02.11.2010

The National Security Authority (hereinafter “the Authority”) draws attention to the following interrelated issues relating to personnel and industrial security:

The basic document for initiating the procedure for issuing a natural person’s certificate for access to classified information (‘FO certificate’) is the so-called ‘Application for the issue of a natural person’s certificate’ - here . In addition to the applicant's personal data, the request must include a justification for the need for access to classified information and confirmation of this justification by the so-called responsible person (Section 2(e) of the Act) or who will provide the individual with classified information of the appropriate level (see also Section 94(1) of the Act).

In this context, the Office draws attention to cases where the natural person applying for the issue of an FO certificate is confirmed in the application by the responsible person as justifying access to classified information of such a degree that the responsible person is not entitled to provide the natural person.

Example:an individual submits an application for an FO certificate for access to classified information classified at Secret level and justifies the need for access to such information, e.g. ‘the need to become acquainted with classified information classified as Secret in the context of an employment relationship with XY, s.r.o.’. This justification is confirmed in the request by the responsible person company XY, s.r.o., however, this company does not hold a certificate of entrepreneur for access to classified information of the level Secret or higher (and is therefore not entitled to handle such information in any way) nor is the Office conducting proceedings for the issue of such a certificate of entrepreneur of this company.

In this regard, the Office points out that such requests must be considered as not complying with the mandatory requirements as regards their proper justification. In this case, the Office shall suspend the proceedings with reference to the provisions of Section 102 of the Act and shall invite the party to the proceedings to submit a new, duly substantiated request. If the deficiencies are not remedied or the information that justifies the admissibility of the submitted FO certificate application is not completed within the legal deadline, the security proceedings will be terminated by the Office.

Based on previous experience with similar cases, where applications for FO certificates are justified by the performance of work involving access to higher-level classified information at another entity (i.e. not directly within the entity employing the natural person, typically supply relationships); The Office draws attention to the basic obligations of the entrepreneur in the field of protection of classified information arising, inter alia, from the provisions of Section 20 of the Act:

§ 20
Forms of access by entrepreneurs to classified information

(1) the entrepreneur has access to classified information,

a) which arises from it or is provided to it, or

b) which is not created or provided to him, but to which the employees of the entrepreneur or a person acting on behalf of the entrepreneur or on behalf of the entrepreneur have access, in connection with the performance of work or other activities for the entrepreneur on the basis of a contract.

(2) In the case of access under paragraph 1(b), the entrepreneur must meet the condition under Section 16(1)(c) only by ensuring the protection of classified information by personnel security [Section 5(a)].

It follows that if the employees of XY, s.r.o. are granted access to classified information by an entity other than XY, s.r.o. in the course of their work for XY, s.r.o., they must be - in accordance with the provisions of the Act. Section 20(1)(b) and (2) of the Act – also XY, s.r.o. holds an entrepreneur’s certificate for access to classified information of at least the appropriate level, at least in the form of ‘introduction’ (Section 20(1)(b) of the Act). If this is not the case, there is a violation of the law with all the ensuing consequences.