ESS Security and Secure exchange of information Expert Group (E4SEG) DIME/ITDG SG ESS IT Security Framework Pascal Jacques ESTAT B2 Local Security Officer

The Context Core Principles for the exchange of confidential business data endorsed by ESSC in February 2016 "Exchange of confidential data takes place only when confidentiality and information security meet the highest standards". all ESS members to take the necessary regulatory, administrative, technical and organizational measures to ensure the physical and logical protection of confidential data following agreed common confidentiality standards

The Context common information security standards (IT, organizational and physical elements) shall be established and their implementation should be regularly monitored a system of monitoring has to be developed and implemented covering ESS members(NSIs, ONAs (Other National Authorities) and Eurostat

VISION 2020 - Mitigating risks of microdata exchange Build trustworthiness between ESS Members by: Common Security Framework Security Assurance Reporting compliance to ESSC Scope: management and exchange of microdata between Member States on a mandatory basis

ESS IT Security Framework (1) 1. Introduction document context/scope 2. Risk analysis focussing on management & storage of microdata transfer of confidential statistical information based on ESTAT data classification

ESS IT Security Framework (2) 3. IT security controls Based on ISO27K:2013 entry pack : 96 out of 114 controls selected with 213 sub-controls Level 1 : 105 controls Level 2 : Full ISO27K – 114 controls 4. Guidelines for implementing controls evidences to be provided. 5. Self-assessment excel sheet with compliance scoring to Entry Pack

Assurance mechanism (1) Self-assessment compiled by all ESS members June-August 2016. To help ESS measure their compliance level Results to be provided to ESTAT To inform November ESSC on IT Security landscape in the ESS Assurance mechanism Self-managed and financed certification mechanism - Conclusions of audit analysed and validated/endorsed by central ESS certification service;

Assurance mechanism (2) Central ESS certification service selected through an Open Call for Tender 29 ESS members to conduct audit ESTAT Included For ONAs, NSIs should act as intermediary Applies to ESS members and service providers (contractors, private cloud provider, etc.) Multiple interactions will be needed between central certification service and ESS members. Audit details and artefacts remain confidential – Summary of certification process submitted to ESSC annually

Capacity Building grants ESTAT to provide support to MS To improve their IT security level To ensure compliance to ESS IT Security Entry Pack Mono-beneficiary grants Organised in 2 steps First group of ESS members to be supported in 2017 for audit in 2018 Second group of ESS members to be supported in 2018 for audit in 2019

Roadmap (1) Present and discuss the ESS IT security framework. DIME_ITDG Steering Group 18/11/2015 Working Group Statistical Confidentiality 1/12/2015 12th SIMSTAT TF Meeting 9-10/2/2016 DIME/ITDG 24-25/2/2016 ESTAT IT Advisory Committee 26/2/2016 ESTAT DM 8/3/2016 VIG 14/3/2016 ESSC 18/5/2016 ITWG 26/5/2016 DIME/ITDG SG 28/6/2016 February 2016 - ESSC endorses Core Principles May 2016 – ESSC endorses IT security framework 6th June 2016 - launch ESS Self-Assessment exercise

Roadmap (2) 31th August 2016 – Receive Self-assessment and prepare analysis June 2016 - Launch call for tender for Central Certification Service September 2016 – Launch of 1st Call for proposals for mono-beneficiary grants : Capacity Building Grants to start early 2017 End 2016 Report to ESSC on ESS security level ESSC Endorsement of IT security assurance mechanism 2017 - Certification mechanism ESS countries phase 1 June 2017 – Launch of 2nd Call for proposals for mono-beneficiary grants : Capacity Building Grants to start early 2018 2018 - Certification mechanism ESS countries phase 2 2019 - Certification mechanism ESS countries phase 3 End of 2017, 2018, 2019: Reporting progress to ESSC 2020-2022 - Restart cycle of certification mechanism