Riigisaladuse ja salastatud välisteabe kaitse kord (RSVKK)

§ 1. Scope of application of Regulation

This Regulation establishes the procedure for the protection of state secrets and foreign classified information, and the subcategories of information classified as a state secret, the levels and terms of classification of subcategories of information.

§ 2¹. Estonian National Security Authority

The Estonian National Security Authority is a structural entity of the Estonian Foreign Intelligence Service.

§ 3. Authorisation of secretary general of ministry

A minister may authorise the secretary general of the ministry to perform all acts and take all decisions which the minister is authorised to perform as the head of the authority in accordance with the current procedure.

§ 4. Subcategories of state secrets related to foreign relations

(1) With regard to information related to international relations created by bodies conducting foreign relations and such information created by bodies conducting foreign relations, the disclosure of which would significantly damage the foreign relations of the Republic of Estonia, the following is a state secret:

1) information received by an employee or representative of a foreign relations institution during an international meeting or information concerning such meeting, the disclosure of which may significantly damage national security. Such information is classified as ‘secret’ for 50 years;

2) information received by an employee or representative of a foreign relations institution during an international meeting or information concerning such meeting, the disclosure of which may damage national security or significantly damage foreign relations. Such information is classified as ‘restricted’ until the arrival of the date or event agreed upon by the parties participating in the meeting but not for longer than for 50 years;

3) information created by a foreign relations institution concerning the preparation for and conduct of international negotiations or meetings, the disclosure of which before the holding of the negotiations or meetings may damage national security or significantly damage foreign relations. Such information is classified as ‘restricted’ until the holding of the meeting or for 50 years in case the disclosure of information after the meeting, or in the case of cancellation of the meeting, would damage national security or significantly damage foreign relations;

4) information concerning the preparation or conduct of international visits or ceremonies (hereinafter in this clause event) unless the disclosure of such information damages national security or significantly damages foreign relations. Such information is classified as ‘restricted’ until the event takes place or for 50 years in case the disclosure of the information after the event or in the case of cancellation of the event would damage national security or significantly damage foreign relations;

5) information received during an international meeting or information concerning such meeting created by a foreign relations institution, which is subject to protection against disclosure according to international practices, or whose protection has been agreed upon by the participants in the meeting or another event. Such information is classified at the level and for the term determined on an agreement between the participants or pursuant to international practices, but not at a level of classification higher than ‘secret’ and not for longer than for 50 years;

6) information created by a foreign relations institution, which concerns international relations, a foreign state or international organisation or their representative in case the disclosure of the contents of information, the manner of transmission or the source of information would damage national security or significantly damage foreign relations. Such information is classified as ‘restricted’ for 50 years.

(2) With regard to information collected and prepared by the Strategic Goods Commission operating at the Ministry of Foreign Affairs concerning the import, export and transit of strategic goods, provision of services related to military goods and the end use of strategic goods, the following is a state secret:

1) information about the import, export and transit of strategic goods, the provision of services related to military goods and the end-use of strategic goods collected by the Strategic Goods Commission, except information the disclosure of which would not damage the security of the Republic of Estonia. Such information is classified as ‘secret’ for 50 years;

2) information about the import, export and transit of strategic goods, the provision of services related to military goods and the end-use of strategic goods collected by the Strategic Goods Commission, in which analyses are made of the dissemination of strategic goods and the related danger to security. Such information is classified as ‘confidential’ for 30 years;

3) information prepared by the Strategic Goods Commission concerning refusal to issue an import or export licence, transit permit or document on supervision of the end-use of military goods, except materials, construction works and equipment related to weapons of mass destruction, as well as information concerning the contents of the meeting of the Strategic Goods Commission which discussed such refusal. Such information is classified as ‘restricted’ for 50 years, except in the case the disclosure of such information does not damage national security or significantly damage foreign relations;

4) the information communicated by the Strategic Goods Commission to international control systems, foreign states and the European Union, which is protected from disclosure in accordance with international practice or the protection of which has been agreed between the participants in a meeting or other event. Such information is classified as ‘confidential’ for a period of 50 years, unless a different level of classification or a longer period of classification has been agreed by the participants or in accordance with international practice.

§ 6. Subcategories of state secret in area of law enforcement

(1) Regarding information collected by a surveillance agency during surveillance activities and information concerning the methods, tactics and means used for collection of such information, the following is a state secret:

1) information collected in the course of surveillance for the conduct of witness protection. Such information is classified as ‘secret’ for 25 years;

2¹) information collected by a surveillance agency by means of surveillance operations in criminal offences provided in Chapters 8, 15, 16 and 22 of the Penal Code and in criminal offences under the investigative jurisdiction of the Estonian Internal Security Service, in case its disclosure may damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ for 25 years. Such information is declassified to the extent that it is included in the criminal file or is communicated to the person who was under surveillance, or to the person whose private or family life has been violated by surveillance;

3) information obtained by the surveillance agency from a person involved in secret cooperation in a surveillance operation and collected by an undercover agent.

4) information collected in the course of surveillance activities, which is reflected in the threat assessments and reviews concerning organised crime and other serious crime prepared by the Police and Border Guard Board. Such information is classified as ‘restricted’ for 50 years;

5) information reflecting the methods, tactics and means used in surveillance activities, except information which can be derived from the information collected by surveillance acts, which has been disclosed lawfully. Such information is classified as ‘restricted’ for 25 years;

6) information concerning the remuneration to a person who has been recruited by a surveillance agency for covert cooperation in surveillance activities, compensation and taxes paid on such amounts, and the documents reflecting them. Such information is classified as ‘restricted’ for 25 years;

7) information concerning a person or body simulated by a surveillance agency, which may disclose the connection thereof to the surveillance agency. Such information is classified as ‘restricted’ for 25 years.

(2) With regard to information concerning a person who has been involved in covert cooperation in surveillance activities by a surveillance agency and undercover agents, the information concerning the identity of the person who has been involved in covert cooperation in surveillance activities by a surveillance agency and undercover agents is a state secret. Such information is classified as ‘restricted’ for 75 years. Classification expires when 20 years have passed since the death of such a person but not earlier than 50 years as of the classification of information.

(3) Information concerning a police agent of surveillance agencies is a state secret. Such information is classified as ‘restricted’ for 75 years. The classification of such information expires to the extent that it has been entered into a criminal file. Classification of information not entered in a criminal file expires when 20 years have passed as of the death of the person but not earlier than 50 years as of the classification of the information;

(4) Regarding information concerning the structure, composition of staff and tasks of the structural unit of the Police and Border Guard Board dealing with witness protection, information reflecting the structure and composition of staff of the structural unit of the Police and Border Guard Board dealing with witness protection and the persons occupying the posts in that unit and their duties is a state secret to the extent determined by a directive of the head of the Police and Border Guard Board. Such information is classified as ‘secret’ for 50 years.

(5) Regarding the property at the disposal of a structural unit of the Police and Border Guard Board dealing with witness protection and the breakdown of the budget, the following is a state secret:

1) information concerning the means of transport used by a structural unit of the Police and Border Guard Board dealing with witness protection in case disclosure of such information would endanger the application of witness protection or the safety of the structural unit dealing with witness protection or of a person placed under protection. Such information is classified as ‘confidential’ for 10 years;

2) information concerning the property used by a structural unit of the Police and Border Guard Board dealing with witness protection in case disclosure of such information would endanger the application of witness protection or the safety of the structural unit dealing with witness protection or a person placed under protection. Such information is classified as ‘secret’ for 25 years;

3) the breakdown of budget expenditure and reports on the execution of the budget of a structural unit of the Police and Border Guard Board dealing with witness protection.

Such information is classified as ‘secret’ for 25 years.

(6) Regarding information concerning witness protection measures the following is state secret:

1) information concerning the methods and tactics of application of witness protection measures. Such information is classified as ‘secret’ for 50 years;

2) format of the witness protection agreement established by a regulation on the basis of subsection 6 of § 14 and § 19 of the Witness Protection Act and the procedure for keeping and storing of the protection file. Such information is classified as ‘restricted’ for 25 years.

(7) Regarding the information concerning application of witness protection measures to a particular person, the following is a state secret:

1) information reflecting the application of witness protection measures to a particular person, except information which reflects only the fact of placing such person under witness protection. Such information is classified as ‘top secret’ for 75 years. Classification expires after 20 years have passed since the death of the person placed under witness protection but not earlier than 50 years as of the classification of information;

2) the breakdown of budgetary expenditure and reports on the execution of the budget of a structural unit of the Police and Border Guard Board dealing with witness protection, in case they reflect the protective measures applied with regard to a particular person. Such information is classified as ‘top secret’ for 75 years. Classification expires after 20 years have passed since the death of the person placed under witness protection but not earlier than 50 years as of the classification of the document.

(8) Regarding the information concerning activities during a state of emergency or state of war described in the national crisis management plan, the information concerning acting during a state of emergency and state of war described in the national crisis management plan, except information the disclosure of which does not damage the security of the Republic of Estonia, is a state secret. Such information is classified as ‘top secret’ for 50 years. Classification expires upon the public use of such information during a state of emergency or state of war.

(11) Information dealing with the conduct of defence operations by the personal protection unit of the Police and Border Guard Board, including information dealing with the methods, tactics and means, except information the disclosure of which would not damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ for 25 years or until the need for the provision of personal protection ceases to exist or the provision of personal protection terminates.

(12) Information concerning the armament, ammunition, special equipment and other equipment of the special unit of the Police and Border Guard Board is a state secret:

1) information reflecting the aggregate data, storage and breakdown of armament, ammunition, special equipment and other equipment. Such information is classified as ‘restricted’ for 25 years;

2) information on the technical data of the armament, ammunition, special equipment and other equipment of the special tactical unit of the Police and Border Guard Board, except for information the disclosure of which would not damage/damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ for 25 years.

§ 7. Subcategories of state secret of security authorities

(1) With regard to information related to the international cooperation of security authorities, the following is a state secret:

1) information concerning foreign relations in the area of security, prepared by a security authority, unless it contains information specified in clauses 2–4 of this subsection. Such information is classified as ‘restricted’ for 30 years;

2) information concerning security cooperation between the security authority and a foreign state or international organisation unless it contains information specified in clauses 3 and 4 of this subsection. Such information is classified as ‘confidential’ for 50 years unless otherwise agreed. Such information is not classified in case it has been disclosed lawfully;

3) covertly collected information to be transmitted in the course of international cooperation by the security authority and information reflecting the exchange of such information. Such information is classified as ‘secret’ for 50 years unless otherwise agreed;

4) information collected covertly by the security authority together with a foreign police or security authority and information reflecting the collection of information or information exchanged in the course thereof. Such information is classified as ‘top secret’ for 50 years unless otherwise agreed.

(2) Regarding the information reflecting the property used by the security authority and breakdown of the budget of the security authority, the following is a state secret:

1) information concerning the property used by a security authority in case the disclosure of such information would endanger the compliance with the function or security of the security authority. Such information is classified as ‘confidential’ for up to 25 years or until the termination of the possession of the building or construction works;

2) information concerning the technical means used for the covert collection of information in case disclosure of such information would endanger the performance of the function of the security authority. Such information is classified as ‘secret’ for 50 years;

3) breakdown of budgetary expenditure, budget execution reports, budget planning and investments of the security authority. Such information is classified as ‘secret’ for 50 years.

(3) Regarding information reflecting the operation of a security authority upon resolving an emergency, the state secret is information reflecting the operation of the security authority upon resolving an emergency, including the methods and tactics used, and the code of conduct for officials participating in resolving the emergency. Such information is classified as ‘confidential’ for 20 years. Classification expires upon the public use of the information in an emergency.

(4) With regard to information covertly collected upon the performance of the tasks of a security authority and the information reflecting the collection thereof, the following is a state secret:

1) information which has been and is being covertly collected based on the Security Authorities Act, and the work organisation for collection of such information. Such information is classified as ‘secret’ for 50 years. Classification expires in case, according to a decision of the director general of the security authority, the public use of such information is necessary for the performance of the functions of the security authority. This clause does not apply to the logs automatically saved in the equipment of an electronic communications undertaking or a processor of personal data;

2) information specified in clause 1 in case the disclosure thereof would pose a threat to the life or health of a person or to the protection of information classified as ‘top secret’. Such information is classified as ‘top secret’ for 50 years;

3) methods and tactics of the collection of information specified in clause 1. Such information is classified as ‘secret’ for 50 years;

4) information reflecting the methods and sources of signals intelligence. Such information is classified as ‘top secret’ for 50 years;

5) reports containing the lists of acts of covert data collection based on the Security Authorities Act, which do not reflect information classified as ‘top secret’. Such information is classified as ‘secret’ for 25 years;

6) tasks for the collection of information assigned to the security authority by the Government of the Republic and the Security Committee of the Government of the Republic. Such information is classified as ‘secret’ for 25 years;

7) information that is received by the Estonian Internal Security Service during covert collection of information, based on the Security Authorities Act, concerning committed or prepared crimes which do not fall within the investigative jurisdiction of the Estonian Internal Security Service, provided that such information does not reveal the sources of information, the tactics of collection of information or the information specified in clauses 2–6 of this subsection. Such information is classified as ‘restricted’ for 25 years.

(5) With regard to information analysed and synthesised during performance of the functions of a security authority, the following is a state secret:

1) information analysed and synthesised during the performance of the functions of a security authority which concerns foreign states, foreign factors or activity. Such information is classified as ‘restricted’ for 50 years;

2) information analysed and synthesised during the performance of the functions of a security authority which reflects internal or foreign sources of danger. Such information is classified as ‘confidential’ for 50 years;

3) threat assessments prepared by a security authority, except threat assessments specified in clause 3¹ of this subsection. Such information is classified as ‘secret’ for 50 years;

3¹) threat assessments prepared by a security authority concerning the crimes within the investigative jurisdiction of the security authority. Such information is classified as ‘restricted’ for 25 years;

4) threat assessment prepared by a security authority with the aim to provide security protection to an event, object or a person. Such information is classified as ‘restricted’ for 15 years;

5) information specified in clauses 1–4, the source data of which is classified at a higher level or for a longer period than provided in these clauses. Such information is classified based on the highest level and longest term of classification for the source data;

7) proposal or task of a governmental authority to a security authority to analyse or synthesize information specified in clauses 1–3 or to prepare the threat assessment specified in clauses 3¹ and 4, except information the disclosure of which would not damage the security of the Republic of Estonia. Such information is classified based on the proposal or task at the level and for the term determined in clauses 1–4.

(5¹) On the basis of subsection 5 information, which is prepared with the aim to prevent threat or damage to the interests of the state or inform the public of the activities of the security authority, is not classified. Neither is classified part of the classified information which is entered in the criminal file.

(6) With regard to information reflecting structural units of the security authorities, composition of staff and their tasks, the following is a state secret:

1) the structure of a security authority, except the structural units which are published in the statutes of the corresponding security authority. Such information is classified as ‘secret’ for 50 years;

2) the tasks of structural units and staff of the security authority, except information the disclosure of which does not damage the security of the Republic of Estonia. Such information is classified as ‘secret’ for 50 years;

3) the aggregate data concerning the employees of the security authority and the composition of staff performing duties related solely to the covert collection of data. Such information is classified as ‘secret’ for 50 years;

5) assessments given and analyses made during the technical security check by the security authority. Such information is classified as ‘restricted’ for 25 years.

(7) Information concerning a person involved in covert cooperation by the security authority and an undercover official or employee of the security authority, except information specified in subsection 2 of § 6, is a state secret. Such information is classified as ‘top secret’ for 75 years. Classification expires when 20 years have passed since the death of the person but not earlier than 50 years as of the classification of information.

(8) Information concerning a person who has submitted a personal confession concerning service in security or intelligence organisations or cooperation with it to the Estonian Internal Security Service pursuant to the procedure provided in clause 1 of subsection 2 of § 5 of the Procedure for Registration and Disclosure of Persons who Have Served in or Co-operated with Security Organisations or Intelligence or Counterintelligence Organisations of Armed Forces of States which Have Occupied Estonia Act, except in the case the person who has served in security or intelligence organisations or cooperated with them, has committed an offence in relation to such service or cooperation which, according to the law in force in the Republic of Estonia, is punishable as a criminal offence of the first degree or has committed a crime against humanity or a war crime and the committing of an offence or crime by this person has been proved by the court with a judgment which has entry into force, or the person who was in service in the security or intelligence organisations or cooperated with it was the President of the Republic, a member of the Riigikogu, the Government of the Republic or the Supreme Court, is a state secret. Such information is classified as ‘secret’ for 50 years. Classification expires when 20 years have passed since the death of the person but not earlier than 50 years as of the classification of the information.

(9) With regard to information concerning the coordination of the activities of security authorities, their cooperation with the Defence Forces and the work of the Security Committee of the Government of the Republic, the following is a state secret:

1) information reflecting foreign relations in the area of security prepared by the officials of the Government Office conducting the coordination of work of the security authorities and the organisation of work of the Security Committee of the Government of the Republic or by the officials and employees related to organisation and coordination of work of the security authorities in the Ministry of the Interior and the Ministry of Defence unless it contains information specified in clause 2 of this subsection. Such information is classified as ‘restricted’ for 30 years;

2) information reflecting cooperation with a foreign state or international organisation in the area of security of a structural unit of the Government Office conducting the coordination of work of the security authorities and the organisation of work of the Security Committee of the Government of the Republic or a structural unit in the Ministry of the Interior and the Ministry of Defence executing the organisation and coordination of work of the security authorities. Such information is classified as ‘confidential’ for 50 years unless otherwise agreed. Such information is not classified in case it has been made public lawfully;

3) information concerning the topics discussed at the meetings of the Security Committee of the Government of the Republic and its subcommittee, except information which is not deemed a state secret by a decision of the Security Committee of the Government of the Republic or which is disclosed with the aim to prevent threat or damage to the interests of the state. Such information is classified as ‘restricted’ for 25 years;

4) the tasks of the structural unit and staff coordinating the work of security authorities in the Government Office and organising the work of the Security Committee of the Government of the Republic, or of the structural unit and staff guiding and coordinating the work of security authorities in the Ministry of the Interior and the Ministry of Defence, except information the disclosure of which would not damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ for 25 years;

5) threat assessments and a plan for the procurement and analysis of national security information prepared by a structural unit coordinating the work of security authorities in the Government Office and organising the work of the Security Committee of the Government of the Republic. Such information is classified as ‘secret’ for 50 years;

6) information analysed and prepared based on security information by a structural unit coordinating the work of the security authorities in the Government Office and the organising the work of the Security Committee of the Government of the Republic. Such information is classified as ‘secret’ for 50 years;

6¹) information reflecting the guidance and coordination of activities of a security authority prepared by the Ministry of the Interior and the Ministry of Defence, except information the disclosure of which does not damage the security of the Republic of Estonia. Such information is classified as ‘secret’ for 25 years;

6²) information reflecting the supervisory control or audit of a security authority, except information the disclosure of which does not damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ for 25 years;

(9¹) The information specified in clauses 3 and 6–6² of subsection 9 the source data of which is classified at a higher level or for a longer period compared to the provisions in these clauses. Such information is classified based on the highest level and longest term of classification for source data;

(10) With regard to information concerning the persons and bodies simulated by security authorities and covert data used, the information which demonstrates the connection with the security authority of the bodies simulated and covert data used is a state secret. Such information is classified as ‘secret’ for 50 years.

(11) Information available in the document register of the security authority is a state secret. Such information is classified as ‘secret’ or higher level for 25 years and for a longer term in case the register contains information with the appropriate classification level and term.

§ 8. Subcategories of state secret related to protection of infrastructure and data

(1) With regard to information concerning the security, alarm, communication and information systems of the Office of the President of the Republic, the Government Office, a security authority, the Ministry of Defence, the Defence Forces, the Defence League, the Defence Resources Agency, the State Information Systems Agency, Eesti Pank, the Ministry of the Interior, the Police and Border Guard Board and the Ministry of Foreign Affairs, including foreign representations and missions, and the state authorities administered by such governmental authorities, the following is a state secret:

1) aggregate information concerning the electronic access or security system of a building or area in the possession of the authority specified in the introductory part of this subsection to the extent of one building or area or part thereof considered to be an integral whole, which contains data on the location, type, connections between them and other technical indicators of the equipment which constitute the system, including the central processing equipment, or data concerning the security areas or zones or a general description of the system, except information the disclosure of which does not damage the security of the Republic of Estonia. Such information is classified as ‘confidential’ for 30 years;

2) analyses and assessments concerning the operation and efficiency of the electronic access or surveillance system of a building or area in the possession of an authority specified in the introductory part of this subsection, except information the disclosure of which does not damage the security of the Republic of Estonia. Such information is classified as ‘confidential’ for 30 years;

4) aggregate information concerning the electronic access or surveillance system of a building or area in the possession of an authority specified in the introductory part of this subsection to the extent of one building or area or part thereof considered to be an integral whole, which contains data concerning the location and type of the terminal equipment (sensors, cameras or other devices) and concerning the setting of the security areas and zones or system created thereby, except information the disclosure of which does not damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ for 30 years;

7) the set of information processed by the electronic access or security system of a building or area in the possession of an authority specified in the introductory part of this subsection, except information the disclosure of which does not damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ for 30 years;

12) aggregate information concerning the automatic fire alarm systems of a building or area in the possession of an authority specified in the introductory part of this subsection to the extent of one building or area or part thereof considered to be an integral whole, which contains data concerning the location, type, the connection between them and other technical indicators of the equipment which constitute the system, or a general description of the system, except information the disclosure of which does not damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ for 30 years;

14) the analyses and assessments concerning the physical security measures of a building or area in the possession of an authority specified in the introductory part of this subsection, which reflect the functioning and efficiency of the security measures, except information the disclosure of which does not damage the security of the Republic of Estonia. Such information is classified as ‘confidential’ for 30 years;

15) information concerning radio frequencies permanently used for signals intelligence, air surveillance, marine surveillance, security and guarding of objects, and military defence of the state and command thereof in the Defence Forces. Such information is classified as ‘confidential’ for 30 years;

(16) aggregate information on the communications networks and processing systems used for military defence of the state and for its command of the Ministry of Defence, the Defence Forces, the Defence League, the Defence Resources Agency and other processing entities within the area of government of the Ministry of Defence, including aggregate information on the architecture of each communications network and processing system and information on security measures. Such information is classified as ‘confidential’ for 30 years;

18) information reflecting the technical data and security measures of the processing systems used for the processing of information intended for official use only by the Ministry of Defence, the Defence Forces, the Defence League, the Defence Resources Agency and other processing entities within the area of government of the Ministry of Defence, which do not process classified information, except information the disclosure of which would not damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ until the end of the use of the processing system or part thereof, but for no longer than 30 years;

20) information concerning the description of the cryptographic device used in the Air Force Airborne Surveillance Communications System of the air forces. Such information is classified as ‘confidential’ for 10 years;

21) information concerning the description of the keyless cryptographic device used in the airborne surveillance communications system of the air forces. Such information is classified as ‘confidential’ for 10 years;

22) information concerning the description of a cryptograhic device with a key used in the airborne surveillance communications system of the air forces. Such information is classified as ‘secret’ for 10 years;

23) information concerning the communication links schemes in the airborne surveillance communications system of the air forces. Such information is classified as ‘confidential’ for 10 years;

24) information concerning the parameters and operational capacity of the data transmission equipment used in the airborne surveillance systems. Such information is classified as ‘confidential’ for 10 years;

25) information of an authority specified in the introductory part of this subsection concerning the cabling of the networks to the extent of one building or area or part thereof considered to be an integral whole, except information the disclosure of which does not damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ for 30 years or until the network is transferred or its use is terminated;

25¹) information of the authority specified in the introductory part of this subsection concerning the cabling of the processing entity of information classified at the ‘confidential’ and higher level of classification to the extent of one building or area or part thereof considered to be an integral whole. Such information is classified as ‘confidential’ for 30 years or until the network is transferred or its use is terminated;

26) information concerning the methods and means used by the Estonian Foreign Intelligence Service for organising and control of special telecommunications. Such information is classified as ‘confidential’ for 30 years.

(27) technical information and operational parameters of surveillance and security systems, intended for the surveillance of external borders, which are not available from public sources and the disclosure of which would damage the safeguarding of internal security. Such information is classified as ‘restricted’ for 10 years;

]

(28) aggregate information on the structure and technical parameters of monitoring and surveillance systems intended for the surveillance of external borders, which contains a general description of the systems or data on the precise technical characteristics of the equipment included in of the system. Such information is classified as ‘confidential’ for 30 years or until the end of its use;

29) the results of the tests reflecting the coverage areas of the monitoring and surveillance systems intended for the surveillance of external borders. Such information is classified as ‘restricted’ for 10 years;

30) a set of data concerning the detailed technical structure or security methods of data communication intended for surveillance of external borders. Such information is classified as ‘restricted’ for 10 years;

31) a set of data concerning the detailed structure or security methods of the operational radio communication, except for the aggregate figures of the structure of the network. Such information is classified as ‘restricted’ for 20 years;

32) Cyber security risk analyses prepared by the Information Systems Authority and the Ministry of Economic Affairs and Communications, except information the disclosure of which would not damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ for 20 years;

32¹) information collected during the monitoring, surveillance and cyber incident analysis concerning the security vulnerabilities and security measures implemented by a constitutional institution, a government authority, a state authority administered by the government authority, a critical service provider, and the network and information system that is not a classified information processing system of an international organisation located in Estonia and whose security is ensured by Estonia, except information the disclosure of which would not damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ until the termination of the use of the network and information system, but not for longer than 30 years;

(33) information in the set on the architecture of the monitoring and surveillance systems for the surveillance of external borders. Such information is classified as ‘restricted’ for 20 years;

34) information contained in the database of the state information system on the application of covert information and covert measures with regard to a natural person involved in secret cooperation by the Defence Forces, a surveillance agency, a security authority or a witness protection authority, an undercover staff official or employee of a security authority, an undercover agent, a police agent, a person relating to the application of witness protection or a natural person related to a simulated legal person, its structural entity, body or subsidiary of the company, except information the disclosure of which would not damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ for up to 50 years.

(1¹) For the purposes of the National Defence Act with regard to information concerning the national defence objects, except information concerning the surveillance and alarm systems and protective measures for national defence objects in the possession of the authorities specified in subsection 1 of this section and for national defence objects essential for ensuring public order, the following is state secret:

1) aggregate data concerning the electronic access or surveillance systems of a national defence object and minimum measures of physical protection and additional security measures of a national defence object in the risk assessment and security plan of a national defence object in the possession of a public authority or related to the provision of a vital service or ensuring internal security, except information the disclosure of which would not damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ for 10 years;

2) information concerning a national defence object, its exact location and relations with other national defence objects, which would endanger the implementation of protective measures, except information the disclosure of which would not damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ for 20 years.

(2) With regard to information concerning the processing systems of state secrets and foreign classified information, the following is a state secret:

1) security requirements established by the minister in charge of the policy sector for the processing and protection cryptographic material. Such information is classified as ‘restricted’ for 30 years;

2) requirements and measures to ensure radiation security, except information the disclosure of which would not damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ for 30 years;

3) the methodology for the measurement of the detectable radiation of the equipment and location of the processing system and the criteria for the evaluation of the measurement results. Such information is classified as ‘confidential’ for 25 years;

3¹) data concerning the registration of cryptographic material of the processing entity, including the entries in the document register used for registration. Such information is classified as ‘restricted’ for 30 years;

4) the data in the set at the Estonian Foreign Intelligence Service concerning the registration of cryptographic material. Such information is classified as ‘confidential’ for 30 years;

5) the source code of a software specially designed for the processing entity for processing classified information, except information the disclosure of which would not damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ for 30 years;

6) information reflecting the technical data or security measures of the processing system processing classified information at the ‘restricted’ level, except information the disclosure of which would not damage the security of the Republic of Estonia. Such information is classified as ‘restricted’ for 30 years;

7) the conditions for processing information in the information processing system for information classified at the ‘confidential’ or higher level and the division of tasks between users in the processing of classified information. Such information is classified as ‘restricted’ for 30 years;

8) information reflecting the technical specifications or security measures of a processing system processing classified information at a ‘confidential’ level. Such information is

classified as ‘confidential’ for 30 years. In accordance with the procedure established based on clause 17 of subsection 1 of § 22 of this Regulation, such information may be classified at a lower level;

9) information reflecting the technical data or security measures of the processing system processing classified information at the secret level. This information is classified as ‘secret’ for 50 years. In accordance with the procedure established based on clause 17 of subsection 1 of § 22 of this Regulation, such information may be classified at a lower level;

10) information reflecting the technical data or security measures of a processing system processing classified information at the ‘top secret’ level. Such information is classified as ‘top secret’ for 50 years. In accordance with the procedure established based on clause 17 of subsection 1 of § 22 of this Regulation, such information may be classified at a lower level;

11) information reflecting the results of the vulnerability analysis and risk analysis and residual risk assessments of the processing system processing classified information. Such information is classified at the highest classification level of the information processed in the processing system for up to 50 years. In accordance with the procedure established based on clause 17 of subsection 1 of § 22 of this Regulation, such information may be classified at a lower level;

12) information reflecting the operation and efficiency of the processing system processing classified information. Such information is classified at the highest classification level of the information processed in the processing system for up to 30 years. In accordance with the procedure established based on clause 17 of subsection 1 of § 22 of this Regulation, such information may be classified at a lower level.

(3) The information reflecting the technical data and security measures of the processing system specified in clause 18 of subsection 1 and clauses 6 and 8–10 of subsection 2 mean information which sets out:

2) the technical specification of the CIS;

3) network scheme of the processing system;

4) technical information concerning interconnection of the processing system with another processing system;

4¹) information on the security measures applicable in the processing system;

5) information on the cryptographic security measures applicable in the processing system;

6) the security measure applied to compensate for non-compliance with the electronic information security requirement provided in the legislation.

(3¹) Prior to classification of the information specified in clauses 8–12 of subsection 2 of § 8 of this Regulation at the level lower than the highest classification level, the processing entity is required to coordinate the procedure established based on clause 17 of subsection 1 of § 22 of this Regulation with the Foreign Intelligence Service. The guidelines for the requirements based on which the procedures are established are developed by the Foreign Intelligence Service.

(3²) In the case of weapon systems and processing systems for international joint use, the Foreign Intelligence Service coordinates the classification levels of the information specified in clauses 8–12 of subsection 2 of this section in each case separately.

(4) With regard to information concerning the buildings and construction works in use by the structural unit of the Defence Forces, which executes military intelligence, the information concerning buildings and premises adjusted for special needs of the structural unit, except information the disclosure of which would not damage the security of the Republic of Estonia, is state secret. Such information is classified as ‘confidential’ for 50 years or until the possession of the building or construction works terminates.

(5) With regard to information concerning the weapons and munitions warehouses of the Defence Forces and the National Defence League, the following is a state secret:

1) information on the specific requirements for the security of the weapons, ammunition and munition warehouses, except those relating to surveillance systems. Such information is classified as ‘restricted’ for 10 years or until the termination of the possession of the weapons, munition or ammunition warehouse;

2) data on weapons, ammunition and munition warehouses of the Defence Forces and the Defence League in the set. Such information is classified as ‘restricted’ for 30 years.

(6) With regard to the information on the evacuation of classified media of the processing entity, the information on the evacuation of media classified as ‘confidential’ or higher level provided in subsections 2 and 3 of § 33 is state secret. Such information is classified as ‘confidential’ for 20 years.

(7) Regarding information on the surveillance and alarm systems of the security area of the processing entity the following is state secret:

1) information containing data on the location and type of the devices, interconnections between them and other technical characteristics of the devices constituting the electronic access or surveillance system of the security area, or data on security areas or zones, or a general description of the system. Such information is classified as ‘confidential’ until the termination of the use of the area as a security area, but not for longer than 30 years;

2) analyses and assessments reflecting the operation and efficiency of the electronic access or surveillance system of the security area. Such information is classified as ‘confidential’ until the termination of the use of the security area.

3) the analyses and assessments of physical security measures of the security area, which reflect the operation and efficiency of security measures. Such information is classified as ‘confidential’ until the termination of using the area as a security area but not for longer than 30 years.

(7¹) In case the electronic access or surveillance system of the security area of the processing entity is a part of a larger system, only information reflecting the equipment installed in the security area is classified.

(8) With regard to information concerning cash transportation by Eesti Pank, the following is a state secret:

1) information concerning the time of the cross-border cash transportation by Eesti Pank and the amount of cash transported. Such information is classified as ‘restricted’ until the termination of transportation.

2) information concerning the route and provision of security protection to the cross-border cash transportation by Eesti Pank. Such information is classified as ‘confidential’ for 10 years.

(9) With regard to information concerning organisation of uninterrupted communication, information in the set concerning the procedure for organisation of uninterrupted communication and the requirements for uninterrupted information and the list of objects supplied with uninterrupted communication and their communication means is state secret. Such information is classified as ‘restricted’ for 25 years.

§ 9. Submission of application for premature declassification

(1) An authority or constitutional institution that has no competence to declassify a state secret created thereby before the expiry of the term, submits, in the case provided in subsection 4 of § 13 of the State Secrets and Classified Information of Foreign States Act, an application for the premature declassification of the state secret to the Government of the Republic through the minister into whose area of government it belongs. In case the authority or constitutional institution does not belong to the area of government of any ministry, it submits the application to the Government of the Republic through the Minister of the Interior.

(2) The application sets forth the reasons for the need for premature classification, the processing entity to whom such information has been forwarded, and specifies whether, after declassification, such information becomes information intended for official use only. The objections submitted thereto are appended to the application. In the case of information specified in subsection 2 of § 13 of the State Secrets and Classified Information of Foreign States Act, the written consent of the natural person is also appended to the application.

(3) A minister has the right to send the application to the Security Committee of the Government of the Republic for obtaining their opinion.

§ 10. Submission of objections to application

(1) Before application for declassification, the agency or constitutional institution specified in subsection 1 of § 9 informs all the authorities and constitutional institutions to whom a medium containing a state secret has been forwarded of the intention to submit such an application and grants them a term of at least one month for submission of objections. The authorities and constitutional institutions, whose tasks such information may concern, are also notified of, where necessary.

(2) The notice on the intention to prematurely declassify information sets forth the reasons for the need for premature declassification and specifies whether such information would be, after declassification, information intended for official use only.

(3) An authority or constitutional institution which receives such notice submits its objections to the premature declassification of a state secret the latest within the term granted on the basis of subsection 1 of this section.

(4) Upon submission of the application to the Government of the Republic, a minister considers the objections submitted to the application.

§ 11. Notification of intention to declassify by authority competent to declassify

(1) An authority or constitutional institution that is competent to declassify a state secret created thereby before the expiry of the term informs all the authorities and constitutional institutions to whom a medium containing a state secret has been transmitted of the intention to submit such application and grants them a term of at least one month for submission of objections. The authority and constitutional institution whose tasks such information may concern is also given notice, where necessary.

(2) A notice on the intention to declassify sets forth the reasons for premature declassification, the planned date of declassification and an explanation whether, hereinafter, such information would become information intended for official use only.

(3) An authority or constitutional institution that receives such a notice submits their objections to premature declassification within the term granted based on subsection 1 of this section.

(4) Upon deciding on premature declassification, the head of the authority or constitutional institution specified in subsection 1 considers the objections submitted by authorities and constitutional institutions.

§ 12. Notification of authorities and constitutional institutions specified in subsection 3 of § 35 of State Secrets and Classified Information of Foreign States Act of premature declassification

In case an authority or constitutional institution that has received a notice specified in §§ 10 and 11 has forwarded such a state secret to the authority or constitutional institution specified in subsection 3 of § 35 of the State Secrets and Classified Information of Foreign States Act, they notify that authority or constitutional institution of having received the notice on the intention to prematurely classify a state secret. The authority or constitutional institution notified in this manner has the right to submit their objections in accordance with the same procedure before submission of the application for premature declassification or within the term granted by the authority or constitutional institution intending to prematurely declassify information.

§ 13. Notification of premature declassification

(1) In case an authority or constitutional institution declassifies a state secret created thereby before the expiry of the term, they immediately inform all the processing entities that possesses the medium containing that state secret.

(2) In case the Government of the Republic declassifies a state secret before the expiry of the term based on an application submitted or transmitted by a minister, the minister immediately informs of the declassification all the processing entities to whom the medium containing such a state secret has been forwarded.

(3) An authority or constitutional institution that has forwarded a classified medium that has been declassified to an authority or constitutional institution specified in subsection 3 of § 35 of the State Secrets and Classified Information of Foreign States Act, also immediately informs such an authority or constitutional institution of the declassification.

§ 14. Application for extension of term of classification

(1) An authority or constitutional institution that has no competence to extend the term of classification of a state secret created thereby submits an application for the extension of the term of classification to the Government of the Republic through the minister into whose area of government they belong. In case the authority or constitutional institution does not belong to the area of government of any ministry, they submit the application to the Government of the Republic through the Minister of the Interior.

(2) An application for extension of the term of classification of information classified as state secret is submitted to the Government of the Republic, where possible, at least three months prior to the expiry of the term of classification.

(3) The application sets forth the reasons for the need to extend the term of classification and specifies the processing entities to which such information has been forwarded. Any objections submitted to the application are appended to the application.

(4) A minister has the right to refer the application to the Security Committee of the Government of Republic for obtaining their opinion.

§ 15. Submission of objections to extension of term of classification

(1) Before application for extension of the term for classification, the authority or constitutional institution specified in subsection 1 of § 14 is required to inform all the authorities and constitutional institutions to whom media containing the state secret has been transmitted of the intention to submit such an application and grant them a term of at least one month for responding.

(2) A notice on the intention to extend the term for classification sets forth the reasons for extension of the term for classification.

(3) An authority or constitutional institution which receives such notice submits their objections to the extension of the term of classification within the term granted on the basis of subsection 1 of this section.

(4) Upon submission of the application to the Government of the Republic, the minister considers the objections submitted to the application.

§ 16. Notification of extension of term of classification

(1) In case an authority or constitutional institution has extended the term of classification of a state secret created thereby, it immediately informs thereof all the entities in possession of a medium containing such a state secret.

(2) In case the Government of the Republic has extended the term of classification of a state secret based on an application submitted or transmitted by a minister, the minister immediately informs of the extension of the term of classification all the processing entities to whom a medium containing such a state secret has been forwarded.

(3) An authority or constitutional institution that has transmitted a classified medium whose term of classification has been extended to an authority or constitutional institution specified in subsection 3 of § 35 of the State Secrets and Classified Information of Foreign States Act, also immediately informs such an authority or constitutional institution of the extension of classification.

§ 17. Submission of application for correction of classification data

(1) An authority or constitutional institution, whose employee or public servant lacks competence to correct classification data, submits, in the case provided in subsection 1 of § 15 of the State Secrets and Classified Information of Foreign States Act, an application for the correction of classification data respectively to the Government of the Republic or the Minister of the Interior through the minister into whose area of government it belongs. A person holding a Facility Security Clearance submits the application through the authority which supported the grant of Facility Security Clearance for the processing of state secrets to such a person.

(2) The application sets forth the reasons for correction of classification data and provides an explanation whether such data would thereafter become public information without any restrictions to access, or information intended for official use only or classified information, specifying the basis and term for classification, and specifies the processing entities to which such data has been transmitted. Any objections submitted thereto are appended to the application.

(3) A minister has the right to refer the application to the Security Committee of the Government of Republic for an opinion.

§ 18. Notification of intention to submit application for correction of classification data

(1) Before submission of an application for the correction of classification data, notice must be given to all the authorities and constitutional institutions to whom media containing the corresponding state secret has been forwarded, and a term of one month must be granted to respond to such authorities and institutions.

(2) A notice on correction of classification data sets forth the reasons for correction of the classification data and an explanation whether such data would thereafter become public information without any restrictions to access, or information intended for official use only or classified information, specifying the basis and term for classification.

(3) An authority or constitutional institution that has received such notice submits their objections to the correction of the classification data of a state secret at the latest within the term granted on the basis of subsection 1 of this section.

(4) Correction of classification data is decided based on the application and the objections submitted thereto.

§ 20. Notification of authority and constitutional institution specified in subsection 3 of § 35 of the State Secrets and Classified Information of Foreign States Act of intention to correct classification data

In case an authority or constitutional institution that has received a notice specified in §§ 10 and 11 has transmitted a state secret to the authority or institution specified in subsection 3 of § 35 of the State Secrets and Classified Information of Foreign States Act, notifies such authority or constitutional institution of having received a notice on the intention to correct the classification data of a state secret. An authority or constitutional institution notified in such a manner has the right to submit their objections in accordance with the same procedure as the authorities and constitutional institutions that have received the notice on the intention to correct classification data, within the term granted for submission of objections to the correction of classification data.

§ 21. Notification of correction of classification data

(1) In case a processing entity corrects classification data, they immediately inform thereof all the processing entities to whom media containing the corresponding state secret has been transmitted.

(2) In case correction of classification data has been decided by the Government of the Republic based on an application, the ministry that submitted the application informs thereof all the processing entities to whom media containing the corresponding state secret has been transmitted.

(3) In case classification data is corrected by a resolution in a misdemeanour matter or a court judgment, the Estonian Internal Security Service informs thereof all the processing entities to whom media containing the corresponding state secret has been transmitted.

4) A processing entity that has transmitted a classified medium prepared by another processing entity, the classified data of which have been corrected, to a processing entity specified in subsection 3 of § 35 of the State Secrets and Classified Information of Foreign States Act immediately notifies that processing entity of the amendment of the classification data.

§ 22. Requirements for guidelines on protection of classified data of processing entity

(1) The guidelines on the protection of classified data of a processing entity regulate the following issues, taking account of the specific character of the processing entity:

1) procedure for receiving and transmitting classified media arriving from outside and to be sent outside;

2) procedure for registration of classified media;

3) procedure for storage of the key and access code to a safe;

4) procedure for handling a Personnel Security Clearance and Personnel Security Clearance Certificate to classified information;

5) procedure for correction of classification data;

6) procedure for holding classified meetings;

7) location of the security area;

8) guarding of the security area, procedure for entry into, moving within and leaving the security area;

9) an emergency action plan for protection of classified information;

10) notification of a person who has attempted, in any manner, to gain unlawful access to classified information, and notification of violation of the requirements of the State Secrets and Classified Information of Foreign States Act or legislation issued on the basis thereof;

11) list of all such procedures, guidelines and other rules in force regulating the processing of state secrets in the processing entity;

12) method of and procedure for destruction of classified media;

13) scope of the administrative area;

14) procedure for bringing into the security area a weapon and a technical device or another object that can be used as technical means for collection of data;

15) procedure for notification of the loss, suspicion of loss of entry permits or means ensuring entry or of the loss of other possession;

16) appointment of a person with whom a spare key to the lock and lock codes for the safe used to store media classified at the ‘confidential’ and higher level of classification must be deposited for safekeeping.

17) the procedure for determining the classification level of information classified as a state secret which may be classified at more than one level in accordance with this Regulation.

(2) In addition to the provisions specified in subsection 1, the guidelines on the protection of classified information may provide, for example:

1) procedure for the receipt and transmission of classified media within the processing entity (within the limits of the security area, through the administrative area);

2) a specific procedure for transmitting classified media;

3) procedure for reproduction of classified media;

4) procedure for inspection rounds by the local manned guard;

5) specifics of the entry permits for persons with the right of independent entry to the security area compared to the persons who work at the same processing entity;

6) specifics of allowing a visitor to enter the security area compared to the persons who work at the same processing entity;

(3) The part of the guidelines on the protection of classified information, which must be classified, is established as an annex to the guidelines or as a separate document.

§ 23. Requirements for activities of person or structural entity organising protection of state secret at processing entity and chief information security officer (järg)

(1) The person or structural entity of the processing entity organising the protection of state secret is required to:

1) organise the protection of state secrets and compliance with the requirements of the State Secrets and Classified Information of Foreign States Act and legislation issued on the basis thereof;

2) advise employees on the processing of classified information;

3) organise the training of persons with the right of access on issues of the protection of classified information, including in the area of electronic information security;

4) organise the work of the guards of the security area and supervise their activities unless such duty is assigned to another official;

6) keep records of the national Personnel Security Clearance and Personnel Security Clearance Certificates of the employees and ensure that the Estonian National Security Authority has up-to-date information on the posts assigned in accordance with subsection 5 of § 20 of the State Secrets and Classified Information of Foreign States Act;

7) keep records of classified media and verify their existence and integrity in accordance with § 23¹;

8) keep a list of persons who use safes;

9) communicate every 90 days information to the Estonian Internal Security Service, the Defence Forces or the Estonian Foreign Intelligence Service respectively concerning the appointment of persons who do not hold Personnel Security Clearance to posts where the right of access to state secrets classified as ’restricted’ is required, as well as information on the release from the post of a person in such a post and on the decisions to approve the access to state secrets classified as ‘restricted’ to persons outside the service;

10) organise compliance with the requirements of electronic information security and communicate corresponding information to the Estonian Foreign Intelligence Service at their request;

12) participate in the development of the security guide and user guide for the system and ensure that they are made available and accessible;

13) determine the persons who have the right of access to the processing entity or a part thereof, and the content and extent of the right of access unless it has been determined by the head of the processing entity;

14) ensure the issue of physical and electronic means enabling access to information and the periodic exchanging and keeping records of such means;

15) have an overview of the records on the maintenance and repair of the processing systems and of any modifications of their configuration;

17) ascertain the circumstances of non-occurrence of an event or process or of the unauthorised use of the processing system;

18) immediately inform the Estonian Internal Security Service and correspondingly, the Defence Forces, the Estonian Foreign Intelligence Service or the Estonian National Security Authority of becoming aware of a violation of the requirements arising from the State Secrets and Classified Information of Foreign States Act or legislation issued on the basis thereof or of the disclosure of classified information to a person who does not have right of access to information of the corresponding level of classification;

18¹) notify immediately in writing the Estonian Internal Security Service and, in the case of communicating foreign classified information, the Estonian National Security Authority of the use of exemption provided in subsection 2 of § 103 of this Regulation and of the person who has used it except in the cases provided in subsection 3 of § 52 of the State Secrets and Classified Information of Foreign States Act;

18²) organise the storage and destruction of such notifications which are submitted concerning travelling to such countries for which notification obligation applies;

19) take explanations from persons who have violated the requirements of the State Secrets and Classified Information of Foreign States Act or legislation issued on the basis thereof.

(1¹) The chief information security officer of the processing entity in charge of the processing system must participate in the following of the processing system:

1) security risk assessment;

2) the planning of significant changes;

3) the development of security guides and user guides.

(2) The person organising the protection of state secrets of the processing entity or the relevant employees or officials of the structural unit must have the right of access to the information at the highest classification level processed by the processing entity.

(3) The chief information security officer of the processing entity in charge of the processing system must have the right of access to information at the highest classification level processed in the processing system.

§ 23¹. Verification of media

(1) A processing entity verifies registered media in their possession containing ‘secret’ and ‘top secret’ classified information as follows:

1) the existence and integrity of the physical medium is verified directly at least once a year;

2) the existence and integrity of the storage medium, which is not permanently connected to the processing system, is verified directly at least once a year;

3) the existence of the storage medium permanently connected to the processing system is verified at least once a year by means of the software of the processing system, or in the absence of suitable means directly;

4) the existence of a file is checked at least once a year by means of the software of the processing system, or at random directly.

(2) The existence and integrity of the recorded media containing information classified as ‘secret’ and ‘top secret’ located in the archive repository is verified in the manner specified in subsection 1 at least once every five years.

(3) The natural person who has verified the media records the results of the verification in a form that can be reproduced in writing and submits them to the person organising the protection of state secrets in the processing entity.

(4) The results of the verifications carried out by means of the software of the processing system may be recorded in the form of log files.

[

§ 23². Determination of the classification level of information subject to classification at multiple levels

Unless the guidelines for the protection of classified information of the processing entity regulates the procedure for determining the classification level of the information classified as a state secret, which may be classified at multiple levels in accordance with this Regulation handled by the processing entity, the information must be classified at the highest classification level provided in the grounds for classification of information.

§ 24. General requirements for security area

(1) A security area must have a defined and protected external border, at which it is possible to control all the entrances and exits, and an entry and exit control system that allows only a person with the required level of access rights to enter the security area independently.

(2) The use of an area as a security area must be priorily coordinated with the Estonian Internal Security Service, the Defence Forces or the Estonian Foreign Intelligence Service respectively-

(3) The Estonian Internal Security Service, the Defence Forces or the Estonian Foreign Intelligence Service may grant exemptions from the requirements for security areas provided in this Regulation with regard to a specific building or processing entity in case the application of the requirements is not technically possible or it is impossible due to reasons arising from law, or in case the compliance with the requirements for the security area may be guaranteed by other means.

(4) The general requirements for the security area are applied to the temporary and mobile security areas in so far as it is not provided otherwise in this Regulation.

(4¹) The requirements for a security area are specified in the guidelines developed by the Estonian Internal Security Service in cooperation with the Defence Forces and the Foreign Intelligence Service.

(5) Upon termination of the use of an area as a security area, the authority which granted their approval for such a use is informed thereof within 30 days as of the termination of the use.

§ 25. Location of security area

(1) A security area of the processing entity must be located in the premises which are in the direct possession of the processing entity.

(2) Before planning the establishment of a security area, the representatives of the authority competent to grant approval must be consulted in order to determine the best possible location for the security area in the building,

(3) Where possible, a security area is not be established on the first or last floor of a building.

(4) Where possible, the location of a security area in a building is chosen so that in case there are windows they would face the territory in the possession of the authority processing state secrets.

(5) Persons and structural entities which process state secrets and classified media must be located, where possible, in a close proximity to each other, for example, in one and the same room or one and the same wing of a building in the authority.

§ 26. Mobile and temporary security area

(1) As an exception, a security area may also be established on moving platforms (hereinafter mobile security area) or areas which are not usually used as a security area (hereinafter temporary security area). A vehicle, trailer, ship, bunker, container, site accommodation, tent, or other existing construction works suitable for such function may be used as mobile or temporary security areas. Where possible, a permanent structure must be used as a temporary security area.

(2) The introduction of such a security area must be priorily coordinated with the Estonian Internal Security Service, the Defence Forces or the Estonian Foreign Intelligence Service respectively. An authority applying for the coordination of a mobile or temporary security area is required to submit a written request for such coordination to the coordinating authority at least 30 days before the introduction of such a security area.

(2¹) A security authority may take into use a mobile or temporary security area by the decision of its head or a person authorised thereby without the coordination of another security authority specified in subsection 2. The security authority notifies the other security authority in writing at the earliest opportunity of the taking into use of a mobile or temporary security area.

(2²) Following a decision to organise an additional reservist training, the Defence Forces may take into use a mobile or temporary security area for the duration of the additional reservist training by the decision of the Commander of the Defence Forces or a commander authorised thereby, informing in writing the structural unit in the Defence Forces organising protection of state secret at the earliest opportunity.

(3) In urgent circumstances, the time limit specified in subsection (2) may be shortened with the consent of the coordinating authority.

(3¹) In the event of the taking into use of a mobile or temporary security area, in which the foreign classified information is processed, in the case specified in subsection 2 the coordinating authority and in the case specified in subsections 2¹ and 2² the authority which has taken into use the security area informs the Estonian National Security Authority in writing at the earliest opportunity.

(4) Where possible, all the requirements for security areas are applied to mobile and temporary security areas and, where not possible, the security of classified information is guaranteed by other means.

(5) During an emergency situation, a state of emergency, increased defence readiness, state of war, mobilisation and demobilisation the mobile and temporary security areas may be established based on an oral order by the head of the authority in possession of a state secret or foreign classified information. An order given orally is recorded also in writing at the first opportunity. Agencies whose activities presume, under such circumstances, the establishment of a mobile or temporary security area must provide information to this effect in the crisis management plans of the agencies themselves, as well as in the plans of other levels, such as counties and ministries, and inform the coordinating authority thereof.

(6) Only the classified media needed for the performance of a particular task is processed within a mobile or temporary security area. After termination of the need for processing, the classified media is moved to a permanent security area immediately.

(7) Upon choosing a location for a mobile or temporary security area, above all, the efficient and safe performance of the task must be given priority.

(8) The head of an authority must appoint a person who is responsible for the security measures to be applied for the protection of classified media within a mobile or temporary security area (hereinafter responsible person).

(9) In case discrepancies from the data submitted for coordination become evident upon using the security area, the responsible person must notify the coordinating authority thereof in writing at the latest within thirty days after such modification took place.

§ 27. Walls, ceiling and floor of security area

(1) The walls, ceiling and floor of a security area must be made of concrete, steel or stone so that the details of which the walls, ceiling or floor consist of could not be easily removed from outside.

(2) A wall between two security areas or an internal wall within a security area may be of a light construction. The exterior walls, ceiling or floor of a security area may be of a light construction in case a permanent manned guard is present in the building or in case they have been strengthened by adding physical barriers or technical surveillance equipment.

(3) A security area must be soundproofed to the extent where sounds originating from such an area would not be heard in the neighbouring premises.

§ 28. Door to security area

(1) The door at the external border of a security area (hereinafter door to security area) must be, in the opinion of the coordinating authority, sufficiently secure to allow the security guards to react to attempted intrusion before the intruder has crossed the physical barriers.

(2) The hinge side of the security door must be provided with security latches which close into the frame upon closing the door. The door to the security area must be equipped with an automatic closing device that ensures that the door closes automatically within a predetermined time, and a sensor which gives a signal in case the door has been open for longer than assigned.

(3) In case a proper door to the security area cannot be installed, the door to the security area must be guarded with additional surveillance and alarm system equipment.

(4) The door to the security area must be fitted with at least two locks, at least one of which must lock automatically, and with at least one mechanical security lock. The tumbler of the security lock must be protected.

(5) Mechanical locks of the security area cannot be openable with the same key with which other mechanical locks in the building can be opened. In case this requirement cannot be met, the keys must be stored under the same conditions as the keys to a safe.

§ 29. Window of security area

(1) The window of a security area located at an easily accessible place, such as a roof, terrace or on the extension of the building, must be fitted with anti-burglar security elements. Other physical barriers or security or alarm system equipment must be used to increase the safety of a window, where necessary.

(2) The windows of a security area must be covered with a curtain or toned film so that it would not be possible to observe from the outside what is going on inside the security area

§ 30. Other opening of security area

Other opening located in a security area must be protected with physical barriers or security and alarm system equipment to prevent the unlawful installation of technical equipment in the security area or other danger to the information contained in the classified media stored within the security area.

§ 31. Open storage area

The external walls, ceiling or floor of an open storage area cannot be of a light construction.

§ 32. Structural protection of mobile and temporary security area

(1) A mobile or temporary security area must have an external boundary clearly defined and protected by a physical barrier which allows control over all entries and exits. At the demand of the coordinating authority, the location of the security area must be changed, the structure of the security area strengthened, and additional barriers used.

(2) The structure of a mobile or temporary security area must guarantee that access or danger to classified information from outside of the security area would be precluded.

§ 33. Evacuation plan

(1) A plan for evacuation of classified media in the case of emergency situation must be prepared with regard to a security area.

(2) The evacuation plan must set out all the possible emergencies in the case of which classified media must be evacuated or destroyed.

(3) For each emergency situation defined on the basis of subsection 2, it must be prescribed how the evacuation or destruction is carried out, who organises it, what means are used for this purpose, where classified information is evacuated.

§ 34. General requirements for guarding of security area

(1) A surveillance and alarm system (hereinafter surveillance equipment), an access system and a manned guarding must be provided for guarding the security area.

(2) The surveillance equipment and the access system of the security area, together with the physical protection measures, must ensure that the manned guard would be able to respond to an intrusion attempt before the intruder has crossed the physical barriers.

(3) The security area or part thereof must be under surveillance when it is not occupied.

§ 35. Requirements for surveillance equipment

(1) The surveillance equipment must:

(1) immediately alert the manned guard and the person designated by the head of the processing entity in case an intrusion or attempted intrusion occurs or in case of a failure of the surveillance equipment has occurred;

3) enable to switch on and off separately the surveillance of the security area;

(4) automatically detect faults in the surveillance equipment;

5) in interaction with the access system, enable the identification of entry into and exit from the security area by a person and, where possible, also a part of the security area;

6) enable electronically identify the switching on and off of the security system, surveillance of the security area, activation and deactivation of the security of the security area, the alarm time and, in interaction with the access system, the entry into and exit from the security area of a person and, where possible, to the part thereof. The data of the specified act are kept for at least one year.

(3) The backup power supply of the surveillance equipment used for the protection of state secrets ensures the operation of the surveillance equipment in the event of a failure of the main electrical system until the security area is taken under manned guarding.

(4) The central unit of the surveillance equipment and its control unit must be located in the security area. Only such a control equipment may be located in the administrative area, which allows only the user with special rights to control or configure the surveillance of the security area, or only to switch the surveillance of security area on and off.

§ 36. Manned guarding of mobile and temporary security areas

(1) A mobile or temporary security area must be protected by mobile or stationary armed guards, who monitor the entire protected area. The surveillance of the security area may be carried out by guards of the guarding team as well as by instructed persons working 24 hours a day in the security area.

(2) In case the continuous staffing of a mobile or temporary security area cannot be ensured, an alarm system must be installed in the mobile or temporary security area, which transmits the alarm signal to the guarding team or instructed security area personnel, who must arrive at the security area within the response time agreed with the coordinating authority. The response time may not exceed the time that it takes the intruder to overcome the physical barriers.

§ 38. Right of on-site manned guard to access state secrets

On-site manned guard patrolling the security area must have the national Personnel Security Clearance at least at the level at which classified information is being processed within the security area under surveillance.

§ 39. Presence of persons in security area

The procedure for presence of persons in a security area must take account of the right of access and need-to-know of a person and must identify the entry into and exit from the security area by persons.

§ 40. Access of persons with independent right of access to security area

(1) A person who has an independent right of access to a security area is issued an entry permit in which the number of the permit is entered. An entry permit need not be issued in case the security area consists of only one or two rooms.

(2) A processing entity must keep record of the right of access, means of access and entry permits of persons with the right of access to the security area.

(3) The person working in the security area must wear the entry permit in a visible place so as to enable identification of the person. The requirement to carry the permit in a visible place does not apply to security authorities. Outside the security area and the administrative area, the permit must not be carried in a visible place.

(4) The procedure for entry into and exit from a security area must ensure the identification of persons with an independent right of access upon entry and exit.

(5) In the case of loss, suspected loss of an entry permit or an object ensuring entry or loss of other possession, notice thereof must be immediately given to the duly appointed person in the processing entity, who take measures for preventing the use of the entry permit or an object ensuring entry.

§ 41. Presence of visitors in security area

(1) A visitor may be admitted to the security area in accordance with the procedure provided in the guidelines on the protection of the classified information of the processing entity.

(2) A visitor is issued a numbered visitor's permit, which has the word KÜLALINE [visitor] on it, and enables the identification of the person who has been granted the permit. A visitor must carry the visitor's permit in a visible place.

(3) A visitor’s permit need not be issued:

1) in case the security area consists of one or two rooms;

2) to a member of a delegation of a foreign visit of national importance or of high-ranking guests visiting Estonia.

(4) The issue and return of the visitor’s permit, the time of arrival and departure of the guest, the given name and surname of the guest must be recorded. The guest must be identified based on a valid identity document. A member of a delegation of a foreign visit of national importance or of high-ranking guests visiting Estonia may be identified in another manner.

(5) A visitor may move within the security area only together with the host or with the person assigned to escort the visitor. It is prohibited to leave the visitor alone in the security area unless the visitor has the right of access to the corresponding level of classification of state secrets which are processed in the security area, taking account of the need-to-know principle.

§ 42. Requirements for working in mobile and temporary security areas

(1) In case of relocating the temporary security area the person responsible for the temporary security area must inspect the abandoned security area and make sure that there are no classified media left in the area.

(2) When the work in the temporary security area has been completed, the classified media must be delivered to the permanent security area of the authority for comparison of data and destruction of the material that have served their purpose.

(3) The physical security measures in place in the temporary security area must be strengthened, where necessary, also after the use of the security area has been coordinated.

§ 43. General requirements for conduct of meetings

In order to organise a consultation, meeting, conference or other gathering (hereinafter a meeting) dealing with classified information the following requirements must be complied with:

1) the organizer of a meeting dealing with classified information and the participants through the technical means must ensure that only the persons who have a right of access to the classified information at the level to be discussed and a need-to-know have access to the meeting;

2) what takes place within the meeting room cannot be heard or seen from outside.

§ 44. Holding meetings within security area and administrative area

(1) The premises used for holding meetings must be located within the security area.

(2) Rooms which are used for the conduct of a meeting on state secrets classified as ‘restricted’ may also be located in an administrative area and the requirements provided in this subchapter need not be applied to the rooms.

§ 45. Periodic checking of meeting rooms

(1) There must be periodic checking to ensure that there are no illegal information gathering devices in the meeting room.

(2) During the holding of a meeting, there must not be any previously unchecked item or technical device in the meeting room that can be used to illegally collect information.

]

§ 46. Recording of meeting and taking notes at meeting

(1) Recording of a meeting and taking notes at a meeting is permitted only with the consent of the organiser of the meeting.

(2) The recordings made and the media containing the notes of each participant in the meeting are processed in accordance with the level of classification of the information contained therein.

§ 46¹. General requirements for administrative area

(1) An administrative area must have a clearly defined external border at which all entrances and exits can be controlled, and an entry and exit control system that allows the identification of all the persons and vehicles that have entered.

(2) The requirements for the administrative area are specified in the guidelines that are drawn up by the Estonian Internal Security Service in cooperation with the Estonian Defence Forces and the Estonian Foreign Intelligence Service.

§ 46². Processing of classified information in security and administrative areas

(1) The processing entity processes classified information in their possession, in general, within their security area.

(2) The processing of classified information in the security area of another processing entity is permitted only with the consent of the Estonian Internal Security Service, the Defence Forces or the Foreign Intelligence Service. Upon granting the specified consent only such requirements for the security area are assessed, the compliance with which was a prerequisite for considering the processing of classified information in the security area permissible.

(3) Classified information may be processed without the consent of the coordinating authority provided in subsection 2:

1) within the security area of the processing entity whose official or employee has a need-to-know in respect of the particular information to be processed, provided that the official or employee is directly present at the processing of the information;

2) within the security area of the security authority;

3) within the security area of a diplomatic mission or consular post;

4) within the security area of the Ministry of Defence and the government authority in the area of government thereof.

(4) A processing entity may also process restricted classified information in the administrative area in their possession or, with the consent of another processing entity, in the premises of another processing entity.

§ 46³. Classification level of set of classified information

Where a set of classified information or media consists of parts with different levels of classification, the highest level of classification of those parts is considered to be the level of classification of the set of information, the medium carrying it and the media in the set.

§ 47¹. Storage medium containing classified information

A storage medium that is considered to be and processed as the storage medium containing classified information until its destruction is a storage medium:

1) on which classified information has been recorded, regardless of whether the information is subsequently erased, unless otherwise specified by the Internal Security Service or the Foreign Intelligence Service at the time of the handling of an incident;

2) which is part of a processing system, regardless of whether the storage medium is designed by the technical design of the processing system to store classified information, unless otherwise specified by the Foreign Intelligence Service upon accreditation of the processing system.

§ 48. Original medium

(1) The first registered copy of the medium created by the processing entity is considered to be the original medium. Other copies of the medium and media received from another processing entity are handled and processed as copies.

(2) Where the original of a physical medium in the possession of a processing entity is transmitted to another processing entity, it is additionally marked 'Originaal'[original]. A medium so marked is treated as an original and processed accordingly.

§ 49. Register of classified media

(1) A processing entity is required to establish a register of classified media (hereinafter also the register) for the purpose of registration of classified media.

(2) Separate registers may be established for the registration of ‘top secret’, ‘secret’, ‘confidential’ and ‘restricted’ classified information depending on the number of classified media.

(3) Media classified as ‘restricted’ may also be registered in the general register of documents by the decision of the head of the processing entity, provided that it is ensured that the classified information cannot thereby become known to unauthorised persons.

(4) The register may be divided into the main register and sub-registers. The establishment of a sub-register is decided by the head of the processing entity.

§ 50. Requirements for register

(1) The register is kept electronically or, where appropriate, on paper.

(2) The register entry itself must not, where possible, contain classified information.

(3) The processing entity must ensure the permanent preservation of the register data.

§ 51. Data entered in register

(1) The following data is entered in the register with regard to classified media:

1) data necessary for the identification of a medium: registration date and number, the name of the processing entity that has created it, and for a document also its title and the name of the person who prepared and signed the document or confirmed the content. Each copy need not be given a new registration number in case the consecutive number of the copy is specified;

2) the name of the processing entity that has transmitted the medium, registration date and number in case the medium has arrived from another processing entity;

3) the type of a medium;

4) the basis for classification of a medium, level of and term for classification, their modification and the basis for modification;

5) in the case of a physical medium, the quantity of copies and copy numbers of the document. The quantity of copies and copy numbers need not be entered in the register for media classified at the ‘confidential’ and lower level;

6) in the case of physical medium the quantity of the parts and pages of the document. In case a document has been prepared on both sides of a page, the quantity of pages of such a document is registered in the register of classified media, with a note that the document has been prepared on both sides of a page;

7) in the case of a physical medium the quantity of copies. The quantity of copies need not be entered in the register for media classified at the ‘confidential’ or lower level of classification;

8) the name of the processing entity to whom the medium has been forwarded and the time of transmission; in the case of a physical medium the number of the instrument of delivery and acceptance;

9) a note in case the other processing entity has been given consent to transmit classified information contained in the medium to a third processing entity;

10) a note concerning the destruction of the medium, including the registration date and number of the instrument of destruction;

11) the name of the person who has been granted access to information on a medium classified as ‘secret’ or higher level, and the method and time of granting access;

12) additional security measures assigned to the medium, in case they are applied to the processing entity keeping the register, and the name or post of the person who has a need-to-know regarding the medium, who is related to the processing entity keeping the register;

13) in the case of an electronic document, information that allows checking the integrity of the document.

(2) The following information about the storage medium, where available, is entered in the register:

1) data necessary for identification of the storage medium: registration date and number, data enabling unique identification of the storage medium;

2) the name, registration date and number of the processing entity that forwarded the storage medium, in case the storage medium has arrived from another processing entity;

3) type of storage medium;

4) the highest level of classification of the information contained in the storage medium;

5) the name of the processing entity to which the storage medium was transferred, as well as the time of transfer and the number of the instrument of delivery and acceptance;

6) a note on whether another processing entity has been granted permission to transmit the classified information contained in the storage medium to the third processing entity;

7) a note on the destruction of the storage medium, including the registration date and number of the report of destruction;

8) the name of the person to whom the storage medium classified at a ‘secret’ or higher level was handed over, and the time of the transfer;

9) additional security measures assigned to the storage medium, in case they are applied to the processing entity keeping the register, and the name or post of the person who has a need-to-know with regard to the storage medium and who is related to the processing entity keeping the register.

§ 52. Registration of classified media

(1) A classified medium is registered at the latest on the working day following its completion or arrival. A classified medium is generally considered completed when it is signed or electronically confirmed. The storage medium is registered at the latest when it is taken into use.

(2) A classified medium is generally registered once. A classified medium registered in the main register does not need to be registered in the sub-register of the same processing entity.

(3) In case the set of classified documents also contains unclassified media, the unclassified media included in the set may be registered in the register of classified media. In case the set consists of separately used classified documents, each document that is part of the set may be registered separately.

(4) In case the medium contains both state secrets and foreign classified information, the medium is registered in the register established for the registration of state secrets of the corresponding level.

(5) It is not necessary to register:

1) an electronic message processed in the processing system, in case the information processing is fixed using the software of the processing system;

2) a copy made of a medium classified at the ‘secret’ or higher level processed in the processing system, in case the processing of the information is fixed using the software of the processing system.

§ 53. Registrar and maker of register entry

(1) The person organizing the management of the register and information entered in it (hereinafter the registrar) must have the right of access to the highest classification level of the media registered.

(2) Registrars and other persons with the right to make register entries and the extent of the rights of these persons is determined by the head of the processing entity or a person authorized thereby.

§ 53¹. Transfer of classified medium within processing entity

(1) The transfer of a physical medium to another natural person in the service or contractual relationship with the same processing entity must be fixed in writing separately from the medium or with electronic confirmation in the document management system.

(2) The following is noted on the transfer:

1) the registration date and number of the medium, the highest level of classification and the number of entities to be transferred;

2) date and time of transfer;

3) name and signature or electronic confirmation of the recipient;

4) name and signature of the transferor or electronic confirmation.

(3) Data on the transfer of a classified medium are stored in the security area or in the document management system for at least ten years. A physical medium on which the data on the transfer of a classified medium is recorded may be destroyed after five years in case it has been digitized.

(4) This section does not have to be applied upon the transfer of an unregistered copy of a medium classified as ‘confidential’ and medium classified as ‘restricted’.

§ 54. Confirmation of access to classified information

(1) A person gives a signature to the access sheet or provides an electronic confirmation on the access to the information contained in a medium classified at the ‘secret’ and higher level of classification.

(2) In the processing system, a separate confirmation of access is not necessary in case the identification of the person and the time of access is ensured electronically.

(3) In case it is not possible to provide a signature or electronic confirmation during the access to the information contained in the medium, the identity of the examiner and the time of access are fixed in another manner, and the signature or confirmation is taken at the first opportunity. In case the visitor is a citizen of a foreign state and their identity, and the time of the access are fixed in another manner, signature or confirmation is not required.

(4) Access sheets and other data on the access to information are stored for at least 75 years, but not less than the medium which contained the information examined.

(5) An access sheet on a physical medium may be destroyed after five years have passed in case it has been digitized.

§ 54¹. General principles of marking of classified information, medium and set of media

(1) Classified information and medium are marked, taking into account its type and characteristics, in the best possible way which does not damage the integrity of the information or the medium, with the aim that:

1) its holder would be able to clearly understand that it is classified information;

2) its processor in any way would be able to find out its classification level, basis for classification, classification term and registration date and number, as well as additional security measures and persons with a need-to-know with regard to the medium, in case they are designated.

(2) In addition to the provisions of subsection 1, the set of classified media are marked in a manner that makes it possible to clearly understand that it is a set of media.

§ 55. Marking of classified media containing state secret

(1) The classified medium containing a state secret is marked as follows:

1) marking of the level of classification;

2) marking of the basis of classification;

3) marking of the classification term.

(2) The marking of the level of classification is the text corresponding to the highest classification level of ‘top secret’, ‘secret’, ‘confidential’ or ‘restricted’. The marking of the level of classification is made in a double-spaced bold printed type with at least 16-point capital letters or with a stamp or sticker bearing red text in compliance with the same requirements.

(3) The marking of the basis of classification is the text "State secret on the basis of...", in the blank of which is entered a reference to this Regulation and its relevant section, subsection and clause. In case the classified medium is classified on several legal grounds, all grounds are entered in the blank.

(4) In addition to the marking specified in subsection 1, the registration date and number are entered on or next to the registered medium.

(5) In case it is not possible to mark the medium due to the type, material, size or other characteristics of the medium in compliance with the requirements provided in subsections 2-4, one or more of the following exceptions may be applied, provided that the marking is easily visible and readable and the purpose specified in § 54¹ is met:

1) make the marking in a different manner or in denser, thinner, smaller, lowercase letters or in a font of a different colour;

2) make the marking consisting only of the marking of the level of classification and the registration date and number;

3) make the marking, instead of the medium, on its cover, packaging or on a label attached to the medium.

(6) In case the making of the marking in compliance with requirements provided in subsections 2–4 threatens the classification of a state secret entered on a medium, the medium may be left unmarked provided that the purpose specified in subsection 1 of § 54¹ is achieved in another manner.

(7) Upon transmitting a medium containing a state secret to a foreign state, an international organization or an institution established by a international agreement, the marking is made on the medium in compliance with the level of classification in accordance with the requirements of the international agreement, and the marking „Classified as State Secret of the Republic of Estonia" is made on the front page in English.

(8) The compiler of the medium is responsible for the proper marking of the classified medium.

§ 58. Additional marking concerning security measures and persons with need-to-know

An additional marking may be made on the classified medium next to the marking or in another clearly visible place about additional security measures or the name or post of a person who has a need-to-know regarding the medium.

§ 59. Additional marking of packaged medium and set of media

(1) In case the classified medium packaged for storage is stored in a package, case or in another manner in such a way that the marking is hidden, an easily visible and clearly legible additional marking is made on the package or case.

(2) Section 88 applies to the marking of classified medium packaged for transport.

(3) In case the classified media make up a set, an easily visible and clearly readable additional marking corresponding to the highest classification level of the set is made on the cover of the set.

§ 60. Amendment of marking

(1) In the case of declassification, additional marking is made or the marking is amended in a manner that enables the holder to understand that it is no longer a classified medium.

(2) In case the medium allows, upon premature declassification the text "Salastatus kustutatud … alusel” [classification deleted on the basis of...] is marked on the medium or next to it, in the blank of which the name of the body that made the declassification decision and the details of the decision, and the date of entry into force are entered.

(3) In case the medium allows, upon extending the classification period, the text " Salastatus pikendatud … alusel” [classification period extended on the basis of...] is marked on the medium or next to it, in which the name of the body that made the extension decision and the details of the decision are entered, and the new classification period is indicated.

(4) In case the medium allows, additional marking is made upon correcting the classification data or incorrect marking is changed and the text " Salastatus parandatud … ” [classification corrected...] is marked on the medium or next to it, in the blank of which the name and signature of the body or official who made the decision to correct the classification data and the details of the decision are entered.

(5) The marking of the medium is amended and an entry about it is made in the register at the earliest opportunity.

(6) The marking of the medium in the archival repository is changed in case of its processing, except for acts directly related to its storage and preservation.

§ 62. Numbering of pages

(1) Each page of a paper document is numbered and the total number of pages is marked on each page. Where a document is printed on both sides of a page, the pages must be numbered and marked accordingly.

(2) Each page of an electronic document is numbered beginning with the first page and the total number of pages is marked on each page.

(3) Where a paper document does not allow numbering pages, it must have other data that allow checking the integrity of the information. Where the electronic document or its medium does not allow numbering pages, it must, where possible, have other data that allow checking the integrity of the information.

§ 63. Marking of document

In case a paper document or an electronic document and its medium allow, the classified document is marked as follows:

1) on a document containing a state secret, the basis of classification and the term of classification are marked in the right corner of the header of the front page, the registration date and number in a clearly visible place, and the level of classification is marked in the middle of the header and footer of each page;

2) on a document containing foreign classified information the marking provided in subsection 1 of § 118¹ is made on the first page and the additional marking provided in subsection 3 of the same section in the right corner of the header of the first page.

§ 64. Marking of annex, copy and extract of document

(1) An annex to a document that is used without the main document is marked as a separate document.

(2) The copy of the paper document is marked with the additional mark "Koopia"[copy].

(3) An additional marking "Väljavõte” [extract] and a reference to the original document is made to the extract of the document.

§ 65. Marking by text sections and illustrations

(1) In case text sections or illustrations of a document have different levels of access restriction or different originators of foreign classified information, the document may be marked by text sections or illustrations.

(2) The marking specified in subsection 1 is made in parentheses in capital letters at the beginning of the relevant paragraph or before or after the illustration and, where necessary, also at the end of the paragraph or after or below the illustration.

(3) Markings of the access restriction level of a text section or an illustration may be presented in parentheses as an abbreviation, using the marks "P", "K", "S" or "TS"[restricted, confidential, secret, top secret], in the case of a state secret.

§ 67. Marking of set of documents

(1) A set composed of classified documents is marked with the marking indicating the highest classification level of state secret.

(2) In case a set of paper documents has been joined together in a file or is stored between covers in another manner, the marking of the highest classification level is made in the header and footer of its front and back cover of the file.

(3) In other cases, the marking of the highest classification level is made in the header and footer of the first page of the first document in the set.

(4) In case the front page of a set does not contain a state secret, an additional notation "Märgistatud riigisaladusena kui kogumi esileht" [marked as a state secret as the front page of a set] is made in the right corner of the header of a document.

§ 70. Marking of file

In case the file allows it, the classification level of the file containing classified information is marked in capital letters at the beginning of the file name, and the highest classification level of the set of files is marked at the beginning of the name of the set. In case the name of the file or set of files has a date stamp at the beginning, the classification level may be indicated after the date stamp. Where appropriate, the marking may be given in brackets or as an abbreviation otherwise visually distinguishable, using the characters 'P', 'K', 'S' or 'TS' for state secrets.

§ 71. Marking of electronic messages

The marking of the classification level of an electronic message is made in capital letters at the beginning of the body of the message and, where necessary, also at the beginning of the title or subject line of the message and at the end of the body of the message. The marking at the beginning of the title or subject line of the message may, where necessary, be given in brackets or as an abbreviation otherwise visually distinguishable, using the characters 'P', 'K', 'S' or 'TS' for state secrets.

§ 72. Safe

(1) Media classified at the ‘confidential’ and higher level is stored in a break-proof safe with a code lock. The deployment of the safe is subject to prior approval by the Internal Security Service, the Defence Forces or the Foreign Intelligence Service accordingly, unless the break resistance of the safe meets at least the requirements of the standard EVS-EN 1143-1 Class 1.

(2) The medium classified as ‘restricted’ is stored in a safe, locked cabinet or drawer, which is protected from access by unauthorised persons.

(3) A safe in which a medium classified at the ‘confidential’ or higher level is stored must be located in the security area.

(4) In case a safe is used by several persons, the safe must be physically divided into parts on a basis of a need-to-know principle. In such a case, the safe must have separately lockable parts.

(5) With the authorisation of the coordinating authority, the classified media may be stored in a public storage area. Upon granting such authorisation, additional conditions for storage in an open storage area may be specified, including the highest classification level of information, method of storage and additional protective measures.

§ 73. Storage of classified media during their use

(1) Following removal from a safe or other place of storage, classified media must be under continuous surveillance. In case the classified documents are not being used at any given moment, they must be kept the blank page facing upwards or pinned.

(2) Upon leaving the room, the classified medium must be locked away in a safe, cabinet or drawer according to the level of classification.

§ 74. Exceptions to general storage conditions

(1) In case it is not possible to meet the requirements for the storage of classified media in the processing entity, the classified media must be deposited temporarily with state authority where the requirements for storing classified media are met.

(2) The coordinating authority may authorise the use in mobile and temporary security areas of safes with a lower burglary resistance class than that provided in subsection 1 of § 72.

(3) In exceptional cases, the coordinating authority may authorise the use of other means of storage for storing classified media, such as storage in a packaged form within the security area of the receiving base or headquarters, in a locked metal box, leather pouch or elsewhere.

(4) In exceptional cases, media classified as ‘secret’ or ‘confidential’ may, with the authorisation of the head of the authority, be stored in a metal filing cabinet or in a drawer for a short period, for example, until a safe of appropriate size is obtained, provided that the storage place is located in the security area and is equipped with a lock with at least one locking bolt or a lock with three-part key combination. one locking bolt or a lock with a three-part key combination.

(5) A storage medium forming part of a processing system may be stored in a computer located in the security area or administrative area, depending on the classification level, without locking the medium in a safe or cabinet, provided that the Foreign Intelligence Service has given their authorisation thereto upon accreditation of the processing system.

§ 75. Lock code of safe

(1) Only the user of a safe is allowed to know the lock code of the safe.

(2) The lock code may not consist of a series of numbers or characters that can be easily guessed, such as dates of important anniversaries, telephone numbers, arithmetic sequences.

(3) Lock codes must be changed:

1) upon change of the user;

2) after opening without the presence of the user;

3) in case there is reason to believe that the code has become known to an unauthorized person;

4) after 12 months have passed from the last changing.

§ 76. Keys and locks to safes

(1) The key to the safe may be in the hands of the user of the safe during working hours.

(2) In case the safe used for the storage of media classified at the ‘confidential’ and higher level has a key in addition to a code lock, and the user of the safe leaves the security area or the administrative area surrounding it into a public space, the key to the safe must be locked into the key cabinet.

(3) The locks to the safe must be changed in case there is reason to believe that the key to the safe has fallen into the hands of an unauthorised person.

§ 77. Key cabinet

(1) A key cabinet must be made of metal, be lockable and be under continuous surveillance.

(2) I case a key cabinet is used by several persons, it must be guaranteed that each user gets only the key that they need.

§ 78. Storage of spare keys and lock codes to safe

(1) The spare key and lock code of the safe are given in a sealed envelope to the person specified in the instructions for the protection of classified information who keeps them in a separate safe. The date of changing the lock code is marked on the envelope. In exceptional cases, spare keys and lock codes may be kept in another secure manner with the prior authorization by the coordinating authority.

(2) The key and lock code to the safe may be kept in a bank safe.

(3) Other notes of the code to the safe lock are prohibited.

§ 79. Key or lock code to safe, cabinet or drawer used to store medium classified as ‘restricted’

(1) The key or lock code to a safe, cabinet or drawer used for the storage of a medium classified as ‘restricted’ must be kept in such a manner that it is protected from falling into the hands of unauthorised persons.

(2) The changing of the lock code to a safe used for the storage of a medium classified as ‘restricted’ is made based on clauses 1–3 of subsection 3 of § 75.

§ 80. Principles of reproduction

(1) The processing entity must exclude the uncontrolled reproduction of a classified medium and the making of an extract therefrom.

(2) It is prohibited to reproduce a medium classified as ‘top secret’ and to make an extract therefrom without the written consent of the processing entity that prepared the medium. It is permitted to reproduce, without consent, classified information for use in the processing system of the processing entity.

(3) A medium classified as ‘secret’ and ‘top secret’ may be reproduced and an extract made from it by the registrar or by the head of the processing entity or another person appointed by the person authorised thereby.

(4) The information recorded in the means of reproduction during reproduction, must be protected against illegal access.

§ 81. Reproduction equipment

(1) Equipment for the reproduction of a medium classified at the ‘confidential’, ‘secret’ and ‘top secret’ level must be located in the security area and the processing entity must ensure that such reproduction equipment is not accessible to unauthorised persons. Only such reproduction equipment that is intended for that purpose must be used for the reproduction of classified medium and making extracts therefrom.

(2) Reproduction of a medium classified as ‘restricted’ and making extracts therefrom is permitted in an administrative area with a reproduction equipment that is intended for that purpose.

(3) The reproduction equipment must bear a clearly legible marking regarding the highest classification level of information allowed to be reproduced.

§ 82. Principles for destruction of classified media

(1) The equipment for the destruction of a medium classified at the ‘confidential’ and higher level must be located in the security area. With the authorisation of the authority coordinating the security area, the equipment for destruction of a classified medium may be located in an administrative area.

(1¹) In the event of evacuation, the classified medium may be destroyed outside the security area or administrative area in a manner that protects the information contained therein from disclosure and from access by a person who has no right of access and no need-to-know.

(2) A classified medium which has become unusable must be destroyed at the earliest opportunity, unless it is necessary to preserve it for a special purpose.

§ 83. Destruction of classified medium

(1) A paper shredder used for the destruction of a paper medium classified at the ‘secret’ and higher level must shred the paper into pieces that cannot be larger than 5 mm2.

(2) A paper shredder used for the destruction of a paper medium classified at the ‘confidential’ and lower level must shred the paper into pieces that cannot be larger than 10 mm2.

(3) Where the waste resulting from the shredding of a medium specified in subsections 1 and 2 is destroyed in such a manner that makes it impossible to restore the medium, a paper shredder which shreds the paper into pieces that cannot be larger 30 mm2 may be used for the destruction.

(4) A device used for the destruction of a storage medium must shred the storage medium into pieces that cannot be larger than:

1) in the case of a hard disk - 10 mm2;

2) in the case of an optical medium - 5 mm2;

3) in the case of a solid-state drive - 4 mm2.

(5) Equipment and methods not specified in subsections 1–4 may be used for the destruction of a classified medium with the consent of the Internal Security Service, the Defence Forces or the Foreign Intelligence Service respectively. Upon granting such consent, additional conditions may be imposed on the use of the exempted equipment or method, including the type of the medium, the classification level and volume of information contained therein, and the threat situation causing the destruction.

(6) A file is destroyed by deletion.

§ 85. Natural persons destroying classified media

(1) The destruction of a medium classified at the ‘confidential’ and higher level, other than an unregistered copy of a medium classified as ‘confidential’, must involve at least two persons who sign the report of destruction of the classified medium or provide electronic confirmation in the document management system.

(2) The persons participating in the destruction must have the right of access to classified information at the appropriate level.

(3) A draft file or an unregistered copy of a file may be destroyed by a person independently.

§ 86. Report concerning destruction of classified media

(1) Upon destruction of a classified medium, a report of destruction of the classified medium is drawn up.

(2) The reports of destruction of classified media must include:

1) the registration date and number of the medium, the copy number and the number of units to be destroyed and, where necessary, the number of copies;

2) data of the persons who destroyed the medium;

3) method of destruction;

4) legal basis for destruction.

(3) The reports of the destruction of classified media are stored in a security area or in a document management system for at least ten years. The report of destruction of a physical medium may be destroyed after five years have passed in case it has been digitized.

(4) The following may be destroyed without drawing up a report of destruction of a classified medium:

1) an unregistered copy of a medium classified at a ‘confidential’ and lower level;

2) a draft of a file or an unregistered copy of the file, in case the report of destroying them is provable within the processing system.

§ 87¹. Application of general requirements for transporting classified medium

The requirements provided in this division are not applied to a portable processing device which is a processing system, or a part thereof intended for processing in the public space and the storage medium in it, which is transported in a public space without the purpose of transfer.

§ 88. Packaging of classified medium for transport

(1) The classified medium is transported in opaque double packaging.

(2) The classified medium must be securely packaged so that the opening of the package is detectable afterwards. Where necessary, additional measures must be taken to protect the contents of the package from access by unauthorized persons.

(3) The following is marked on the outer packaging:

1) name of the receiving processing entity;

2) registration date and number of the medium included in the package;

3) where necessary, the address of the receiving processing entity.

(4) The following is marked on the inner packaging:

1) the register of classified media of the recipient processing entity as the addressee;

2) the level of classification, registration date and number of the medium contained in the package and the number of items;

3) the marking "Leidmisel teavitada kohe Kaitsepolitseiametit” [upon finding notify the Internal Security Service immediately].

(5) In case the medium is transported in a public space without the purpose of transfer, bringing it back to the administrative or security area of ​the processing entity after the termination of the need for processing, both the outer and inner packaging of such a medium is marked with at least the name of the processing entity and, additionally to the inner packaging the classification level of the medium and the marking specified in clause 3 of subsection 4.

(6) For transportation of a medium classified as ‘restricted’, a bag, suitcase or other similar object which is locked or sealed or otherwise closed in such a manner as to prevent unauthorised persons from opening it may be used as an outer packaging. Such outer packaging need not be marked.

(7) A processing entity may, with the consent of the Internal Security Service, derogate from the packaging requirements for a classified medium set out in this section provided that the security of the medium is ensured by other measures.

§ 89. Organisation of transportation

(1) Prior to the transportation of a classified medium, the sending processing entity and the receiving processing entity agree on the transportation of the medium in compliance with the requirements laid down in this Regulation.

(2) In case it is not possible for the processing entity to comply with the requirements for the transportation of a classified medium, they must apply to the Internal Security Service or the Defence Forces for the organisation of the transportation of the classified medium.

§ 90. Method of transportation

(1) A classified medium is transported in a manner that ensures that only persons with the need-to-know about the circumstances related to the transport of the medium, including the fact of its transportation, are aware thereof due to their employment or service task.

(2) The classified medium is transported without delay choosing the shortest possible route and the safest possible manner for the transport.

(3) The courier keeps the classified medium in their direct possession all the time until delivery.

(4) In case it is not possible to immediately transport the medium classified at the ‘confidential’ and higher level or deliver to another processing entity, it is returned to the registrar of the sending processing entity or to the person organising the protection of state secrets.

(5) A medium classified as ‘restricted’ may be sent to another processing entity by mail, provided that the route of the postal item can be tracked and its delivery against signature is ensured.

§ 91. Right of access of courier

A courier carrying a medium classified at the ‘confidential’ and higher level must have the right of access to information classified at the appropriate level.

§ 92. Removal of classified medium from security area

A medium classified at the ‘confidential’ and higher level may be taken out of the security area only with the permission of the head of the sending processing entity, registrar or another person appointed in the guidelines for the protection of classified information, and in a locked bag or box intended for transportation or in a sealed bag for diplomatic mail.

§ 93. Instrument of delivery and acceptance of classified medium

(1) Regarding the transfer of a classified medium to another processing entity, the sending processing entity prepares an instrument of delivery and acceptance. Such instrument needs not be prepared concerning the transfer of a medium classified as ‘restricted’.

(2) The following is marked in the delivery and acceptance instrument:

1) the registration date and number of the medium, the highest level of classification and the number of items to be transferred. The instrument of delivery and acceptance must not include a reference to the content of the information contained in the medium;

2) name and address of the receiving processing entity;

3) date and time of transfer;

4) given name and surname and signature of the recipient;

5) given name and surname and signature of the transferor.

(3) The recipient signs the instrument of delivery and acceptance after comparing the entries on the package and in the instrument.

(4) The instrument of delivery and acceptance is stored in the security area for at least ten years. An instrument on a physical medium may be destroyed after five years have passed in case it has been digitized.

(5) One and the same instrument of delivery and acceptance may record the transfer of several classified media.

(6) This section is not applied to a medium that is transported in a public space without the purpose of transfer.

§ 94. Obligations of recipient of classified media

(1) Upon receipt of a classified medium it is verified whether the consignment is sealed and without traces of opening.

(2) In the case of an opened consignment or a consignment with traces of opening, or in case of such suspicion, the registrar or another person specified in the guidelines on the protection of classified information must be notified immediately.

(3) The consignment must be immediately handed over to the registrar, who organizes the registration of the information and the internal transfer inside the processing entity in accordance with the procedure provided in the instructions for the protection of classified information.

(4) The registrar must check whether the media and what is contained therein correspond to the indicated number of items.

(5) This section is not applied to a medium that is transported in a public space without the purpose of transfer.

§ 95. Courier transporting through administrative area

A classified medium may be transported from one security area to another through an administrative area by one courier.

§ 96. Application of general requirements for transportation upon transporting through administrative area

In case a medium is transported from one security area to another through an administrative area, §§ 88 and 92 are not applied.

§ 97. Courier transporting through public space

(1) A medium classified at the ‘confidential’ and lower level may be transported through public space by one courier.

(2) A medium classified at the ‘secret’ and higher level may be transported through public space by at least two couriers. With the authorization of the Internal Security Service, the Defence Forces, the Estonian National Security Authority or the Foreign Intelligence Service, this may be done by one courier.

§ 98. Use of vehicle upon transporting through public space

(1) A medium classified at the ‘secret’ and higher level is generally transported by car.

(2) The windows of the car are kept closed and the doors locked, and the driver must be in an employment or service relationship with the state authority or the sending or receiving processing entity.

§ 99. Carrying weapon upon transporting through public space

(1) At least one courier transporting a medium classified as ‘top secret’ must carry a service weapon. With the permission of the Estonian Internal Security Service, the Defence Forces, the Estonian National Security Authority or the Foreign Intelligence Service, a medium classified as ‘top secret’ may be transported without carrying a service weapon.

(2) The courier who is the only one carrying a service weapon may not drive a vehicle while transporting a medium.

§ 100. Transporting to, in and from foreign states by courier

(1) A medium classified at the ‘confidential’ and higher level is transported to, in and from foreign states by a diplomatic or military courier who has the right of access to information classified at the appropriate level.

(2) The Estonian Internal Security Service, the Defence Forces, the Estonian National Security Authority or the Estonian Foreign Intelligence Service respectively may give a written authorisation for transporting the media specified in subsection 1 without using a diplomatic or military courier in case using the courier would result in an undesirable delay or in case the need to use a different form of transportation is due to an objective situation.

(3) In case a security authority wishes to transport a classified medium without using a diplomatic or military courier, the written authorisation for transportation is given by the head of that security authority or a person authorised thereby.

(4) The authorisation specified in subsection 2 sets out the requirements that must be met upon transportation of the consignment, in particular regarding the route and the means of transport used for transportation.

§ 101. Courier upon transportation to, in, from foreign states

(1) For transportation to, in and from foreign states, a courier must have a diplomatic courier certificate issued by the Ministry of Foreign Affairs, or diplomatic immunity.

(2) In the area of ​an international military operation, a classified medium may also be transported by a military courier. Requirements for military courier are established by the Commander of the Defence Forces.

§ 102. Electronic processing

Classified information may be processed in the processing system complying with the requirements for electronic information security, which has a certificate of compliance or a temporary use permit for processing classified information at the appropriate level of classification issued by the Estonian Foreign Intelligence Service (hereinafter accredited system) and during the processing they are staying, dependent on the communicated information, within the administrative or security area, except in the case provided in § 103.

§ 103. Exceptions in electronic processing

(1) Information classified as ‘restricted’ may be processed in a public space:

1) in case of unavoidable necessity for operational transmission or reception of information, in case an accredited system intended for processing in a public space is used;

2) where otherwise necessary for the transmission or receipt of information only in case a mobile phone that is part of an accredited system intended for processing in a public space is used.

(2) In case the operational transmission of a state secret, classified at the ‘confidential’ or higher level or foreign information classified as ‘confidential’ or ‘secret’, is necessary to prevent or counter an immediate threat to national security, constitutional order or the life, health or property of persons, it may be transmitted and received provided that a system accredited to process information classified at least at the ‘restricted’ level is used. The transmitter and receiver of information must immediately notify the person in charge of the protection of state secrets in their processing entity.

(2¹) The Defence Forces may process state secrets related to national defence dealing with operational planning and operational management classified up to the ‘secret’ level, or foreign classified information corresponding to that content, in public space, in case the transmission of such information is necessary for participation in international military cooperation or military defence of the state, and an accredited system intended for processing in public space is used.

(3) In case the sender or recipient of information is staying in a public space in the case provided in subsection 1 or 2, they are is required to:

1) notify the other party of their staying in a public space before communicating the information orally;

2) apply all the required measures to protect the transmitted information from disclosure to and access of persons without the right of access or need-to-know.

(4) in case a failure to operatively transmit the state secret specified in clauses 2–5 of subsection 1 and subsection 3 of § 6 or foreign classified information corresponding to that content would bring about a failure of surveillance activities or put the participating persons at risk, being present in a public space and using an unaccredited system for transmitting and receiving the corresponding information is allowed.

§ 104. Definitions

In this Division, the definitions are used in the following meaning:

1) electronic information security - ensuring availability, secrecy and integrity of information in the classified information processing systems;

2) accreditation of the processing system – assessment of the compliance with the requirements for electronic information security of the processing system;

3) availability – the possibility of using information and accessing information at the request of an authorized person;

4) secrecy - unavailability or incomprehensibility of information to unauthorized persons;

5) integrity – the property of information not to be altered, supplemented or destroyed by unauthorized persons;

6) threat – potential damage to the availability, secrecy or integrity of information;

7) incident - a situation where information or the system operations and devices supporting its protection have lost or could have lost secrecy, integrity or availability due to theft, sabotage, acts of terrorism, other prohibited actions or security weaknesses (including loss of information, disclosure to unauthorized persons, modification or destruction by unauthorized persons or attack on the system);

8) security risk – the probability of an incident occurring;

9) risk management – ​analysis of property, information, threat, incident and security risk, based on which the security measures of information and system operations and devices supporting its protection are determined. Risk management includes the planning, organization, use and control of security measures of the system in order to prevent security risk from exceeding acceptable limits and incidents;

10) vulnerability analysis - a detailed inspection of the system in order to find out security weaknesses of the system, threats to the secrecy, integrity and availability of information processed in the system, and the vulnerability of the system to any attack or threat;

11) security guide for the processing system - a document in which the mandatory security requirements and the rights and obligations of users with a special right to access the processing system are determined upon using the processing system and ensuring its security based on the technical solution of the processing system;

12) user guide for the processing system - a document in which the rights and obligations of the users of the processing system upon using the processing system and ensuring its security are determined based on the mandatory security requirements specified in the security guide for the processing system;

13) external security environment - the environment surrounding the location of the system, including a building or an area where the events taking place may affect the security of the system;

14) internal security environment - the external security environment bordering a room or area where system components are located or where they are used;

15) electronic security environment - is limited to the system components, by means of which information is processed electronically and for the protection of which the staff operating the system implements electronic security measures;

16) revealing radiation – an electromagnetic signal emitted undesirably from the processing system, which enables illegal access to information;

17) usage history – a description of the purpose of the processing system, which reflects who processes what information, where and how;

18) portable processing device - a device that forms a processing system or a part of it, which can be used for processing information in the processing system without being physically connected to other parts of the processing system.

§ 105. Electronic information security principles

(1) Electronic information security requirements for the protection of classified information upon processing it electronically are provided in this subchapter.

(4) A processing device, in which the highest level of information classification permitted for processing is ‘restricted’, may be taken outside the internal security environment in case:

1) the classified information has been encrypted with compliant cryptographic materials or protected from unauthorised access by another method authorised by the Estonian Foreign Intelligence Service;

2) the processing device bears no marking which would refer to the level of classification of the information processed therein.

(5) Upon ensuring electronic information security for the protection of foreign classified information, the requirements prescribed by the discloser of the foreign classified information are taken into account additionally.

(6) When ensuring electronic information security, the following security principles are considered in particular:

1) only the functions, protocols or services that are necessary for processing information or ensuring its security may be used - the principle of minimality;

2) management of system security risks, including prevention, reduction, diversion and permissible acceptance - the principle of continuous management of security risks - and regular control of system security must take place without interruption;

3) users of the system only have the user rights necessary to perform their tasks - the principle of privilege limitation;

4) the unreliability of all other systems connected to the system is assumed, and adequate security measures must be implemented upon exchanging information with them - the principle of using self-protecting nodes;

5) in case of a failure of one of the security measures used, the entire system must not lose its security - the in-depth defence principle.

§ 106. Requirements for processing system

(1) The availability, secrecy and integrity of classified information must be ensured in the processing system of classified information.

(2) The processing system of classified information must enable:

1) identify and register persons who had or could have had access to system operations and devices supporting the protection of classified information;

2) distinguish the users of the system based on the right of access to classified information;

3) access to information and the system operations and devices supporting protection of information only in case there is a right of access and a justified need-to-know;

4) checking the secrecy, integrity, availability of information and the system operations and devices supporting its protection, as well as their origin, reliability and connections;

5) achieve a situation where the protection mechanisms of electronic information security function properly during the entire period of using the system;

6) prevent and eliminate incidents and prevent or reduce the damage caused by the incidents;

7) deal with incidents during which the threat to the system or its part and the resulting damage to the information and the measures taken to eliminate the damage are determined and recorded.

(2¹) More detailed requirements for the processing system, including related processing entities and the users thereof, are presented in Annex 14. Based on the security assessment, the Foreign Intelligence Service may set additional requirements to the processing system.

(2²) The processing entity may apply stricter requirements than those specified in Annex 14.

(2³) The processing entity may apply the requirement set out in Annex 14 in part or not apply it as an exception, only in case the resulting risks are described in the risk analysis of the processing system, the compensating security measures are described in the security guide for the processing system and the Foreign Intelligence Service has approved them during the accreditation of the processing system.

(2⁴) In addition to the provisions of subsection 2³, the processing entity may not implement the requirement presented in Annex 14, in case the implementation is impossible due to the small size or structure of the processing system, this is described in the security guide for the processing system and the Foreign Intelligence Service has approved this upon accreditation of the processing system.

(2⁵) In case the application of the requirement presented in Annex 14 requires the processing entity to carry out regular operations, their frequency must be described in the security guide for the processing system and must correspond to the intensity of use of the processing system.

(3) Information about the processing system is documented in the security guide and the user guide for the processing system.

(4) The processing entities related to the processing system perform continuous risk management of the processing system within the scope of their tasks.

§ 106¹. Processing entities related to the processing system

(1) The processing entity responsible for the processing system (hereinafter the responsible entity):

1) is responsible for the legality of managing the processing system and ensuring the security of the processing system and the information processed therein;

2) organizes the development of the processing system according to the needs of the using entity;

3) plans resources for managing and developing the processing system;

4) decides on joining the processing system of the using entities;

5) prepares a risk analysis of the processing system in cooperation with the managing and using entity and regularly assesses its up-to-datedness.

(2) The processing entity managing the processing system (hereinafter the managing entity):

1) manages the processing system;

2) develops the technical solution of the processing system according to the guidelines of the responsible entity;

3) ensures the operation of the technical solution of the processing system;

4) ensures the security of the processing system and the information processed in it and regularly checks the operation of security measures.

(3) The processing entity using the processing system (hereinafter using entity):

1) processes the information in their possession in the processing system;

2) submits the needs for the use and development of the processing system to the responsible entity;

3) ensures the security of the processing system and the information processed therein at their location, taking into account the security risks determined in the risk analysis, their acceptable limits and security measures.

(4) The tasks listed in subsections 1-3 may be performed by the same processing entity, provided that the separation of roles is described in the security guide for the processing system and ensured by internal work arrangements.

(5) The tasks of one responsible entity for the processing system may not be performed by several processing entities.

(6) One processing system may have several managing entities and using entities.

§ 106². User with special rights responsible for processing system

(1) The user with special rights responsible for the processing system must have right of access corresponding to at least the highest level of classification of information processed in the processing system.

(2) In the case of a user with special rights responsible for the processing system accredited for the processing of foreign classified information, in addition to the provisions of subsection 1, the requirements submitted by the originator of foreign classified information must be taken into account.

(3) Users with special rights responsible for the processing system are appointed in writing by the head of the processing entity or a person authorized thereby.

(4) The Foreign Intelligence Service and the Internal Security Service are notified in writing immediately of the appointment or change of a user with special rights responsible for the processing system. One security authority does not notify another security authority of the appointment or change of a user with special rights responsible for the system.

§ 106³. Access to processing system

(1) The user of the processing system may be an employee or official of another processing entity with the right of access and a need-to know, in case this is necessary for the performance of the tasks of the other processing entity.

(2) Parts of the processing system may be in the direct possession of another processing entity, and the user with special rights responsible for the processing system may be an employee or official of another processing entity, in case compliance with the requirements provided in subsection 2 of § 106 and Annex 14 is ensured.

§ 107. Security guide for processing system

(1) The security guide for the processing system sets out:

1) a general description of the processing system and information it processes;

2) a responsible entity, managing entities and using entities;

3) tasks, rights and obligations of users with special rights responsible for the processing system;

4) description of the security arrangements for the processing system;

5) technical specification of the processing system, including technical information about the connections of the processing system with other systems;

6) a list of the hardware and software of the processing system, their configuration and description of their management;

7) a description of the security requirements for the processing system, an overview of the results of the risk analysis of the processing system and a list of security measures based on them.

(2) The security guide for the processing system is developed by the responsible entity in cooperation with the managing entity and is established by the head of the responsible entity. Prior to establishment, the responsible entity coordinates the security guide for the processing system with the Foreign Intelligence Service.

(3) The security guide for the processing system is specified during the construction and use of the processing system, in case modifications are made, for example, in case the purpose of use, structure, physical location of the processing system or a part thereof is changed, large-scale modifications are made to the hardware or software of the processing system, new significant threats appear or the classification level of information processed in the processing system is changed. Changes to the security guide for the processing system are coordinated with the Foreign Intelligence Service by the responsible entity.

§ 108. User guide for processing system

(1) The user guide for the processing system sets out:

1) a brief description of the processing system;

2) users of the processing system and their tasks, rights and obligations;

3) instructions for electronic processing of classified information;

4) description of the processing of media used in the processing system;

5) a description of the incident management of the processing system and actions to be taken in an emergency situation.

(2) The user guide for the processing system is developed by the responsible entity in cooperation with the managing entity, based on the security guide for the processing system, and established by the head of the responsible entity. Prior to the establishment, the responsible entity coordinates the user guide for the processing system with the Foreign Intelligence Service.

(3) The user guide for the processing system is specified during the use of the processing system, in case modifications are made, for example, in case changes are made to the purpose of use, structure, physical location of the processing system or a part thereof, large-scale changes are made to the hardware or software of the processing system, new significant threats become evident or the level of classified information processed in the processing system is changed. Modifications to the user guide for the processing system are coordinated with the Foreign Intelligence Service by the responsible entity.

§ 109. Accreditation of processing system

(1) The purpose of accreditation of the processing system is to make sure that the processing system meets the requirements established to ensure electronic information security.

(2) During the accreditation of the processing system, the Foreign Intelligence Service:

1) examines the purpose and usage history of the processing system provided by the responsible entity;

2) reviews the process and results of the risk analysis of the processing system and makes sure that the responsible entity has identified and accepted residual risks;

3) evaluates the compliance of the structure of the processing system and the external, internal and electronic security environment with the requirements;

4) evaluates the security guide and user guide for the processing system and other documents concerning the security of the processing system;

5) evaluates the compliance with the requirements of the implementation of security measures and procedures concerning the security of the processing system;

6) provides a general security assessment, which expresses the compliance of information protection in the processing system with the requirements and current state of their implementation.

(3) The Foreign Intelligence Service initiates the accreditation of the processing system at the request of the responsible entity or on their own initiative. The responsible entity attaches the security guide and the user guide for the processing system to the application for accreditation of the processing system. The information specified in clauses 1–3, 5 and 6 of subsection 2 is provided by the responsible entity at the request of the Foreign Intelligence Service.

(4) As a result of accreditation of the processing system, a certificate of compliance is issued to the processing entity by the directive of the Director General of the Foreign Intelligence Service, in case:

1) the processing system is in compliance with the requirements of electronic information security or

2) the processing system does not meet all the requirements of electronic information security, but the resulting security risks are permanently acceptable due to compensating security measures.

(5) As a result of accreditation of the processing system, a temporary use permit is issued to the processing system by the directive of the Director General of the Foreign Intelligence Service in case the processing system does not meet all the requirements of electronic information security, but the resulting security risks are temporarily acceptable.

(6) A temporary use permit for testing (hereinafter testing permit) may be issued by the directive of the Director General of the Foreign Intelligence Service to the processing system which needs to be tested before being put into use, Based on the test permit, the processing system may be used and classified information may be processed only for testing the technical solution of the processing system and the connections of the processing system. In order to obtain a test permit, the responsible entity must submit the security guide and the user guide for the processing system only in case they are available. The testing permit specifies the conditions for testing the processing system, such as the purpose and scope of testing, the level of classification of information allowed to be processed during testing, and the testing deadline.

(7) In case of construction and commissioning of a new processing system, the processing entity may submit an application together with a brief description of the planned structure of the processing system, after which a temporary use permit is issued only for the preparation of the security guide and the user guide for the processing system

(8) The Foreign Intelligence Service refuses to issue a certificate of compliance or a temporary use permit to the processing system by the directive of the Director General and prohibits its use for processing classified information in case the processing system does not meet the requirements of electronic information security and the resulting security risks are not acceptable.

§ 110. Obligation to provide information

At the request of the Foreign Intelligence Service, the processing entity is obliged to immediately provide, including in written form, information about the system in their possession and the circumstances related to electronic information security, and to ensure the Foreign Intelligence Service with continuous access to parts of the system during working hours and during rest days and national holidays at pre-agreed times, regardless of their location.

§ 111. Re-accreditation of processing system

(1) For the re-accreditation of the processing system, the responsible entity submits an application:

1) at least two months prior to the expiry of the current certificate of compliance;

2) at least five working days prior to the expiry of the current temporary use permit.

(2) In case the application for re-accreditation together with the relevant documentation is submitted before the expiry of the current certificate of compliance or temporary use permit, the Foreign Intelligence Service may extend the validity of the current certificate of compliance or temporary use permit until the expiry of accreditation.

§ 112. Revocation of certificate of conformity and temporary use permit

(1) The Foreign Intelligence Service declares the certificate of compliance or temporary use permit invalid:

1) based on the request of the responsible entity;

2) in case the responsible, managing or using entity has failed to comply with the precept of the Foreign Intelligence Service to eliminate the violation or risk of violation of an electronic information security requirement;

3) a fact underlying the refusal to grant a certificate of compliance or a temporary use permit becomes evident.

(2) The certificate of compliance or the temporary use permit is declared invalid by the directive of the Director General of the Foreign Intelligence Service.

(3) A responsible entity is notified of the revocation of a certificate of compliance or a temporary permit for use in writing.

§ 112¹. Storage of storage media in absence of valid certificate of compliance or temporary use permit

In the absence of a valid certificate of compliance or a temporary use permit, the processing entities related to the processing system must ensure proper storage of the storage media that have been part of the processing system, and the information contained therein.

§ 113. Notification of Estonian National Security Authority

The Foreign Intelligence Service notifies the Estonian National Security Authority of the issue of a certificate of compliance or a temporary use permit for the system, extending the validity of the certificate of compliance or revoking it in case foreign classified information is processed in the system.

§ 114. Principles of processing foreign classified information

The processing of foreign classified information is subject to the requirements for the protection of classified information arising from a international agreement or an agreement of an international organization or an institution established by an international agreement, taking into account the provisions of this section. The processing requirements set forth in this section do not apply to cryptographic material registered with the Foreign Intelligence Service and to the information specified in subsection 3 of § 52 of the State Secrets and Classified Information of Foreign States Act.

§ 115. Keeping record of foreign classified information

The records of foreign classified information are kept separately from the records of state secrets, so the restriction of access to register data and media is guaranteed on the basis of the need-to-know and the right of access. In the register, records must be kept separately for each originator of foreign classified information.

§ 116. Main register of foreign classified information kept by Estonian National Security Authority

(1) The Estonian National Security Authority keeps the main register of foreign classified information, where all media of foreign classified information transmitted to the state or created in the state at the ‘top secret’ level and media of foreign classified information with special marking are registered.

(2) Processing entities that are users of the main register of the Estonian National Security Authority are obliged to comply with the requirements set forth in § 51.

§ 117. Register of foreign classified information kept by processing entity

(1) The processing entity in possession of foreign classified information is obliged to set up a register of foreign classified information and to notify in writing the Estonian National Security Authority in advance.

(2) In order to process foreign information classified at the ‘top secret’ level and foreign classified information with a special marking and to keep the register and its sub-register, the processing entity must obtain written consent from the Estonian National Security Authority. The Estonian National Security Authority issues the consent after an inspection during which it is established whether the processing requirements are in compliance.

§ 118. Registration of media containing foreign classified information

(1) The processing entity in possession of foreign classified information is obliged to register media containing foreign information classified at a ‘top secret’ level and foreign classified information with special marking in their possession in addition to the register of the processing entity, in the main register kept by the Estonian National Security Authority at the earliest opportunity, but not later than seven working days after the creation of the classified medium, or its arrival at the processing entity.

(3) The processing entity does not need to register in the main register kept by the Estonian National Security Authority such media that have been transmitted thereto by the Estonian National Security Authority or the processing entity that is the user of the main register of the Estonian National Security Authority.

(4) The processing entity in possession of foreign classified information is obliged to put the registration number given by the Estonian National Security Authority on every medium containing foreign classified information at a ‘top secret’ level and foreign classified information with special marking.

§ 118¹. Marking of medium containing foreign classified information

(1) A medium containing foreign classified information is marked with the level of classification of the originator of foreign classified information, in case it is prescribed by an international agreement, and with the marking of the corresponding level of state secret.

(2) In case the medium contains both state secrets and foreign classified information, the level of classification of which is lower than the level of classification of state secrets, it is not marked as specified in subsection 1.

(3) Mediums containing foreign classified information is additionally marked "Salastatud välisteave” [foreign classified information] in capital letters, and the name of the originator of foreign classified information, the level of classification and the term of classification are indicated, in case the originator of foreign information has noted this. In case the originator of foreign information has not specified the deadline, the marking “tähtaeg: määramata” [deadline: unspecified] or "tähtaeg: tähtajatu] [deadline: without time-limit] is made. In such case, the classification applies until the originator of foreign information has not announced otherwise.

(4) In case the medium contains foreign classified information of several originators, all the originators of the foreign classified information, the levels of classification and the terms of classification must be indicated in the additional note provided in subsection 3.

(5) Medium containing foreign classified information of the European Union and the North Atlantic Treaty Organization may be left unmarked in accordance with the requirements provided in subsections 1-4.

(6) With the written consent of the Estonian National Security Authority, electronic foreign classified information may be left unmarked in accordance with the requirements set forth in subsections 1-4, in case the information is marked in accordance with § 70.

§ 119. Transmission of medium containing foreign classified information

(1) A medium containing foreign information classified as ‘top secret’ and specially marked foreign classified information is received and transmitted to other processing entities only through the Estonian National Security Authority, in case such a requirement arises from an international agreement.

(3) A medium containing foreign classified information may be transmitted only to such a processing entity that has previously established a register of foreign classified information.

§ 120. Reproduction and destruction of medium containing ‘top secret’ foreign classified information and foreign classified information with special marking

(1) Only the Estonian National Security Authority reproduces and destroys a medium containing foreign information classified as ‘top secret’ and foreign classified information with special marking.

(2) The Estonian National Security Authority may give a written permission to the state authority to reproduce or destroy the medium specified in subsection 1.

§ 122. Inspection by National Security Authority

At least once every two years, the National Security Authority carries out inspection in the processing entity holding foreign classified information of the security measures implemented to ensure the protection of foreign classified information and of the access of natural persons processing the specified information.

§ 122¹. Contracts requiring processing of classified information

(1) A civil law contract, the performance of which requires the processing of foreign classified information or the transfer of a state secret to a foreign state, international organization or institution established by international agreement, must contain a part by which it is agreed at least on the processing of classified information, created by whom and at what level the classified information is processed and what are the instructions for protecting the information, taking account of the requirements arising from this Regulation and international agreements.

(2) The part of the contract specified in subsection 1 is coordinated with the National Security Authority prior to the entry into the contract.

(3) Within one month as of the entry into the contract, a copy of the part specified in subsection 1, as well as the names, registry codes, countries of location and the validity period of the contract must be submitted to the National Security Authority.

(4) Subsections 2 and 3 are not applied in the case provided in subsection 3 of § 52 of the State Secrets and Classified Information of Foreign States Act.

§ 122². Approval of international visit request

An international visit request is approved by the National Security Authority, except in the case provided in subsection 3 of § 52 of the State Secrets and Classified Information of Foreign States Act.

§ 123. Right of access to foreign classified information of European Union and North Atlantic Treaty Organization and right to process it

(1) A prerequisite for the person specified in subsections 1, 2 or 5 of § 27 of the State Secrets and Classified Information of Foreign States Act for obtaining the right of access to foreign information classified as ‘restricted’ of the European Union and the North Atlantic Treaty Organization is that the person has to undergo the briefing specified in § 130 and sign the obligation.

(2) A natural person has the right of access to foreign information classified at the ‘confidential’ and higher level of the European Union and the North Atlantic Treaty Organisation on the basis of a Personnel Security Clearance Certificate.

(3) A person has the right to process foreign information of the European Union and the North Atlantic Treaty Organization classified at the ‘restricted’ and higher level on the basis of a security clearance certificate intended for processing (hereinafter Facility Security Clearance Certificate).

(4) A prerequisite for obtaining a Personnel Security Clearance Certificate is the national Personnel Security Clearance, and a prerequisite for obtaining a Facility Security Clearance Certificate is a national Facility Security Clearance.

§ 124. Correspondence between levels of Personnel Security Clearance Certificate and Facility Security Clearance Certificate

A person is not given:

1) a Personnel Security Clearance Certificate for access to foreign classified information at a higher level than the level of their national Personnel Security Clearance;

2) a Facility Security Clearance Certificate for processing foreign classified information at a higher level than the level of their national Facility Security Clearance.

§ 125. Validity of Personnel Security Clearance Certificate and Facility Security Clearance Certificate

(1) The validity period of a Personnel Security Clearance Certificate or a Facility Security Clearance Certificate is decided by the Estonian National Security Authority according to the desired period of validity specified in the application, the validity of the Personnel Security Clearance and the justification of the need-to know. In case the grounds for refusal of the right of access arising from an international agreement are stricter compared to the grounds provided in the "State Secrets and Classified Information of Foreign States Act", the existence of a circumstance arising from an international agreement is also taken into consideration upon deciding on the validity period of the Personnel Security Clearance Certificate or a Facility Security Clearance Certificate.

(2) In the event that a national Personnel Security Clearance or a national Facility Security Clearance of a person expires before the validity period of the Personnel Security Clearance Certificate or a Facility Security Clearance Certificate expires, the Personnel Security Clearance Certificate or a Facility Security Clearance Certificate loses its validity.

(3) In case a Personnel Security Clearance Certificate or a Facility Security Clearance Certificate becomes invalid before the expiry of its validity period, it must be returned to the Estonian National Security Authority.

§ 126. Application for Personnel Security Clearance Certificate

(1) In order to apply for a Personnel Security Clearance Certificate, a state authority, Eesti Pank or the Defence League, due to whose tasks the person needs access, or an authorised authority (hereinafter the applicant) submits to the Estonian National Security Authority:

1) a written application stating the originator of the foreign classified information and the level of classification to which access is applied for, the requested validity period for the Personnel Security Clearance Certificate, as well as the person's name, personal identification number, place of birth, citizenship, contact information and the post;

2) a copy of the national Personnel Security Clearance or other document confirming the right of access to state secrets, or their copy, unless the applicant is a security authority.

(2) In order to apply for a Personnel Security Clearance Certificate for the person specified in subsection 1 of § 30¹ of the State Secrets and Classified Information of Foreign States Act, the Defence Forces submit a list of posts to the Estonian National Security Authority, in which the level of access to foreign classified information required for each post is indicated.

(3) In order to apply for Personnel Security Clearance Certificates for the persons specified in subsection 2, the state authority, whose main task is to coordinate and organize activities and maintain the records related to reserve service, submits to the Estonian National Security Authority:

1) information on the appointment of a person with a military rank to a wartime post;

2) the validity period of the requested Personnel Security Clearance Certificate, as well as the person's name, personal identification number, place of birth, citizenship and contact information;

3) information on the granting of the right for access to a state secret to a person of and the validity thereof.

§ 128. Application for Facility Security Clearance Certificate

In order to apply for a Facility Security Clearance Certificate, the applicant must submit the following documents to the Estonian National Security Authority:

1) a written application of the applicant, which specifies the name of the originator of foreign classified information and the level of classification of foreign information to which access is applied for, and justifies the need of a person to access foreign classified information;

2) a copy of the Facility Security Clearance;

3) a copy of the guide on the protection of classified information;

4) a copy of the document designating by name the person organizing the protection of state secrets in the legal person, as well as a list of persons who commence processing foreign classified information, and, where necessary, the documents to apply for a Personnel Security Clearance Certificate for natural persons.

§ 129. Deciding on grant of Personnel Security Clearance Certificate and Facility Security Clearance Certificate

(1) In case the application for granting a Personnel Security Clearance Certificate or a Facility Security Clearance Certificate or the documents attached thereto are not in compliance with the requirements, the Estonian National Security Authority notifies the applicant of the deficiencies within ten working days and sets a term for elimination of them.

(2) The Estonian National Security Authority decides on the issue or refusal to issue a Personnel Security Clearance Certificate or a Facility Security Clearance Certificate within one month as of receiving a proper application. In the case of a justified need, the term may be extended, notifying the applicant thereof.

§ 131. Delivery of Personnel Security Clearance Certificate and Facility Security Clearance Certificate

The Estonian National Security Authority delivers a Personnel Security Clearance Certificate or a Facility Security Clearance Certificate to the applicant within five working days.

§ 132. Formalising of Personnel Security Clearance Certificate and Facility Security Clearance Certificate

(1) A Personnel Security Clearance Certificate or a Facility Security Clearance Certificate must contain at least the following data:

1) date and number of issue;

2) given name and surname, date of birth, personal identification code, place of birth and citizenship of a natural person who has received a Personnel Security Clearance Certificate or a Facility Security Clearance Certificate or the name, address and registry code of a legal person;

3) the highest level and special categories of foreign classified information to which the person is granted the right of access or processing;

4) period of validity.

(2) The Personnel Security Clearance Certificate and the Facility Security Clearance Certificate are issued in English and Estonian.

§ 134. Revocation of Personnel Security Clearance Certificate and Facility Security Certificate

A Personnel Security Clearance Certificate or a Facility Security Clearance Certificate is revoked:

1) in the case of a lapse in the need of a person for access;

2) upon the issue of a new Personnel Security Clearance Certificate or a Facility Security Clearance Certificate to a person before the expiry of the previous Personnel Security Clearance Certificate or Facility Security Clearance Certificate;

3) in case the personal information entered on the Personnel Security Clearance Certificate, or a Facility Security Clearance Certificate is modified;

4) in case during the period of validity of the Personnel Security Clearance Certificate or Facility Security Clearance Certificate issued, any circumstance excluding the issue thereof becomes evident.

§ 135. Notification of amendment of data based on which Personnel Security Clearance Certificateand Facility Security ClearanceCertificate were issued

An applicant immediately informs the Estonian National Security Authority of the lapse in the need for access to foreign classified information, or of a national Personnel Security Clearance or right, or a national Facility Security Clearance of the person who has the right of access, and of the event specified in clauses 3 and 4 of § 134.

§ 137. Forms related to national Personnel Security Clearance

(1) A natural person submits an application for a Personnel Security Clearance using the form of application specified in Annex 1.

(2) A natural person submits an application for the extension of a Personnel Security Clearance using the form specified in Annex 2.

(3) Upon application for a Personnel Security Clearance or for the extension of the period of validity thereof, a natural person fills out the form of an applicant for and extender of Personnel Security Clearance (Annex 3).

(5) Upon application for a Personnel Security Clearance or extension of the period of validity thereof, a natural person fills out the consent form (Annex 5) annexed to the application form.

(6) Upon application for a Personnel Security Clearance or extension thereof, a natural person confirms that they are aware of the requirements for the protection of state secrets, the liability for violation of such requirements and the obligation to maintain the state secrets that have become known thereto (Annex 6).

(7) A person who is applying for or holding the right of access only to state secrets classified as ‘restricted’ fills out the form of consent specified in subsection 5 and gives the confirmation specified in subsection 6.

§ 138. Forms related to national Facility Security Clearance

(1) A legal person submits an application for a permit to process state secrets (hereinafter Facility Security Clearance) using the form specified in Annex 7.

(2) A legal person submits an application for the extension of a Facility Security Clearance using the form specified in Annex 8.

(3) Upon application for the issue of a Facility Security Clearance or for the extension of the period of validity thereof, a legal person submits the form of the applicant for or extender of Facility Security Clearance (Annex 9).

(5) Upon application for a Facility Security Clearance or extension of the period pf validity thereof, a legal person fills outs the consent form (Annex 11) annexed to the application form.

(6) Upon application for a Facility Security Clearance or for the extension of the period of validity thereof, a legal person confirms awareness of the requirements for the protection of state secrets, liability for violation of such requirements and obligation to maintain the state secrets that have become known thereto (Annex 12).

(7) Subsections 1–3, 5 and 6 are also applied to a self-employed person.

§ 138¹. Implementation of Regulation

(1) Information classified before 5 June 2023 on the basis of clause 2 of subsection 1 of § 6 of this Regulation remains a state secret in accordance with the requirements in force at the time of classification.

(2) The guide for the protection of state secrets established before 5 June 2023 is brought into compliance with the requirements of this Regulation at the latest by 1 October 2023.

(3) The requirements for information to be entered in the register valid from 5 June 2023, are applied to a medium that is registered as of 5 June 2023.

(4) The medium in the archive storage is brought into compliance with the marking requirements valid as of 5 June 2023 upon processing the medium, except for actions directly related to storage and preservation, but at the latest by 1 June 2028.

(5) The certificate of compliance or temporary use permit issued to the processing system before 5 June 2023 is valid until the end of its validity period.

(6) A Personnel Clearance Certificate issued to a natural person or a person processing classified information on the basis of a Facility Security Clearance before 5 June 2023 is valid until the expiry of its period of validity.

(7) The security guide and the user guide for the processing system must be brought into compliance with the provisions of §§ 107 and 108 at the latest by the time of the next accreditation.

(8) Equipment for the destruction of classified media acquired before 5 June 2023, which is not in compliance with the requirements of § 83 of this Regulation, may be used as follows:

1) paper shredder until 30 April 2026;

2) A device for destruction of the storage medium coordinated with the Foreign Intelligence Service until the end of its life cycle.

(9) The person performing the duties of the information security manager of the responsible entity must meet the requirement provided in subsection 3 of § 23 at the latest on 1 January 2025.

§ 139. Entry into force of Regulation

(1) This Regulation enters into force on 1 January 2008.

(2) Clauses 4, 5, 7, 8 and 11 of subsection 1 of § 8 enter into force on 1 January 2009, except in respect of information which was a state secret before 1 January 2008.

(3) Subsection 1 of § 70 enters into force on 1 January 2009.