1. ESS Security and Secure exchange of information Expert Group (E4SEG) DIME/ITDG SG ESS IT Security Framework
Pascal Jacques ESTAT B2 Local Security Officer

2. The Context
Core Principles for the exchange of confidential business data endorsed by ESSC in February 2016
"Exchange of confidential data takes place only when confidentiality and information security meet the highest standards".
all ESS members to take the necessary regulatory, administrative, technical and organizational measures to ensure the physical and logical protection of confidential data following agreed common confidentiality standards

3. The Context
common information security standards (IT, organizational and physical elements) shall be established and their implementation should be regularly monitored
a system of monitoring has to be developed and implemented covering ESS members(NSIs, ONAs (Other National Authorities) and Eurostat

4. VISION 2020 - Mitigating risks of microdata exchange
Build trustworthiness between ESS Members by:
Common Security Framework
Security Assurance
Reporting compliance to ESSC
Scope:
management and exchange of microdata between Member States on a mandatory basis

5. ESS IT Security Framework (1)
1. Introduction document
context/scope
2. Risk analysis
focussing on
management & storage of microdata
transfer of confidential statistical information
based on ESTAT data classification

6. ESS IT Security Framework (2)
3. IT security controls
Based on ISO27K:2013
entry pack : 96 out of 114 controls selected with 213 sub-controls
Level 1 : 105 controls
Level 2 : Full ISO27K – 114 controls
4. Guidelines for implementing controls
evidences to be provided.
5. Self-assessment
excel sheet with compliance scoring to Entry Pack

7. Assurance mechanism (1)
Self-assessment compiled by all ESS members June-August 2016.
To help ESS measure their compliance level
Results to be provided to ESTAT
To inform November ESSC on IT Security landscape in the ESS
Assurance mechanism
Self-managed and financed certification mechanism - Conclusions of audit analysed and validated/endorsed by central ESS certification service;

8. Assurance mechanism (2)
Central ESS certification service selected through an Open Call for Tender
29 ESS members to conduct audit
ESTAT Included
For ONAs, NSIs should act as intermediary
Applies to ESS members and service providers (contractors, private cloud provider, etc.)
Multiple interactions will be needed between central certification service and ESS members.
Audit details and artefacts remain confidential – Summary of certification process submitted to ESSC annually

9. Capacity Building grants
ESTAT to provide support to MS
To improve their IT security level
To ensure compliance to ESS IT Security Entry Pack
Mono-beneficiary grants
Organised in 2 steps
First group of ESS members to be supported in 2017 for audit in 2018
Second group of ESS members to be supported in 2018 for audit in 2019

10. Roadmap (1) Present and discuss the ESS IT security framework.
DIME_ITDG Steering Group 18/11/2015
Working Group Statistical Confidentiality 1/12/2015
12th SIMSTAT TF Meeting 9-10/2/2016
DIME/ITDG 24-25/2/2016
ESTAT IT Advisory Committee 26/2/2016
ESTAT DM 8/3/2016
VIG 14/3/2016
ESSC 18/5/2016
ITWG 26/5/2016
DIME/ITDG SG 28/6/2016
February ESSC endorses Core Principles
May 2016 – ESSC endorses IT security framework
6th June launch ESS Self-Assessment exercise

11. Roadmap (2)
31th August 2016 – Receive Self-assessment and prepare analysis
June Launch call for tender for Central Certification Service
September 2016 – Launch of 1st Call for proposals for mono-beneficiary grants : Capacity Building Grants to start early 2017
End 2016
Report to ESSC on ESS security level
ESSC Endorsement of IT security assurance mechanism
Certification mechanism ESS countries phase 1
June 2017 – Launch of 2nd Call for proposals for mono-beneficiary grants : Capacity Building Grants to start early 2018
Certification mechanism ESS countries phase 2
Certification mechanism ESS countries phase 3
End of 2017, 2018, 2019: Reporting progress to ESSC
Restart cycle of certification mechanism