2.Entities of secrets may, in accordance with the procedure laid down by the institution performing the functions of the Security Accreditation Authority, appoint or set up departmental security accreditation authorities. The general rules for activities of departmental security accreditation authorities shall be approved by the institution performing the functions of the Security Accreditation Authority. The institution performing the functions of the Security Accreditation Authority shall co-ordinate the activities of departmental security accreditation authorities relating to performance of the functions of control of security of ADP systems and networks and issuance of authorisations for automated processing and transmission of classified information via ADP systems and networks of an entity of secrets, the contractor (subcontractor) thereof.
\n
3.Classified information may be subject to automated processing and transmission only via certified ADP systems and networks. ADP systems and networks shall be considered to be certified when an entity of secrets, the contractor (sub-contractor) thereof are issued an authorisation for automated processing and transmission of classified information via ADP systems and networks. The authorisation for automated processing and transmission of classified information using ADP systems and networks shall be issued by the institution performing the functions of the Security Accreditation Authority, or a departmental security accreditation authority in accordance with the procedure laid down by the institution performing the functions of the Security Accreditation Authority.
\n
Article 41Requirements for the Protection of ADP Systems and Networks
\n
1.The means of protection used for safeguarding the security of ADP systems and networks must ensure:
\n
1)confidentiality of the classified information stored, processed or transmitted;
\n
2)a possibility to identify users of ADP systems and networks;
\n
3)integrity of the classified information stored, processed or transmitted and system services and resources;
\n
4)availability to authorised users of the classified information stored, processed or transmitted and system services and resources;
\n
5)recording of deliberate or accidental breaches of confidentiality, integrity or availability of the classified information stored, processed or transmitted via ADP systems and networks as well as services and resources of the ADP system and networks;
\n
6)control of interconnection of ADP systems and networks;
\n
7)assessment and verification of adequacy of the protection mechanisms of ADP systems and networks.
\n
2.ADP systems and networks must be equipped with the protection mechanisms and security management procedures preventing breaches of security, detecting occurred breaches of security and restoring the confidentiality, integrity and availability to authorised users of the classified information and services and resources of the ADP systems and networks as adversely affected by the breaches of security.
\n
3.The security requirements for ADP systems and networks shall be set forth by an institution performing the functions of the Security Accreditation Authority.
\n
4.ADP systems and networks must be equipped with the means of protection allowing to protect the information classified “Confidential” or above against compromise through electromagnetic emissions. The means of protection applied must be commensurate with the risk of the compromise of information and the prejudice likely to be caused upon the disclosure of the information.
\n
5.All operations of the installation and modification of ADP systems and networks must be carried out with the participation and under the supervision of a responsible person. The persons carrying out the maintenance of the communication facilities and computing devices used for storage or transmission of classified information, ADP systems and networks must be cleared to the highest classification level of the information processed, stored or transmitted in the said equipment or system.
\n
6.The requirements for the means of protection of ADP systems and networks against electromagnetic radiation shall be set forth by the Commission for Secrets Protection Co-ordination.
\n
7.Installation in the ADP systems and networks processing classified information of the hardware or software not provided for in the ADP systems and networks’ specifications shall be prohibited.
\n
Article 42Transmission of Classified Information via ADP Systems and Networks
\n
1.When transmitting classified information via ADP systems and networks, the confidentiality, integrity and availability to authorised users of the classified information must be ensured.
\n
2.When transmitting classified information via ADP systems and networks, confidentiality thereof must be ensured by means of the cryptographic methods and products approved by the National Distribution Authority and the telecommunications protection requirements approved by the National Communications Security Authority.
\n
3.Transmission of classified information via public telecommunications networks in clear text, with the exception of the cases referred to in paragraph 4 of this Article, shall be prohibited.
\n
4.By a decision of the head of an entity of secrets’ structural division housing classified information, the information classified “Restricted”, “Confidential” and “Secret” may be transmitted in clear text, where a state of war or emergency has been declared and means of encrypting are not available, while speed of delivery is more important than the imminent threat of disclosure of the information.
\n
5.The protection afforded to cryptographic products, mechanisms and classified information must be commensurate with the amount of the prejudice likely to be caused upon a compromise of classified information.
\n
Article 43Protection of Computer Storage Media
\n
1.All computer storage media used for recording classified information must be adequately identified, held and stored according to the requirements set for the protection of the most highly classified information contained therein.
\n
2.The classified information stored in reusable computer storage media may be deleted and the media declassified or destroyed only in accordance with the procedures laid down by the Government.
\n
Article 44Functions of a Responsible Person in Organising the Protection of ADP Systems and Networks
\n
A responsible person must:
\n
1)ensure the installation, operation and maintenance of means of protection at the workstations with elements of ADP systems and networks;
\n
2)devise telecommunications plans and schemes and specify therein the location of wires, cables, the amount, types, numbering thereof;
\n
3)on the basis of the requirements set by the Security Accreditation Authority, develop, implement and control the procedures for managing security of the ADP systems and networks of an entity of secrets or contractor (sub-contractor) and periodically acquaint therewith administrators and users of the ADP systems and networks;
\n
4)prepare the documents required to obtain an authorisation for automatic processing and transmission of classified information via ADP systems and networks, organise the issuance of the authorisation;
\n
5)ensure that ADP systems and networks are handled by the users authorised to familiarise with the classified information stored, processed and transmitted in the ADP systems and networks and related to the discharge of their duties as well as control user actions;
\n
6)exercise control of the administration of user passwords and/or of installations for the user identification;
\n
7)organise the administration of classified computer storage media;
\n
8)organise and check the backup and recovery of the information of ADP systems and networks;
\n
9)verify the information collected about occurrences (process errors, unauthorised users and operation of the system);
\n
10)notify the head of the contractor (sub-contractor) of an entity of secrets or a person authorised by him of any gaps known to exist in the protection afforded to the ADP systems and networks of the entity of secrets, the contractor (sub-contractor) and the breaches which have occurred and take remedial measures.
\n
CHAPTER NINE CONTROL OF THE PROTECTION OF CLASSIFIED INFORMATION
\n
Article 45Control of the Protection of Classified Information
\n
1.Implementation of the policy of protection of the Republic of Lithuania classified information and carrying out of actions of the protection of classified information in all institutions within the country and abroad shall be controlled by the State Security Department. The Department shall:
\n
1)control compliance with the procedure laid down for classifying, using, storing, destroying and declassifying the information classified “Top Secret”, “Secret” and “Confidential”. An entity of secrets must eliminate the deficiencies established in the course of an inspection by the State Security Department within a time limit laid down by the Department and notify thereof the State Security Department;
\n
2)submit proposals to the Government, the Commission for Secrets Protection Co-ordination on the upgrading of the classified information protection system;
\n
3)(repealed as of 1 February 2011);
\n
4)provide methodological support to entities of secrets on the protection of classified information.
\n
2.Control of the protection of the information classified “Restricted” shall be exercised by the entities of secrets that have this information at their disposal.
\n
3.The persons exercising control of the protection of classified information must hold authorisations to handle or familiarise with the information classified “Top Secret”. The persons exercising control of the protection of the classified information released to the Republic of Lithuania by other states or international organisations must be appropriately security cleared.
\n
4.The persons exercising control of the protection of classified information shall, in the course of inspections, be familiarised with the contents of classified documents only with a consent of the head of an entity of secrets.
\n
5.The persons exercising control of the protection of classified information shall have the right:
\n
1)in accordance with the procedure laid down by an entity of secrets, to access the territories and premises where classified information is processed, stored or transmitted;
\n
2)to familiarise with the documents of an entity of secrets regulating the protection of classified information;
\n
3)to carry out inspections of storage of classified documents or copies thereof, where it is required to establish whether a document (copy thereof) has not been lost and is stored in a place specified in accounting documents;
\n
4)to familiarise with physical security measures;
\n
5)to familiarise with ADP systems and networks designed for the processing, storage or transmission of classified information;
\n
6)to request from responsible persons or from the persons handling classified information oral and written explanations about compliance with the procedure for protecting classified information or breaches of this procedure;
\n
7)to engage appropriate specialists, where special knowledge is required at the time of a check.
\n
6.Where classified information is suspected to have been lost or compromised, an enquiry shall be conducted by a decision of the head of an entity of secrets. The inspection must:
\n
1)establish and confirm the classification, contents and volume of the classified information lost or disclosed;
\n
2)establish the persons whose actions could have led to the loss or disclosure of classified information;
\n
3)specify the persons who had this information at their disposal or were familiarised therewith;
\n
4)establish the circumstances of the loss or disclosure of classified information.
\n
7.Where, upon the carrying out of the enquiry provided for in paragraph 6 of this Article and the inspection referred to in Article 27 of this Law, it transpires that classified information has indeed been lost or compromised, the head of an entity of secrets shall immediately notify thereof the State Security Department.
\n
8.Where, upon the conducting of an enquiry, it transpires that the classified information released to the Republic of Lithuania by foreign states or international organisations has indeed been lost or compromised, notice shall be immediately given to the Commission for Secrets Protection Co-ordination, appropriate services of the state or international organisation which has released the information and the State Security Department.
\n
CHAPTER TEN LIABILITY
\n
Article 46Liability for Unauthorised Holding of Classified Information, Compromise, Loss, Seizure or Other Unauthorised Acquisition of Classified Information
\n
A person shall be held liable for an unauthorised holding of classified information, the compromise, loss, seizure or other unauthorised acquisition of classified information or for other breaches of the requirements set for the protection of classified information in accordance with the procedure laid down by legal acts.
\n
I promulgate this Law passed by the Seimas of the Republic of Lithuania.
\n
PRESIDENT OF THE REPUBLIC VALDAS ADAMKUS Annex to Republic of Lithuania Law No IX-1908 of 16 December 2003 EU LEGAL ACT IMPLEMENTED BY THIS LAW Council Decision of 19 March 2001 adopting the Council’s security regulations (2001/264/EC).