Security clearance

AREAS OF PROTECTION OF CLASSIFIED INFORMATION AND PREPARATION OF THE CLIENT FOR THE SECURITY MANAGEMENT OF THE NSA

The Provider will prepare a complete security documentation for the classification level "C - Confidential" and "S - Secret" with the form of access according to the provisions of § 20 par. a, b) according to Act. No. 412/2005 Coll. as amended and in accordance with the implementing regulations to the law. The Provider's participation in individual acts within the preparation of the Client for obtaining a certificate from the NSAwill be direct and personal without representatives and intermediaries.

The contract does not include documentation for the certification of the information system (communication system and cryptographic protection) in the sense of § 4 of Decree no. NSA No. 523/2005 Coll. and § 46 of Act no. 412/2005 Coll.).

The Provider shall process and deliver to the Client the following documents for the needs of the security procedure to obtain the organization's certificate for access to classified information of level "C" - Confidential and "S" - SECRET at the NSA:

Safety documentation of the organization according to § 98 of Act no. 412/2005 Coll., Which must contain, among other things

• listing of classified information;
• company information incl. internal organizational structures;
• specification of classified information to which the entrepreneur assumes access;
• analysis of possible threats to classified information (risk analysis), including measures to reduce or eliminate these risks;
• methods of implementing individual types of ensuring the protection of classified information (with a special focus on the physical security of classified information);
• a list of functions and persons for whom the organization is expected to be acquainted with classified information (including an indication of the classification level of this information);

2.    As part of the security documentation, it will be processed by the Provider separately or as an integral part in accordance with Annex No. 1 to Decree no. NSA No. 528/2005 Coll. as amended NSA No. 19/2008 Coll.

"Project of physical security of classified information" with the prescribed internal structure, which consists of (in the case of security management level - C - S "- Confidential - Secret);

• Risk assessment;
• Technical documentation of physical security;
• Operating rules of the secured area / object (incl. The so-called key rules);
• Security plan of the building and secured area in crisis situations (crisis plan);
• Object identification, secured area incl. their boundaries and the designation of categories and classes of secure areas;
• Method of application of physical security measures (incl. Table of point evaluation of physical security measures);

Guidelines of the organization for handling classified documents "Principles of work with classified documents at the organization" - which will deal with the so-called administrative security of classified information, ie their marking, registration, storage, transmission, sending, copying, etc., incl. shredding.

The organization's directive for the so-called personal security of classified information entitled "Principles of personal security of classified information at the organization", which will include, among other things, the procedure for selecting persons for security proceedings to obtain accessories. NSA certificates, requirements for these persons, methods of their instruction and responsibility of individual persons and their mandatory training in the field of classified information.

In cooperation with the designated employee of the Client, the "Safety Questionnaire" of the organization will be filled in and completed under the methodical guidance of the Provider, including the relevant mandatory annexes, so that the safety management can be approved. degree with the Client at the NSA certificatesstarted.

Note in this area, the Client's cooperation is necessary and crucial. The questionnaire will require, among other things, some accounting and financial documents of the organization. At the same time, confirmations will be attached, eg of the tax office, banks and leasing companies, an extract from the securities center, etc. To speed up the process and reduce the associated administration, the NSA will be asked to reuse some even in this safety procedure. 

Depending on the level of required security management, the Provider will provide appropriate methodological assistance in the preparation of the "Security Management of Natural Persons of the Organization", who should obtain a certificate from the NSA for access to classified information. degrees. This mainly concerns the completion of the application and the questionnaire of natural persons and the addition of the relevant annexes. Each candidate will be dealt with individually, as each application case is specific. The basic price of the service includes methodological assistance with questionnaires and a security check of a total of 3 natural persons (responsible person, procurators).

Part of the Client's preparation for security proceedings will be the "Mandatory training of persons for contact with classified information" (ie including persons who do not yet have a security clearance, but are expected to check it in the future). The date of the training is determined by the client himself, whichever is more suitable for him. The scope of the training is about 2 - 3 hours. Capacity up to 10 people.

6.    The Provider will "Represent the company before the NSA" of the Client throughout the security proceedings, even after the submission of complete documentation to the NSA, in the form of methodological cooperation and actual implementation or. supplements, if requested by the NSA, until the issue of the certificate.

Note: The Provider's co-operation actually continues even after the handover of the work according to Article 7, until the issuance of the relevant certificate for the organization (Client), even if the main part of the work is done when submitting all documentation to the Client. However, during the security proceedings, the NSAmay require various clarifications or additions. Prior to the actual issuance of the certificate, the NSAstaff carries out the so-called inspection, during which they personally check with the organization about the compliance of the implemented and written project. The Client will personally participate in this inspection.

The Client shall provide a confirmation from the selected st. authority or a document on the preparation or existence of a public contract, in which there is a requirement for the relevant certificate for access to classified information level D and T with the required form of access (ie according to § 20 paragraph 1 letter a) of Act. No. 412/2005 Coll. as amended).

AGENDA

Process stages, processing dates, delivery date of complete documentation. The individual stages of the organization's preparation for security proceedings to obtain the NSA certificate are as follows:

• acquaintance with the conditions of the organization, their analysis and specification of further procedure,
• processing the organization's questionnaire,
• preparation, request and collection of material for the annexes of the organization's questionnaire,
• processing of individual documents that form the security documentation of the organization,
• discussion of documentation with the organization, completion,
• training of persons
• submission of the application, documentation, questionnaire and annexes to the NSA.

The safety documentation, including other materials, will be processed within 8 weeks from the handover of the necessary documents by the Client to the Provider. Processing of individual stages:

1st - 2nd week - stages 1.3 3rd - 8th week - stages 2,4,5,6 9th - 12th week - stage 7

It is clear from the time schedule that some stages take place simultaneously side by side, specifically the processing of individual documents and the questionnaire. At the same time, individual file materials are required, which will form an appendix to the questionnaire.

Negotiations with NSA staff will be carried out by the Provider on an ongoing basis during the processing of documentation and the questionnaire, as required in cases where any ambiguity arises. The physical security project will also be discussed in advance with the staff of the NSA Department of Physical Security to obtain prior unofficial approval in order to avoid any complications during the actual security procedure.

Duration of security proceedings: according to the provisions of § 117 of Act no. 412/2005 Coll., On the protection of classified information and on security clearance, as amended, the NSA is obliged to proceed with the issuance of a certificate for the classification level

• "S" - SECRET to terminate the organization's application within 8 months from the delivery of the organization's application and within 2 months from the date of delivery of the natural person's application.
• "C" - CONFIDENTIAL to terminate the organization's application within 6 months from the delivery of the organization's application and within 6 months from the date of delivery of the natural person's application.
• "R" - RESERVED to terminate the organization's application within 3 months from the delivery of the organization's application and within 1 month from the date of delivery of the natural person's application.

The individual stages of preparation of selected natural persons for security proceedings to obtain the NSA certificate will be as follows:

• acquaintance of the applicant with the meaning of security management, instruction on rights and obligations, acquaintance with the procedure of filling in the questionnaire of a natural person (can be done within the proposed training),
• leading a natural person to fill in the questionnaire correctly ** and to obtain the necessary annexes to the questionnaire,
• completion of file materials and handover to the NSA.

** Questionnaires from the organization and individuals may contain information that may constitute a trade secret or may be otherwise sensitive. In order not to reduce the security of handling this data, all questionnaires will be processed exclusively by the organization and individuals in their presence. The data will not be available to the processor in written or electronic form. If individual natural persons do not wish the processor to become acquainted with their data, the processor will only perform methodological guidance of applicants and consulting activities.

The preparation of individual natural persons for the security procedure will take place in parallel with the preparation of the organization, with the proviso that it is not necessary to submit applications from natural persons to the NSA at the same time and within the deadline. Based on practical experience, it can be assumed that the preparation of these individuals may take more than 5-6 weeks for some individuals, as some will not be able to provide some annex materials to the questionnaire and application in time. These will be worked on until their application is submitted to the NSA. On the other hand, in the case of persons who have already undergone the "D" level verification process, a faster procedure can be expected.