Create Concept Scheme for Confidentiality

[Haigutus]

1. For OPC/STA
2. For OPDE

Both have Secret and Confidential statuses

[Haigutus]

The required list of Confidentiality list from relevant security plans

1. OPDE Secret
2. OPDE Confidential
3. OPC/STA Secret
4. OPC/STA Confidential

If we see need, we can add more generic ones

For example PUBLIC as alias of http://publications.europa.eu/resource/authority/access-right/PUBLIC

[griddigit-ci]

Added Confidentiality in the Generated data folder. I added 5 concepts

open items

• the definitions - can we have something from MVS - I coudl not find the definitions
• I see from EC = Confidential and Restricted as useful. Shoudl we add them as I did for Piblic?

[Haigutus]

Relevant commits:
a051a9c
84e9f68
84e9f68

[Haigutus]

Waiting for Rado final feedback

• Descriptions
• Source documents (for OPDE and OPC/STA)
• Check if anything aditional for General Security Plan

[ElenaNik123]

Rado feedback

Descriptions
Definitions of this levels are rather tricky as they are defined with the Control Library, which is a part of both Security Plans. For example for OPDE Confidential, this is the definition: All OPDE Data classified at the level of “OPDE Confidential” shall be protected by each Party in accordance with the applicable Security Controls defined under Section 7 of the Security Plan and in line with Section 9 of the Agreement, as well as labelled in accordance with section 7.4.6. “OPDE Confidential” defines the minimum level of Security Controls for the protection of OPDE Data.

Source documents (for OPDE)
The document source is MVS OPDE Security Plan 1.4 that is currently valid. It defines two confidentiality levels, OPDE Confidential and OPDE Secret. On the other hand, we are finishing anew version of OPDE Security Plan 2.0 which will be valid from the beginning of 2024. IT will be approved sooner but we will have some transition period so that all the Parties of the MVS agreement can prepare for 2024 mandatory external audit. It defines four confidentiality levels Normal, High, Very High (following the Generic Security Plan) and additionally OPDE Confidential.

An important document source is also the MVS agreement where the MVS OPDE Security Plan is an annex. Unfortunately, these documents have very limited availability to non-security people. In this way, I can't share them.

[ERelAlg]

Ridardo Dupont's feedback:

• The OPCSTA Security Plan v2.0 defines label OPC/STA Confidential in the annex A.8.2.1.
• There no such a thing as OPCSTA Secret. It has simply never been defined.
• We are trying to migrate to a more general labelling independent on the platform the data is stored (i.e. OPDE platform, OPC platform or STA platform). This labels are ENTSO-E Critical value data, ENTSO-E Important value data and ENTSO-E Minor value data.
• These three labels are defined as a combination of three values derived from the standards SG-CG/M490, modified NTA 8120 and Operational ENTSO-E ICS. To better understand this, refer to the Risk Impact Matrix (In the "Risk Impact Matrix" tab) used for the latest Business Impact Assessment.
• Again, the tendency should be to consolidate the use of these three security labels instead of creating one for every platform, but this is still an ongoing conversation and there no written procedure yet.