FantasticSearch

1. After the successful takeover of the e-CODEX system, eu-LISA shall be responsible for maintaining a high level of security when carrying out its tasks, including the security of the hardware and software IT infrastructure referred to in Article 7(2). In particular, eu-LISA shall establish and maintain an e-CODEX security plan and ensure that the e-CODEX system is operated in accordance with that security plan, taking into account the classification of the information processed in the e-CODEX system and eu-LISA’s information security rules. The security plan shall provide for regular security inspections and audits, including software security assessments, of the e-CODEX system with the participation of the entities operating authorised e-CODEX access points.

2. When carrying out its responsibilities, eu-LISA shall implement the principles of security by design and data protection by design and by default.

3. Entities operating authorised e-CODEX access points shall have the exclusive responsibility for setting them up securely and operating them securely, including for the security of data transmitted through them, taking into consideration the technical standards set out in the implementing acts adopted pursuant to Article 6(1), point (a), and the security rules and guidance referred to in paragraph 6 of this Article.

4. Entities operating authorised e-CODEX access points shall notify, without delay, any security incident to eu-LISA and, in the case of authorised e-CODEX access points operated by a national public authority or legal person authorised under national law, to the Member State that maintains the list on which those authorised e-CODEX access points are listed or, in the case of authorised e-CODEX access points operated by a Union institution, body, office or agency, to the Commission.

5. Where eu-LISA detects any vulnerabilities or security incidents or on receipt of a notification of a security incident as provided for in paragraph 4, eu-LISA shall analyse the security incident and inform the entities operating authorised e-CODEX access points impacted by it and the e-CODEX Advisory Group without delay.

6. eu-LISA shall develop security rules and guidance regarding authorised e-CODEX access points. Entities operating authorised e-CODEX access points shall provide eu-LISA with statements proving their compliance with the security rules regarding authorised e-CODEX access points. Those statements shall be updated on a yearly basis or whenever a change is otherwise required.