1. The Agency shall adopt its own security rules based on the principles and rules laid down in the Commission’s security rules for protecting European Union Classified Information (EUCI) and sensitive non-classified information, including, inter alia, provisions for the exchange with third states, processing and storage of such information as set out in Commission Decisions (EU, Euratom) 2015/443 (47) and 2015/444 (48). Any administrative arrangement on the exchange of classified information with the relevant authorities of a third state or, in the absence of such arrangement, any exceptional ad hoc release of EUCI to such authorities shall have received the Commission’s prior approval.
2. The Management Board shall adopt the security rules referred to in paragraph 1 of this Article following approval by the Commission. The Agency may take all necessary measures to facilitate the exchange of information relevant to its tasks with the Commission and the Member States and, where appropriate, the relevant Union agencies. The Agency shall develop and operate an information system capable of exchanging classified information with the Commission, the Member States and relevant Union agencies in accordance with Decision (EU, Euratom) 2015/444. The Management Board shall, pursuant to Article 2 and point (z) of Article 19(1) of this Regulation, decide on the Agency’s internal structure necessary to comply with the appropriate security principles.