As a general principle, and wherever possible, risks are best managed at the level closest to those most directly affected. The principle of “subsidiarity” means that the information necessary to anticipate risks must be shared, and the capacity to respond effectively to risks must be built, across the security system.