1. ACER shall adopt its own security rules, which shall be equivalent to the Commission's security rules for protecting European Union Classified Information (EUCI) and sensitive non-classified information, including provisions for the exchange, processing and storage of such information, as set out in the Commission Decisions (EU, Euratom) 2015/443 (28) and (EU, Euratom) 2015/444 (29).
2. ACER may also decide to apply the Commission's Decisions referred to in paragraph 1, mutatis mutandis. ACER's security rules shall cover, inter alia, provisions for the exchange, processing and storage of EUCI and sensitive non-classified information.