17.3.2015 Official Journal of the European Union L 72/53 COMMISSION DECISION (EU, Euratom) 2015/444 of 13 March 2015 on the security rules for protecting EU classified information THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249 thereof, Having regard to the Treaty establishing the European Atomic Energy Community, and in particular Article 106 thereof, Having regard to the Protocol No 7 on the Privileges and Immunities of the European Union annexed to the Treaties, and in particular Article 18 thereof, Whereas: (1)  The Commission’s security provisions regarding the protection of European Union Classified Information (EUCI) need to be reviewed and updated, taking into account institutional, organisational, operational and technological developments. (2)  The European Commission has entered into instruments on security matters for its principal sites with the governments of Belgium, Luxembourg and Italy (') (3)  The Commission, the Council and the European External Action Service are committed to applying equivalent security standards for protecting EUCL (4) Tt is important that, where appropriate, the European Parliament and other Union institutions, agencies, bodies or offices, are associated with the principles, standards and rules for protecting classified information which are necessary in order to protect the interests of the Union and its Member States. (5)  Risk to EUCI shall be managed as a process. This process shall be aimed at determining known security risks, defining security measures to reduce such risks to an acceptable level in accordance with the basic principles and minimum standards set out in this Decision and at applying these measures in line with the concept of defence in depth. The effectiveness of such measures shall be continuously evaluated. (6)  Within the Commission, physical security aimed at protecting classified information is the application of physical and technical protective measures intended to prevent unauthorised access to EUCL (7)  The management of EUCI is the application of administrative measures for controlling EUCI throughout its life- cycle to supplement the measures provided for in Chapters 2, 3 and 5 of this Decision and thereby help deter, detect and recover from deliberate or accidental compromise or loss of such information. Such measures relate in particular to the creation, storage, registration, copying, translation, downgrading, declassification, carriage and destruction of EUCI and they supplement the general rules on document management of the Commission (Decisions 2002/47[EC (3, ECSC, Euratom and 2004/563EC, Euratom (?)). () Cf.the ‘Arrangement entre le Gouvernement belge et le Parlement européen, le Conseil, la Commission, le Comité économique et social européen, le Comité des régions, la Banque européenne d'investissement en matiere de sécurité’ of 31 December 2004, the ‘Accord de sécurité signé entre la Commission et le Gouvernement luxembourgeois’ of 20 January 2007, and the ‘Accordo tra il Governo italiano e la Commissione europea dell'energia atomica (Euratom) per listituzione di un Centro comune di ricerche nucleari di competenza generale’ of 22 July 1959. (*) Commission Decision 200247 [EC, ECSC, Euratom of 23 January 2002 amending its rules of procedure (OJ L 21, 24.1.2002, p. 23). (®) Commission Decision 2004/563/EC, Euratom of 7 July 2004 amending its Rules of Procedure (O] L 251, 27.7.2004, p. 9).