SEPAD description - CIRCA - Europa

Problem statement
In 2003 - 2004, after a call for tender initiated by ADMIN/IAC, an external
company performed an audit control and issued a report on the access rights
management of DG Admin Information Systems; the development and
implementation a DG ADMIN specific security policy was one of the most
important outcomes of that Audit;
The specific recommendations were formally accepted by the DG, as tasks to
be performed as soon as possible; however, mainly due to lack of human
resources, the implementation of the recommendations has not been realised
up to now.
The recommendations
A project should be set up to develop and implement a DG ADMIN specific
security policy in compliance with the I.S. Security Policy. This should define
the list of controls that need to be applied on an on-going basis, the scope or
depth of the controls as well as who should operate the controls.
A record of all information systems in DG ADMIN should be created with an
assessment of the risk factors and the preventive and corrective measures
introduced.
A record should be created of all the persons authorised to maintain, modify
or use any part of any of the information systems in DG ADMIN, specifying the
exact type of authorisation granted to each individual.
The checks required by the I.S. Security Policy should be executed. Reporting
to management should be prepared.
The SEPAD project
Project goal is to develop and implement a DG ADMIN specific security policy
and controls on the access rights management, taking into account the
recommendations mentioned above.
Legal basis
Commission Decision 2001/844/EC, on Commission provisions on security;
Commission Decision C(2006) 3602 on the security of information systems;
Additional Documents
Information Systems Security Policy (version 2001)

Organisation
Steering Committee composition:
Phases
Adviser for Data protection and IT security;
IRMs of DG ADMIN;
Head of Unit of ADMIN/DS.5;
Representative from the system owners;
LISO of DG ADMIN (project coordinator).
Create an inventory of all information systems in DG ADMIN, with an
assessment of the risk factors associated to them;
Create a “Security Policy” high level document, and define the list of controls
that need to be applied on an on-going basis;
Define preventive and corrective measures to mitigate the recorded risks;
Create a record of all the persons authorised to maintain, modify or use any
part of any of the information systems in DG ADMIN;
Supervise the implementation of the established controls (“running-in”
phase).
Indicative Timetable
Inventory of all information systems in DG ADMIN, with an assessment of the
risk factors associated to them: by May 2007
“Security Policy” high level document, with list of controls that need to be
applied on an on-going basis: First version by July 2007, final version by
middle 2008 (end of project)
List of preventive and corrective measures to mitigate the recorded risks: by
November 2007
Record of all the persons authorised to maintain, modify or use any part of
any of the information systems in DG ADMIN: by November 2007
Running-in: January - April 2008
Contact
LISO of DG ADMIN (Mr. Petros Kosmetatos, tel. 54874 or by email:
admin-liso@ec.europa.eu)
Adviser for Data protection and IT security (Mr. Patrice Marcelli, tel. 52556)