REPUBLIC OF ALBANIA
COUNCIL OF MINISTERS
No. 478, Date 19.07.2001
SECURITY OF INFORMATION CLASSIFIED “ STATE SECRET”
IN NETWORKS AND TRANSMITTING DEVICES
Based on the article 100 of the Constitution and articles 24, 31 of the law 8457,
date 11.02.1999 „On information classified „STATE SECRET““, with the proposal of
the Prime Minister, the Council of Ministers,
I. NETWORKS AND TRANSMITTING DEVICES REQUIREMENTS
The state institutions, which, for the needs of their work, have
to produce, protect,
process, deliver or transmit information classified “state secret”, through networks
and transmitting devices, must use the designated rules in this decision.
The networks and devices storing, processing or transmitting information cla
“state secret”, must provide:
a. protection from unauthorised disclosures;
b. unauthorised unchanging;
c. elicit non
The ministry or state institution, must require to the Classified Information Security
Directorate (CISD), the release
of the “network security clearance” or “ device
security clearance”, before they use the network and transmitting devices.
The request is associated with the “security declaration” and other documents
certifying and supporting the network and transmitting
The model and content of the security clearance and security declaration are
designated by CISD.
The “network security clearance” is the document certifying that whole devices of
the network storing, processing or transmitting informa
tion classified “state secret”,
provide the security requirements.
The “ device security clearance” is the document, certifying that transmitting devices
provide the classified information security requirements.
The “security declaration” consist of the d
etailed description of the
network and transmitting devices security, during their use and
installation. It is released to the ministry or state institution and is signed
by the juridical and physical person, foreign or albanian, who
produced, traded or provided in an other way.
CISD, within a month, assesses the presented request. When the network and
transmitting devices provide the classified information security requirements, CISD
releases the “security clearance”.
he request is not approved, the requiring subject, within 10 days, has the right to
complain to the Prime Minister, whose decision is final.
The personnel of the institution or not, who install, maintain or repair the network and
transmitting devices, must
When the installation is carried out by the personnel who aren’t
employees of the ministry or institution, they have to be under constant
supervision of technically qualified personnel who are cleared for access
When the classified information is exchanged between Albania and other nations or
international organisations, in the agreement can be designated and other standards or
requirements to the networks and transmitting devices security.
WORKS AND TRANSMITTING DEVICES SECURITY MEASURES
NETWORKS PHYSICAL SECURITY
The physical security measures to the information classified “state secret”,
designated in other normative acts, are applicable to the networks.
The networks are designed accord
ing to the institution organisation structure and
processing classified information level.
The physical link with the local networks is made only by optic fibre or checked
devices, using more then one obstacle type, which support each other.
The use of dif
ferent modems, which create unchecked connection to the network, is
The physical security of the local network server is made according to the highest
classified information security measures.
REQUIREMENTS TO THE PERSONNEL WHO WORK IN NETWORKS
The network personnel must be cleared in accordance with normative acts, which are
in force. The personnel security clearance level must be in the same level of
The network personnel must be trained in the network operation and ex
field and especially on the activities that threat the network security.
The network administrators are responsible on the implementation of security
measures. They are cleared to the highest classification of the information stored,
d or transmitted within the system, and are selected among the best
specialists of the network operation and exploitation systems.
The individuals, who enter in the network zones, must be under the rules of classified
information protection, designated by
the ministry or institution official.
C. CLASSIFIED INFORMATION SECURITY IN NETWORKS
1. The classified information security in networks must be provided along whole phases
of its full cycle.
The classified information transmitting system must have the a
bility and capacity that
through nonphysical contacts or software special elements, to block up the access to the
2. The storing of classified information in computers, which are linked to internet, is
prohibited. In this case, the storing i
s made in server only.
When computers with fixed hard disc, work out of network and process classified
information, must provide the maximum protection level, in accordance with information
3. The security measures and the right for acce
ss to the classified information are
designated according to its classification level.
The security measures must predict the protection from the damages causing different
viruses, control of entering in network and prevention of ill purposely intervent
4. The users are organized in groups, in accordance with the organization structure. They
have in their disposal the appropriate accounts, which are opened only after they use the
passwords that are belt in accordance with professional procedures an
d are changed
5. The network users are not allowed:
to attempt entering in network under an other identity;
to attempt illegally accessing and administration of classified information;
to import and export
ns, games, etc;
to install or change, in any way, the hardwere, softwere or applications;
to transfer or get out classified information and tapes, without authorisation of
their institution official.
The network is under periodically checking, by respons
ible personnel, to look
changes in network, the security measures of classified information and their fit with
The activity of network users and
must be audited to prevent events
the security of classified informat
To protect the classified information and network configuration processing the
classified information, their reservation must be made in different media, as magnetic
tape, CD and backup server.
For their protection, must be created special conditions
The authorised destruction of classified information stored in different media, must be
methods or physically destruction. The destruction must be
made when it is necessary only and when classified information is printed and
The print and administration of classified documents must be made according to the
The classified information processing in personal laptops and their entering in
environments processing and transmitting classified information, is p
D. COMMUNICATION SECURITY
For classified information transmitting, must be used specialized cryptographic
systems and devices, which stronghold is in accordance with classified information
The Classified Information Ciphering and Transm
itting Directorate, that actually, is
under the National Intelligence Service, is specialized directorate, that is responsible
for classified information protection in whole state structures, when this information
is transmitted by massive and public commu
nication devices. It is responsible for
composition, production and use of the
in whole ministries and state
The enciphering systems and transmitting devices of classified information, must be
used after the approval and certificatio
n by the Classified Information Security
III. SPECIAL REGULATIONS
Ministries and state institutions are responsible for the protection and security of the
information classified “state secret” stored, processed and transmitted in networks
nd transmitting devices.
Ministries and other state institutions are ordered in the execution of this decision.
The officials of these institutions, within 30 days from the day this decision is in
force, are obliged to issue the regulation in the execution
of this decision.
CSID is ordered for the control of this decision execution.
This decision enters in force after the publication in the “Official note