Legal Disclaimer
The following text is a translation of the original wording in the Slovenian language published in the Official Gazette of the Republic of Slovenia. The Secretariat General of the Government of the Republic of Slovenia translated the text which cannot be considered as an authentic wording, nor does it cause any legal effects. Any liability of the author is herby excluded.
Pursuant to the fourth paragraph of Article 17 and fifth paragraph of Article 39 of the Classified Information Act (UR L RS, No. 56/03 – official consolidated text), the Government of the Republic of Slovenia hereby issues
DECREE
on the protection of classified information
I. GENERAL PROVISIONS
Article 1
(The purpose of the Decree)
This Decree determines the methods and forms of marking classified information, physical, organizational and technical measures and the mandatory elements of procedures for the protection of classified information that have to be observed and provided when setting up a system of measures and procedures for the protection of classified information by all agencies and organizations listed in the second and third paragraphs of Article 1 of the Classified Information Act (UR L RS, No. 135/03 – consolidated text; hereinafter referred to as the Act).
Article 2
(The purpose of security measures)
(1) The purpose of security measures is to set up, by introducing direct physical security measures for classified information, security premises or facilities (physical security measures), measures for the handling of classified information by a respective body involving preparation, transmission, storage, destruction and marking of classified information (organizational measures) and security measures applied to classified information, security areas or facilities by technical means in accordance with this Decree (technical measures), a system of procedures and measures for the protection of classified information appropriate to the classification level and quantity of classified information and preventing their disclosure to unauthorised persons.
(2) The protection of classified information of other countries or international organizations shall include, in addition or in lieu of the measures laid down herein, also other security measures determined by international treaties or assumed international obligations.
II.MARKING OF CLASSIFIED INFORMATION
Article 3
(Marking of classified information)
(1) Any written documents, including books and brochures and their reproductions, shall have their classification level marked in their heading and foot on every page of the document, including the external side of the front cover, if any.Each page of the document shall be marked in the footer not only with classification level but also with a subsequent page number of the total number of pages of the document (for example, 3/10). The front page or the covers of books and brochures may be left without the subsequent page number.In numbering, the front page or the cover shall be counted as the first page.If the contents of a book or a brochure were subsequently graded as classified information, it is not necessary to change the existing numbering.
(2) The marking of classification level (hereinafter referred to as “the marking”) on any other documents or media (for example the maps, photographs, video or sound recordings) containing classified information, shall be visibly imprinted, typed, written, painted, glued or affixed by some other method using the appropriate means on the document or medium.
(3) If a document or medium is kept in any kind of envelope, such envelope shall bear appropriate markings indicating that it contains classified information and its classification level.
(4) Classified information shall not be destroyed, damaged or rendered useless in some other way by the process of marking the documents or media.
Article 4
(Marking)
(1) When assigned the appropriate classification level, each document and medium shall be visibly marked with markings as determined by the law.
(2) All documents or media classified SECRET and TOP SECRET shall also bear the following data in addition to the markings defined in the preceding paragraph:
copy number of the document;
total number of pages of a document;
number, reference number and date of any annexes.
(3) Any documents classified TOP SECRET shall be marked by at least 4 millimetres thick red line, extending diagonally at an angle of 45 degrees four centimetres from the top right edge of a page, in addition to the marking prescribed in the preceding Article.
(4) The marking of classification level shall be clearly distinguished from other inscriptions and shall use a different writing style whose letters must be larger from the letters used in the remaining inscriptions.
(5) The markings of classification level are indicated in marking samples VZ-I, VZ-Z, VZ-T and VZ-ST, listed in Annex I hereof, and shall form an integral part of this Decree.
Article 5
(Keeping the written assessment)
A written assessment, constituting the basis for assigning the classification level to an item of information, shall be kept as annex to the document by the agency assigning the classification level.
Article 6
(Additional marking)
(1) In compliance with the statute or other regulations, classified information may bear other markings in addition to those determined in Article 4 hereof in order to provide maximum security.
(2) Markings as referred to in the preceding paragraph shall be written under the markings as referred to in Article 4 hereof.
Article 7
(Exceptional marking)
(1) In a document containing classified information, each paragraph may exceptionally be marked with a different classification level as follows:
the markings (I), (Z), (T), (ST) shall be written at the beginning and at the end of each paragraph;
the classification of a document containing several paragraphs of different classifications shall be as high as its most highly classified paragraph;
the following shall be entered in the space designated for additional markings:“The paragraphs are marked with different classification levels.”
(2) The authorized person who assigned the classification level shall also include in his written assessment the reasons for assigning different classification levels to particular paragraphs.
Article 8
(Marking of copies)
(1) A physical copy of the entire or just part of a document containing classified information shall be marked with the classification level of its original and a marking identifying it as a copy by placing the word COPY and its subsequent number on the right side of the first page in line with the top classification marking. A copy of an item of classified information in electronic form shall be marked following the same method.
(2) A document that is being copied shall also be marked to indicate the recipient of the copy and the number of copies received.
(3) A physical copy of a portion of a document containing classified information shall be marked with the reference number of its original in addition to the marking from the preceding paragraph. If a copied portion of a classified document fails to indicate the classification level of its original, such indication shall be added to it.
Article 9
(Marking reclassification or declassification)
(1) When the classification level of an item of classified information is changed or the information is declassified, the original classification markings affixed on such a document or medium shall be crossed out and a reclassification or declassification marking shall be affixed bellow or above the original marking. A document or medium containing classified information shall be accompanied by a document constituting the basis for its reclassification or declassification.
(2) Classified documents marked pursuant to the regulations effective before the entering into force of the Classified Information Act, shall be assigned the classification level under the above Act and this Decree at the time of their repeated use. Such document shall be accompanied by a document assigning it a new marking.
(3) The authorized person of the competent agency who changed the classification level of an item of classified information shall ensure that all the recipients thereof are notified about the change.
III.HANDLING AND STORAGE OF CLASSIFIED INFROMATION
Article 10
(Security area)
(1) Information classified RESTRICTED can be handled in administrative areas.Information classified CONFIDENTIAL or higher can be handled and stored only in a defined, visibly marked area (hereinafter referred to as “security area”), categorized as Class I or Class II Security area according to the method of storage and handling of classified information.
(2) Class I Security area is a marked area where information classified as CONFIDENTIAL or higher is handled and stored in such a way that entry into the area constitutes, for all practical purposes, access to these classified information.In Class I Security area, at least the following security procedures and measures shall be applied:
– entry control system, providing total control over the entry or exit of persons and vehicles in and from this area, permitting entry only to the persons having authorized access to classified information and assigned to this area or having a special authorization to enter this area;
–keeping a register of classified information accessed by persons upon their entry into the security area;
–prohibition of introducing any mechanical, electronic, magnetic and optical components that might enable unauthorized recording, removing or transmitting of classified information;
–direct and continued physical safeguarding of the security areas that may, based on the threat assessment, be reinforced or replaced by electronic intrusion detection system for the protection of security area whose alarm signal is linked to the unit responsible for taking action in the case of alarm (control centre); intervention time shall be less than seven minutes;
–upon replacing physical security with a technical security system, the latter shall ensure a comprehensive control of the security area that shall be controlled from the control centre. The system shall be provided with emergency electrical supply;
–the premises shall be inspected after the working hours.
(3) Class II Security area: a marked area where information classified CONFIDENTIAL or higher is handled and stored in such a way that the entry and movement in the area per se do not constitute access to these classified information.In Class II Security area, at least the following security procedures and measures shall be applied:
–Entry control system, admitting only the persons having authorized access to classified information of the appropriate classification level and having the need to enter the area by reason of their duties;
–Such organization of work as will ensure that the persons working in the security area shall have access only to the classified information they have the need to know by reason of their duties and to the classification level for which they have the appropriate security clearance;
–Movement control system ensuring that other persons enter the security area only when escorted by a person employed in the security area or equivalent controls admitting the visitors only to the parts of the area related to the purpose of their visit and, if necessary, providing them with access to only those classified information that are related to the purpose of the visit and to the classification level for which they have authorization;
–Introducing any mechanical, electronic, magnetic and optical components that might enable unauthorized recording, removing or transmitting of classified information shall be allowed, but all the equipment must be switched off.Its use shall be subject to approval by the person in charge of the security of the security area on case-by-case basis;
–After the working hours, the security area shall be protected by a physical and intrusion detection system or periodic physical checking of the premises designated in the security plan.
(4) Around or leading up to Class I or Class II security areas, an administrative area of lesser security may be established, comprising all of the agency’s premises.Such an area requires a visibly defined perimeter allowing the agency to control the entry and movement of personnel and vehicles. Only information classified RESTRICTED shall be handled and stored in administrative areas, while the security procedures and measures shall ensure that such information is accessible only to persons signing a statement to the effect that they are acquainted with the regulations governing the handling of classified information and have the need to know by reason of their duties.
(5) A person shall be issued a special authorisation to enter Class I security area by the director of an agency or organization covering the security area or by a person authorized in writing to do so by the director of the agency or organization.
(6) Entry and exit of persons and vehicles in and out of security areas shall be supervised.All entries and exits shall be recorded.
Article 11
(Identity card)
(1) All persons moving within Class I or Class II security areas shall wear and display their identity cards prominently to allow them to enter and move within Class I or Class II security area (hereinafter referred to as “identity card”). Identity cards shall differ depending on the status of the person wearing it (identity cards for the employees, visitors, technical staff, etc.).
(2) A regulation may determine when certain persons do not need to wear and display their identity cards prominently within Class I or Class II security areas.
(3) The design of identity cards and their technical reproduction shall be determined by the agency’s director.
Article 12
(Determining security and administrative areas)
(1) The director of the agency or organization shall determine security and administrative areas by issuing a decision.
(2) The agency or organization as referred to in the second and third paragraphs of Article 1 of the Act shall, prior to issuing the decision on the designation of a security area, obtain the opinion of a national security body on the conformity of technical security equipment, incorporated in the security area, and procedures and measures for the protection of the security area.
Article 13
(Marking of security and administrative areas)
(1) A person about to enter the security area shall be notified to this effect clearly and unambiguouslyprior to entering such an area.
(2) The notice from the preceding paragraph shall contain clearly visible inscriptions: “Name of Agency – SECURITY AREA – Class II or Class I”, and may include other notices related to security procedures and measures that are implemented in the security area.
(3) In order to mark the administrative area, no special notice as referred to in the first paragraph of this Article shall be necessary; it shall be sufficient for the area or the building or the neighbourhood of the area to be marked with tables bearing the name of the agency and notice on the entry and exit control, if any.
(4) When required so by reason of the agency’s duties, the director of the agency may determine in the decision on designation of a security area that the security area shall not be marked with the notice as referred to in the second paragraph of this Article, or that it shall be marked in a manner not disclosing to the public that it refers to an agency’s facility.
(5) The sample of inscriptions as referred to in the second paragraph of this Article is given in Annex II hereof.
Article 14
(Entry and exit controls)
(1) The entry of permanent staff into security and administrative areas shall be controlled by personal recognition system applicable to the entering person. Physical entry control may be supplemented by a system of automated identification of identity cards or biometric characteristics of entering persons.
(2) Prior to a visitor’s entry into a security or administrative area, the person controlling the entry to the security area shall check his/her identity and the purpose of his/her visit, and whether he/she meets other conditions required for the entry to the security area.
(3) A pass shall be issued to a visitor allowed to enter the security area and his/her movements in the security area shall be appropriately controlled and recorded.
(4) The data from the second and third paragraphs of this Article shall be recorded in the register of entries and movements in the security areas of the agency.
(5) The plan of security area protection shall include the measures and procedures of more stringent control or limited entry and movement in the security and administrative areas when indicated so by threat assessment or changed conditions of safety.
(6) Visitors and other persons (clients) may enter and exit the premises intended specifically for receiving the clients escorted by the staff employed in the agency without identity control and without keeping a record of their entry.
Article 15
(Protection of equipment)
Copying and telefax machines and other equipment for processing classified information located in security areas shall be appropriately protected to ensure that only the persons specially authorised to handle such equipment can use them.
Article 16
(Handling classified information outside the security area)
(1) Classified information may be handled outside the security area if the premises or the area where they are dealt with are physically or technically protected and the access thereto controlled.A person handling an item of classified information outside the security area shall have such item of classified information under the control at all times. After the handling is completed, such item of classified information shall be returned to the security area.
(2) When an item of classified information graded CONFIDENTIAL or higher needs to be handled outside the premises of a certain agency by reason of implementing a special duty, the responsible person shall elaborate a plan of measures and procedures for the protection of such item of classified information appropriate to its classification level. These measures and procedures shall be comparable to those prescribed for a particular security area.
(3)Any taking out of or bringing into the security area of an item of classified information graded CONFIDENTIAL or higher by its bearer shall be recorded. The person receiving the item of classified information shall confirm it by his/her signature, thus assuming the responsibility for the security of such item of classified information.
Article 17
(Technical security equipment)
Technical security equipment of security areas shall comply with the conditions determined by the Government of the Republic of Slovenia on the proposal of the national security authority.
Article 18
(Anti-eavesdropping inspection)
(1) Class I security areas and security areas in which information classified SECRET or above is regularly discussed shall be protected against passive and active eavesdropping attacks.Anti-eavesdropping inspection of these security areas shall be performed: