1 State - People - Authorities - 15 Authorities - 150 General Provisions - Chapter One Competent Authorities (AGEAA)

[2] The Department of Security, Digitalization, and Culture (hereinafter: the Department) is the competent department for assuming the tasks entrusted to the State by the Law on the Single Secure Counter (LSSC), dated September 28, 2004.

[3] The Neuchâtel Entity's Information Technology Service (hereinafter: NITS) operates the Single Secure Portal (hereinafter: SSP) and performs the tasks assigned to it by the SSP Act.

**1 The GSU Commission is appointed by the Council of State at the beginning of each legislative period.**

2. The commission organizes itself and arranges its proceedings. It is convened for this purpose by the chairperson, designated by the LGSU.

3. The operator and the State Chancellery, as managers of the GSU, sit on the commission with an advisory vote.

4. The chairperson may invite individuals specialized in certain matters submitted for the commission's study to the GSU commission sessions, with an advisory vote.

5. The sessions of the GSU commission are not public.

1. The cantonal or communal authority that wishes to offer services to the users (hereinafter: users) of the GSU must have previously signed a collaboration agreement with the Council of State.

2. The collaboration agreement specifies the organizational, financial, and technical terms of collaboration between the cantonal or communal authority and the State.

For a signature to be valid, the following conditions must be met

a) The individuals authorized to validate the affixing of a signature for the State Chancellery are the Chancellor or the General Secretary, and for municipal administrations, the Municipal Chancellor, the Municipal Administrator, or the Municipal Officer responsible for resident control;

b) Natural persons must personally present themselves at the State Chancellery or the municipal administration of their domicile with a valid identity document;

c) Legal entities acting through their statutory representatives, duly authorized and, if necessary, with the required authorizations, must present themselves at the State Chancellery with a valid identity document;

d) By their signature, the authorized persons attest that the usage contract has been personally signed in the presence of a staff member of the State Chancellery or the municipal administration.

[4] 1 Legalization is the declaration by which an official or public officer attests to the authenticity of a signature affixed to a document.

2. Legalization is done following the signature.

3. Only the following have the authority to legalize

a) notaries;

b) judges of the District Court;

c) the competent Swiss representation for Swiss nationals abroad.

[5] The affixing of the apostille on contracts signed in accordance with the rules of the Hague Convention of October 5, 1961 [6] is authorized for Swiss nationals residing abroad who live too far from a Swiss representation.

1. The user contract, whose signature has been duly legalized or affixed, is sent to the State Chancellery in two copies.

2. After reviewing the required conditions, the State Chancellery signs the user contract.

3. One copy of the user contract is returned to the user, and the other is retained at the State Chancellery for entry into the user register.

1. The State Chancellery communicates to the user the information required to be memorized, which consists of a user code and a password.

2. The State Chancellery informs the operator of the conclusion of any new usage contract.

[7] 1 The operator provides the user with the authentication element to be carried, namely a numbered card or a one-time code sent via SMS.

2. The operator validates the authentication certificates provided by an authority recognized by it (SuisseID, AdminPKI).

Legal representatives who provide proof of their power of representation to the State Chancellery are granted access rights in accordance with Articles 8 and 9 of this regulation.

1. In accordance with Article 22, paragraph 3, of the LGSU, the power of attorney must, if it does not pertain to all the services offered by the GSU, explicitly mention the topics it includes in the sense of Article 20, paragraph 2, of the LGSU.

2. The list of available topics is accessible on the GSU's website.

3. The legalized power of attorney is transmitted to the State Chancellery for examination.

4. After the acceptance of the power of attorney, it is recorded in the register of powers of attorney, and access rights are transmitted to the proxy according to the procedure defined in Articles 8 and 9 of this regulation.

1. The State Chancellery is the sole point of contact for users concerning all aspects of managing usage contracts and access rights.

2. It communicates all useful information to users regarding the operation and development of the GSU.

3. The partners are the sole point of contact for users concerning all aspects related to their services.

1. The GSU user register contains at least the following information for each user listed

h) Authorized services.

2. The user register is accessible to the state chancellery, the operator, and the partners.

3. Any user may request to consult the information in the register that concerns them.

1 The GSU power of attorney register contains at least the following details

e) the areas of rights.

2. The power of attorney register is accessible to the state chancery, the operator, and the partners.

3. Any user may request to consult the information in the register that concerns them.

The conditions for the implementation of a service are as follows

a) the service is associated, by the partner, with existing roles or with new roles to be created pursuant to Article 18 LGSU;

b) the partner providing the service must be mentioned and recognizable by users;

c) the transmission of data to third parties by the partner must comply with data protection;

d) the service and associated data must first be installed by the operator in the GSU's testing environment. The behavior of the service must be validated in writing by the partner to the operator before any production rollout;

e) online assistance must be associated with the service;

f) the GSU commission has given its approval for the distribution of the service.

1. The temporary transaction history allows for the logging of all transactions activated by users into a computer file, excluding those associated with electronic voting.

2. The temporary transaction history related to the previous month is archived monthly within the GSU.

3. The operator may use the archived temporary transaction history for billing purposes and for statistical analysis of the GSU's service usage.

4. After 18 months of archiving, the operator destroys the temporary transaction history.

5. Since no personal data associated with the transactions is retained, the operator cannot provide any information about the data transmitted by the GSU.

[8] 1. The cantonal financial oversight is responsible for conducting a security audit of the GSU at least every 4 years.

2. The state financial inspection service can mandate a specialized external consultant for security audits of the GSU.

3. The purposes of the audit include

a) conducting intrusion tests to validate the access security level of the GSU;

b) analyzing vulnerabilities and assessing the threats associated with the GSU;

c) reviewing the architecture of the GSU and related processes.

4. The audit reports are confidential and restricted to the Council of State, the competent department, the GSU commission, the state chancellery, and the operator.

5. The Council of State may, at any time, order a security audit from a third party.

1. The persons authorized within the meaning of Article 15 of the LGSU are appointed by the State Council.

2. The authorized persons must submit all documents proving that they meet the legal conditions set forth in Article 15, paragraph 2, of the LGSU.

3. Each candidate must disclose, subject to professional confidentiality, any conflicts of interest, namely

a) their professional activity;

b) their roles within the executive or supervisory bodies of significant foundations, companies, or institutions, whether Swiss or foreign, and whether public or private law;

c) their permanent roles in management or consultancy on behalf of significant interest groups, whether Swiss or foreign;

d) their roles within commissions or other bodies of the Confederation, the canton, and the municipalities;

e) their political roles.

4. Any changes that occur are reported annually by the authorized persons.

5. The State Council administers the oath to these persons before they assume office.

6. The oath is taken with the following formula: "I swear (or I promise) to faithfully and conscientiously fulfill the duties of my office."

1. The servers extremely sensitive within the meaning of Article 16 of the LGSU are

a) servers that record encrypted votes;

b) servers that manage data related to the access rights of GSU users.

2. Within the meaning of Article 16, paragraph 2, LGSU, the conditions for intervention on these servers are

a) each intervention is ordered, in writing, by the operator or the state chancellery;

b) authorized persons must intervene in pairs;

c) the intervention report, countersigned by the two authorized persons, must be submitted within 15 days to the state chancellery;

d) intervention reports are archived for 18 months, then destroyed by the state chancellery.

The environment in which the GSU's secure infrastructure is installed must meet the following security standards

d) access to the premises is electronically controlled.

[9] 1 The affixing of the signature on the user contract before the State Chancellery or the municipal administration is free of charge.

2. The fee charged for the legalization of the signature by notaries is determined by Article 13 of the decree establishing the tariff of notary fees, dated January 20, 1982 [10].

3. The fee charged for the legalization of the signature by judges of the District Court is determined by Article 23, letter b, of the temporary decree setting the fees, chancery fees, and costs in civil, criminal, and administrative matters dated December 22, 2010 [11].

[12] 1 No fee is charged to users by the State Chancellery and the operator for the registration of the usage contract and the dispatch of access rights.

2. For each allocation of additional access rights to persons duly authorized by the users representing legal entities, a fee of 21 francs will be charged by the State Chancellery.

3. For any request for the renewal of lost access rights, a fee of 20 francs will be charged to the user by the State Chancellery.

1. The costs of services are established and billed by the partners to the users, based on determined fees.

2. These costs are subject to special regulations.

The collaboration agreement sets the fees owed by the partner to the operator.

The department, upon the recommendation of the GSU commission, determines the opening date of the GSU to users.

1. This regulation shall enter into force on January 1, 2005.

2. It will be published in the Official Gazette and inserted into the Collection of Neuchâtel Legislation.