Official Gazette, 79/2007 Article 7 Information security measures shall be stipulated by the Regulation adopted by the Government of the Republic of Croatia and standards for the implementation of measures shall be stipulated by Ordinances adopted by the Heads of National Security Authority (NSA) and National Communications Security Authority (NCSA). III INFORMATION SECURITY AREAS Article 8 Information security areas for which information security measures and standards are stipulated, are as follows: - Personnel Security - Physical Security - Security of Information - INFOSEC - Industrial Security Personnel Security Article 9 (1) Personnel Security is the information security area within which information security measures and standards are determined that are applied on persons who have classified data access. (2) Persons referred to in paragraph 1 of this Article shall obtain Personnel Security Clearance (Certificate). (3) Bodies and legal persons referred to in Article 1, paragraph 2 of this Act, who use classified data of CONFIDENTIAL, SECRET and TOP SECRET degree of secrecy, shall establish as follows: - the list of persons with classified data access - the registry of Certificates issued with their respective expiry dates Physical Security Article 10 (1) Physical security is the information security area which determines information security measures and standards for the protection of objects, facilities and equipment where classified data are stored. (2) Bodies and legal persons referred to in Article 1, paragraph 2 of this Act, who use data of CONFIDENTIAL, SECRET and TOP SECRET degree of secrecy, shall perform the categorization of objects and facilities to security zones that are stipulated by information security measures and standards. 3