1. The Agency shall carry out all the tasks relating to the communication infrastructure of the systems conferred on it by the Union legal acts governing the systems, with the exception of those systems that make use of the EuroDomain for their communication infrastructure. In the case of those systems that make such use of the EuroDomain, the Commission shall be responsible for the tasks of the implementation of the budget, acquisition and renewal, and contractual matters. In accordance with the Union legal acts governing the systems using the EuroDomain, the tasks regarding the communication infrastructure, including the operational management and security, are to be divided between the Agency and the Commission. In order to ensure coherence between the exercise of their respective responsibilities, operational working arrangements shall be concluded between the Agency and the Commission and reflected in a memorandum of understanding.
2. The communication infrastructure shall be adequately managed and controlled in such a way as to protect it from threats and to ensure its security and that of the systems, including that of data exchanged through the communication infrastructure.
3. The Agency shall adopt appropriate measures, including security plans, inter alia, to prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or transport of data media, in particular by means of appropriate encryption techniques. All system-related operational information circulating in the communication infrastructure shall be encrypted.
4. Tasks relating to the delivery, setting up, maintenance and monitoring of the communication infrastructure may be entrusted to external private-sector entities or bodies in accordance with Regulation (EU, Euratom) 2018/1046. Such tasks shall be carried out under the responsibility of the Agency and under its close supervision.
When carrying out the tasks referred to in the first subparagraph, all external private-sector entities or bodies, including network providers, shall be bound by the security measures referred to in paragraph 3 and shall have no access, by any means, to any operational data stored in the systems or transferred through the communication infrastructure or to the SIS II-related SIRENE exchange.
5. The management of the encryption keys shall remain within the competence of the Agency and shall not be outsourced to any external private-sector entity. This is without prejudice to the existing contracts on the communication infrastructures of SIS II, the VIS and Eurodac.