for insulting the National Council pursuant to Section 117 (1) of the Criminal Code, BGBl. No 60/1974;
3.		Reports according to the Incompatibility and Transparency Act, BGBl. No 330/1983, on which the National Council or the Federal Council has to decide, without prejudice to the provisions of Section 9 of the Federal Constitutional Law on the limitation of the references of public officials, Federal Law Gazette (BGBl). I No 64/1997;
4.		information for which a committee has decided to limit the inspection and distribution in accordance with Section 14 of the InfOG, with the name of the committee being attached.

(3) For information on classification levels 2 or above, the date, the number of business and the originator, as well as on each page of the recipients, the classification level, a page numbering and, where appropriate, the respective number of the copy . If such a marking is not possible on a case-by-case basis, other appropriate labelling measures shall be applied in accordance with the determination of the responsible registral responsible.

(4) As a result of a service instruction pursuant to § 13 Z 3, additional information about the recipient can be provided, without prejudice to section 21 (5) of Annex 1 to the Law on the Rules of Procedure 1975.

Protected Areas

§ 5. (1) As administrative areas within the meaning of § 20 Z 1 InfOG, office areas in the parliamentary buildings, committee-local areas and specially designed areas for the processing and storage of classified information, as well as the respective areas, may be used as administrative areas. immediate surrounding areas.

(2) Areas within the meaning of § 20 Z 2 and 3 InfOG may be defined as specially protected areas within administrative areas, provided that appropriate precautions are taken, in particular by means of a locking system or electronic access control. It is ensured that only specially authorised persons can enter this area independently.

Storage and processing

§ 6. (1) Classified information shall be kept in locked containers in accordance with the classification level in question. The storage of classified information is carried out

1.		Level 1 in the administrative area in a suitable, lockable office furniture or in the specially protected area,
2.		Levels 2 and 3 in the specially protected area in a security container or vault,
3.		Level 4 in the particularly protected area in
a)			a security container with permanent surveillance or inspection or with an approved burgling alarm system in connection with standby personnel in the security service, or
b)			a vault equipped with an emergency alarm system in connection with standby staff in the security service.

(2) Classified Level 1 information may also be kept outside the protected areas for a limited period of time if the transport is carried out in a packaging which does not permit conclusions to be drawn on the content, and the Owners of the security documents according to § 2 guarantee a comparable safety standard as in the protected areas.

(3) The processing of classified information is basically carried out in protected areas, with the processing of classified information

1.		up to level 2 in the administrative area, provided that they are protected from access by unauthorised persons,
2.		of the stage 3 and 4 is exclusively in the particularly protected area.

(4) Classified information up to level 2 may be processed outside the protected areas, if:

1.		the transport is carried out in a packaging which does not allow any conclusions to be drawn to the content, and the owner, in accordance with § 2, guarantees a comparable safety standard as in the protected areas, as well as
2.		in the case of classified information of level 2, the owner keeps the classified information under personal control at any time.

(5) In public, classified information shall not be read or discussed.

Distribution and promotion

§ 7. (1) The distribution of EU classified information of level 1 shall be carried out by the databases in accordance with Article 2 (2) and (3) of the EU Information Law, BGBl. I No 113/2011.

(2) The distribution and transportation of classified information shall be carried out with the exception of the cases of § 6 para. 2 and 4 exclusively by the registries according to § 21 InfOG.

(3) Classified level 2 or higher information shall be submitted against acknowledgement of receipt. The transmission shall be carried out by persons authorised to do so for the classification stage concerned.

(4) For transport within and between the buildings belonging to Parliament, classified information of levels 1, 2 and 3 shall be packed in such a way that no conclusions can be drawn on their content. Classified information of level 4 shall be transported in a secured envelope.

Oral transmission

§ 8. (1) Classified information in stages 2 and 3 may only be transmitted orally in protected areas and in the presence of persons who are eligible for the relevant stage.

(2) Telephone conversations about this information may only be conducted in exceptional and urgent cases without taking any action against interception. In such cases, the discussions should be so cautious that the facts will not be understood by third parties.

(3) In the case of the oral transmission of classified information of level 4, additional measures shall be taken against interception.

Electronic processing

§ 9. (1) In the electronic processing of classified information at level 1, it is intended to ensure that the safety standards set out in the InfOG and in the description of the measures referred to in paragraph 2 are complied with in order to ensure that the classification of classified information is not Information is not available to persons who do not have permission in accordance with § § 12 to 16 InfOG. For this purpose, appropriate teachings of the authorized persons shall be used. Classified information of level 2 or above shall not be processed electronically.

(2) The security measures are dependent on the extent of networking, the storage possibilities and the local conditions. Their specific definition and updating shall be carried out on the basis of a policy description drawn up jointly by the Directorate of Parliament and the clubs, which, in any event, shall include:

1.		Appropriate precautions must be taken to detect malicious software. Any ICT system must take appropriate protective measures against other, potentially insecure, networks or connected computers.
2.		The transmission of classified information of level 1 (electronic transport or transport on external data carriers outside protected areas) shall in principle be carried out by means of cryptographic products and procedures. Unencrypted filenames, captions and captions, etc., must not allow any conclusions to be drawn about the contents of the classified information.
3.		If the transmission takes place within protected areas, encryption can be waived.
4.		If the transmission takes place outside of protected areas, either a securing of the transmission path with cryptographic measures or an end-to-end encryption is to be provided. In the case of documents classified documents, care must be taken to ensure that access to the expression may only be possible for authorised persons and that the marking shall be carried out in accordance with § 4.

(3) In IKT systems, it is necessary to ensure that access to non-public or classified information is provided only under the condition of § § 12 to 16 InfOG. For each ICT system in which non-public or classified information is processed, appropriate protection of the system is to be ensured. Each user must be uniquely identified.

Registration

§ 10. (1) Classified information from classification levels 2, 3 and 4 shall be registered. Registration shall be carried out in commercial books provided for this purpose, which shall be distinguished by classification levels. Each registrar according to § 21 InfOG carries out its own business books, which are used exclusively for their area.

(2) The business books referred to in paragraph 1 shall be provided with their own classification level. Business books in which information of classification levels 2 or 3 are registered shall at least be provided with classification level 1. Business books in which classification level 4 information is registered is to be provided with classification level 3.

(3) To be registered, the creation or receipt of a registered classified information as well as its reproduction, translation, distribution, return, promotion, release and destruction are to be registered.

(4) Each registrant classified information shall be provided with its own business number. In any case, the date of creation or receipt, the originator, the subject matter and the classification stage, the respective number of the copy, the name of the recipient and the date of transmission, return, promotion, release and Destruction.

(5) In the case of a promotion, the registration in the business books of both the previous and the new classification level must be carried out. Recipients of a registered classified information shall be informed of the promotion or release.

(6) Where EU classified information is transferred to the Très Secret UE/EU Top Secret classification level by a body other than the Central Registry of the Federal Ministry for European and International Affairs, the said classification shall be to be verifiably informed without delay.

Copies and translations

§ 11. (1) Copies and translations of classified information of level 2 or above are to be made only by the relevant registry in specially protected areas. Each copy must be marked as such and can be individualized by the respective number of the copy.

(2) The production of copies or translations of classified information of Level 4 is permitted only with the prior written consent of the author.

(3) The preparation of copies of classified information of level 2 or above and the creation of notes on the content based on the classification are, with the exception of the cases of section 21 (1) (2) of Appendix 1, on the Law of the Rules of Procedure 1975 not admissible.

(4) The provisions applicable to the original of a classified information shall be applied to copies, notes and translations.

Destruction

§ 12. (1) Classified information shall be destroyed by means of appropriate procedures. Registrant classified information shall be destroyed exclusively by the relevant registry.

(2) The destruction of classified information subject to registration shall be subject to a non-disclosure protocol, which shall be kept in place of the destroyed classified information. Minutes of destruction of classified information in stages 2 and 3 shall be kept for at least five years, and shall be kept for at least ten years of classified information in grade 4.

Service Instructions

§ 13. Appropriate service instructions shall, in particular, specify:

1.		administrative areas and particularly protected areas, as well as the management of the respective keys and codes in consultation with the persons entitled to dispose of the respective rooms,
2.		Samples for proof of security instruction, registration information, acknowledgement of receipt and the non-registration protocol,
3.		additional information on the recipient, in particular the name of the club, the political group or the parliamentary Directorate, on the individual identification of copies in accordance with § 4.

Bures