Control activities

Insights from inspections

Under Paragraph 143(1) Act No 412/2005 on the protection of classified information and on security capacity (hereinafter referred to as “the Act”), the National Security Authority (NBÚ) monitors the compliance of state authorities, legal entities, sole traders and natural persons (hereinafter referred to as “controlled persons”) with legislation on the protection of classified information and security capabilities. Pursuant to Section 143(5) of the Act, a representative of the National Cyber and Information Security Authority (NÚKIB) may be invited in case of an inspection that interferes with the scope of the National Cyber and Information Security Authority (NÚKIB).

The NBÚ's control activities are permanently focused on State authorities and certificate holder entrepreneur, to:

  • entrepreneurs with a form of access pursuant to Section 20(1)(a) of the Act - classified information is created or provided to the entrepreneur,
  • entrepreneurs with the form of access pursuant to Section 20(1)(b) of the Act - employees of the entrepreneur have access to classified information in connection with his activities, but the classified information is not located with the entrepreneur
  • Entrepreneurs who, pursuant to Section 15a of the Act, have made a Declaration of Entrepreneurship for access to classified information classified at the level Reserved.

The obligations in respect of the protection of classified information, compliance with which is monitored by the Office, shall be laid down by law and its implementing legislation:

Sections 148 to 156 of Part Eight of the Act provide: List of misdemeanours in the field of protection of classified information. However, the primary purpose of the Office’s control is not to punish misconduct in protecting classified information, but to provide regulatory addressees with systematic and effective methodological oversight to help identify risks in specific circumstances, thereby preventing breaches of legislation and preventing the emergence of serious systemic failures.

Insights from inspections

Below are listed both the most common and some specific shortcomings that have been identified in the Office’s control activities in recent years.

Weaknesses in compliance with general obligations and staff security

Weaknesses in industrial security

Weaknesses in physical security

Weaknesses in administrative security

Weaknesses in the register of classified information

Weaknesses in compliance with general obligations and staff security

failure to notify the establishment and occupation of the post of Security Director

failure to send one copy of the instruction to the holder of a certificate for access to classified information classified Confidential and above

failure to notify the termination of employment of the holder of a certificate for access to classified information classified Confidential and above

failure to draw up an overview of the places or functions where it is necessary to have access to classified information;

failure to keep records of natural persons who have access to classified information

failure to process records of unauthorised handling of classified information

granting access to classified information to a person who, although in possession of a certificate or notification, has not been instructed

the absence of a written record of the lapse of validity of the notification pursuant to Section 9(3)(b) to (d) (f), (h) or (i) of the Act;

non-delete of one of the paragraphs under which the person has been instructed on a copy of the Instruction in the case of the use of a general form

the release of classified information to a person who did not meet the conditions for access to classified information of the appropriate level;

Weaknesses in industrial security

failure to send a single copy Declaration of the entrepreneur

non-updating of safety documentation

failure to send the updated security documentation of the entrepreneur to the NSA

for holders of certificates of entrepreneurs, failure to notify changes made to the Commercial Register

deposit of classified documents with the entrepreneur even after the expiry of its certificate or declaration (documents must be returned to the originator or another entity according to the law)

Weaknesses in physical security

lack of clarity of the physical security project due to a number of additions and repairs

the drawings included in the physical security project do not correspond to the actual state of deployment of the technical means in the secure area;

the list of persons with permission to enter the object and the secure area is missing or not updated

Absence of a table of technical means used

poorly processed scoreboard of the secured area in the physical security project

scoring of storage objects in the physical security project does not correspond to their type

non-save of copies of certificates of the technical means used/installed for the physical security project

absence of a conformity assessment report for a technical device of the type (door, grille, storage object)

installation of the entrance door to the secure area was carried out in violation of the certificate of the technical device (the opening direction must be followed)

Cylindrical inserts at the door protruded by more than 3 mm from the side of the attack (to be rotated or replaced)

absence of certified fittings in the lockable system of the Secured Area

absence of fire alarm equipment in a secure area of the category Secret

non-documentation of valid certificates of certain technical means or proof of a certificate of another type

incorrect configuration of the electronic input control system

non-functional reporting of the electronic entry control system

display of the emergency signal only visually without an audible signal

non-connection of the electronic access control system to the surveillance post

for shredding stand, non-compliance with the waste particle size requirement (then further destruction by the method of incineration, melting, crushing or pulping shall be ensured and this method of additional destruction shall be described in the physical security project)

Weaknesses in administrative security

Failure to submit the UD for inspection (loss)

non-registration of delivered UD

UD processing on an uncertified information system

non-numbering of sheets or pages and non-assembly or fixed non-assembly of UD sheets

incorrect or missing mandatory elements of the UD itself: correctly placed classification level, originator's name, reference number in the correct format, date of origin, copy number, number of sheets, number of attachments and number of their sheets, type and number of non-listed attachments (separately classified and non-classified)

erroneous record of UD (e.g. technical drawings) stored in the plates – unless a sheet of classified document (e.g. cover sheet) is affixed to the plates, the plates should not contain UD elements (number of sheets, number of attachments, copy number, etc.) and should bear 1 x classification marking (analogy as in the case of an envelope), otherwise it would be the first sheet of UD and the entire content would have to be marked as its attachments, or the plates themselves would have to form one of the attachments

not to declassify the UD with the indication ‘secret until attachments are disconnected’, or not to record the declassification of attachments when they are re-registered

non-registration/non-registering of a detached classified attachment under a new reference number

failure to draw up a checklist for the re-registered annex

non-marking of the declassification on the UD, absence or incomplete record of the declassification

failure to record a copy or extract on the UD

failure to record (written consent of the superior) the creation of a copy on the UD classified Secret or Confidential (also applies if a copy of an unclassified attachment to such UD is made)

failure to record (written consent of the immediate superior) the creation of an extract from a classified attachment (in the case where the contents are printed, even a single file from the CD that formed the attachment to the UD)

Unauthorised classification marking

Determination of a lower classification level of the created document than that of the Annex

non-marking of the classification level on the envelope or packaging in which the UD has been inserted

declassification without the originator’s consent

failure to notify all addressees of UD of the declassification

netting of the delivered distribution sheet drawn up on a separate sheet into the number of sheets of UD or registering it as an attachment without identifying it as an attachment by the originator of UD

incorrect re-recording of a disconnected attachment of a delivered classified document (cannot be recorded as own UD)

erroneous registration of the returned document (the returned classified document is de facto a classified document delivered when the original addressee/recipient has changed to sender and the document has a new document/ref.)

Failure to register a classified document delivered by mistake

Absence of distribution or record

the inclusion of incorrect or incomplete data in the distribution list;

the inclusion of incorrect or incomplete data in the record;

sending UD in non-paper form without cover letter

failure to comply with the legal procedure for handing over the UD, e.g. failure to provide proof of receipt of the UD within the organisation (signature in the handling book)

absence of an entry in the handling book on the created UD (the person who creates the UD writes it in his own handling book, where he then has his handover confirmed to the person in charge of the negotiation protocol, who ensures its dispatch, or to another person)

failure by the postal licence holder to provide proof of receipt of the consignment for transport

failure to provide all the data on the receipt of the UD by the recipient

failure to resolve the defect of the delivered consignment with the sender

Confidential UD lending without the written consent of the responsible person or the Security Director

non-return of the borrowed UD to the loan book for the purpose of a physical check, which is mandatory in January of each year

non-compliance with formal and content requirements (e.g. missing boxes, wrong names)

failure to mention in the minutes the person in charge

non-execution or incorrect execution of authentication

non-classification of the notebook and non-authentication

erroneous correction of records

incorrectly performed acts in administrative aids that are not intended for this purpose (transmission in a loan book without a loan, confirmation of receipt of UD in an incorrect aid)

failure to document the performance of the relevant acts in the event of personnel changes (creation of a handover report in the event of a change of the person in charge of the minutes)

management of administrative aids in electronic form, although the requirements laid down for this method of management have not been met

Difference between data on number of sheets and attachments in administrative aids when transmitting one UD

Fixed non-connection/non-separation of the UD file after closing the collection sheet

destruction of some UDs entered and registered in an already closed collection sheet

failure to draw up a checklist for UD classified Confidential or above

failure to include all persons familiar with the content of the UD in the checklist (i.e. also the person who created the document and the person who registered it)

use of one checklist for multiple UDs at the same time

Absence of ID card numbers for persons entered in checklists who became acquainted with UD and who were not employees of the controlled person

Failure to save a checklist for a document that has been sent

destruction of the checklist before the deadline (e.g. in the context of UD shredding)

registration of a classified document of a foreign power together with ‘national’ classified documents

incomplete or incorrect records in the negotiation protocol (JP) or in the collection sheet (SA)

erroneous or non-executed declassification entries (without crossing out the abbreviation in column 1 of the JP and in column ‘Order number’ of the SA)

non-registration of the initiative document in the JP (document establishing the collection sheet)

absence of information on the establishment of the collection sheet in column 3 of the JP

erroneous date in column 4 of the JP (date of delivery indicated instead of the date indicated on the UD)

Column No 6 of the JP erroneously indicates the aggregate number of sheets of all copies

in column 8, no indication of other persons to whom the UD has been handed over or a reference to the administrative aid in which the handover is recorded and confirmed

non-closure or incorrect/incomplete closure of the collection sheet

non-closure of records in the JP at the end of the calendar year, or incomplete record of this act

Weaknesses in the register of classified information

the person entered in the register of classified information of a foreign power held a certificate for a classification level lower than that of the register of classified information of a foreign power;

a person included in the NATO Classified Information Register did not hold a valid certificate for foreign power;

the list of persons who may be granted access to classified information of a foreign power did not contain all the mandatory particulars;

only one comprehensive list of individuals who can be granted access to classified information of a foreign power has been maintained, not separate lists for the EU, NATO and OSCM separately

a classified document of a foreign power has been acquainted with a person who was not the holder of the notification or certificate or a person who has special access to classified information

a person who did not hold a certificate of a natural person for a foreign power has become acquainted with a NATO classified document classified as Confidential

a classified document of a foreign power has been acquainted with a person who was not included in the access list

Register entry sheet has not been updated

classified documents of a foreign power have been recorded in ‘national’ negotiation protocols

on classified documents of a foreign power, the Czech equivalent of the security classification level including the relevant abbreviation was not marked on the first page

a checklist for a classified foreign power document has not been drawn up;

a classified document of a foreign power has been sent as an annex to a ‘national’ classified document

the classification levels have been marked on the translation of a classified document of a foreign power, but without the appropriate abbreviation (NATO, EU)

classified documents of a foreign power were recorded in a collection sheet

the checklists have not been stored in the Classified Information Register (destroyed together with the documents) after the removal of classified documents of a foreign power;

shredding of classified documents of a foreign power with the generation of larger waste particles than stipulated by the relevant regulation (see physical security)

Finally, the recommendation:

In case of any ambiguities or unexpected situations when working with classified information, do not hesitate to contact the staff of the NSA, they will certainly advise you how to deal with the ambiguity or situation.

The NBÚ's information line is 257 283 111, from where you will be transferred to a competent employee.