### (11) depending on the sector in which they operate or the type of service they provide , the entities falling within the scope of this directive should be classified into two categories: essential and important. that categorisation should take into account the level of criticality of the sector or of the type of service , as well as the level of dependency of other sectors or types of services. both essential and important entities should be subject to the same risk management requirements and reporting obligations. the supervisory and penalty regimes between these two categories of entities should be differentiated to ensure a fair balance between requirements and obligations on one hand , and the administrative burden stemming from the supervision of compliance on the other hand. ### (11) depending on the sector in which they operate or the type of service they provide , the entities falling within the scope of this directive should be classified into two categories: essential and important. that categorisation should take into account the level of criticality of the sector or of the type of service , as well as the level of dependency of other sectors or types of services. both essential and important entities should be subject to the same risk management requirements and reporting obligations. the cybersecurity risk management measures , reporting obligations and supervisory and penalty regimes between these two categories of entities should be differentiated to ensure a fair balance between requirements and obligations on one hand , and the administrative burden stemming from the supervision of compliance on the other hand.


### (12) sector-specific legislation and instruments can contribute to ensuring high levels of cybersecurity , while taking full account of the specificities and complexities of those sectors. where a sector–specific union legal act requires essential or important entities to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats of at least an equivalent effect to the obligations laid down in this directive , those sector-specific provisions , including on supervision and enforcement , should apply. the commission may issue guidelines in relation to the implementation of the lex specialis. this directive does not preclude the adoption of additional sector-specific union acts addressing cybersecurity risk management measures and incident notifications. this directive is without prejudice to the existing implementing powers that have been conferred to the commission in a number of sectors , including transport and energy. ### (12) sector-specific legislation and instruments can contribute to ensuring high levels of cybersecurity , while taking full account of the specificities and complexities of those sectors. as a minimum baseline sector–specific union legal act should require essential or important entities to adopt cybersecurity risk management measures and to notify incidents or significant cyber threats in line with requirements laid down in articles 18 (1 , 2) and 20 of this directive. where sector-specific legislations foresee specific rules on supervision and enforcement , these rules should apply. the commission may issue guidelines in relation to the implementation of the lex specialis. this directive does not preclude the adoption of additional sector-specific union acts addressing cybersecurity risk management measures and incident notifications. nevertheless , while adopting the additional sector-specific union acts the need of a comprehensive and consistent cybersecurity framework should be duly taken into account. this directive is without prejudice to the existing implementing powers that have been conferred to the commission in a number of sectors , including transport and energy.


### (15) upholding and preserving a reliable , resilient and secure domain name system (dns) is a key factor in maintaining the integrity of the internet and is essential for its continuous and stable operation , on which the digital economy and society depend. therefore , this directive should apply to all providers of dns services along the dns resolution chain , including operators of root name servers , top-level-domain (tld) name servers , authoritative name servers for domain names and recursive resolvers. ### (15) upholding and preserving a reliable , resilient and secure domain name system (dns) is a key factor in maintaining the integrity of the internet and is essential for its continuous and stable operation , on which the digital economy and society depend. therefore , this directive should apply to all providers of dns services along the dns resolution chain , top-level-domain (tld) name servers , authoritative name servers for domain names and recursive resolvers.


### (20) those growing interdependencies are the result of an increasingly cross-border and interdependent network of service provision using key infrastructures across the union in the sectors of energy , transport , digital infrastructure , drinking and waste water , health , certain aspects of public administration , as well as space in as far as the provision of certain services depending on ground-based infrastructures that are owned , managed and operated either by member states or by private parties is concerned , therefore not covering infrastructures owned , managed or operated by or on behalf of the union as part of its space programmes. those interdependencies mean that any disruption , even one initially confined to one entity or one sector , can have cascading effects more broadly , potentially resulting in far-reaching and long-lasting negative impacts in the delivery of services across the internal market. the covid-19 pandemic has shown the vulnerability of our increasingly interdependent societies in the face of low-probability risks. ### (20) those growing interdependencies are the result of an increasingly cross-border and interdependent network of service provision using key infrastructures across the union in the sectors of energy , transport , digital infrastructure , drinking and waste water , health , as well as space in as far as the provision of certain services depending on ground-based infrastructures that are owned , managed and operated either by member states or by private parties is concerned , therefore not covering infrastructures owned , managed or operated by or on behalf of the union as part of its space programmes. those interdependencies mean that any disruption , even one initially confined to one entity or one sector , can have cascading effects more broadly , potentially resulting in far-reaching and long-lasting negative impacts in the delivery of services across the internal market. the covid-19 pandemic has shown the vulnerability of our increasingly interdependent societies in the face of low-probability risks.


### (30) access to correct and timely information on vulnerabilities affecting ict products and services contributes to an enhanced cybersecurity risk management. in that regard , sources of publicly available information on vulnerabilities are an important tool for entities and their users , but also national competent authorities and csirts. for this reason , enisa should establish a vulnerability registry where , essential and important entities and their suppliers , as well as entities which do not fall in the scope of application of this directive may , on a voluntary basis , disclose vulnerabilities and provide the vulnerability information that allows users to take appropriate mitigating measures. ### (30) access to correct and timely information on vulnerabilities affecting ict products and services contributes to an enhanced cybersecurity risk management. in that regard , sources of publicly available information on vulnerabilities are an important tool for entities and their users , but also national competent authorities and csirts. for this reason , enisa should establish a vulnerability database where , essential and important entities and their suppliers , as well as entities which do not fall in the scope of application of this directive may , on a voluntary basis , disclose the patched vulnerabilities and provide the vulnerability information that allows users to take appropriate mitigating measures.


### (31) although similar vulnerability registries or databases do exist , these are hosted and maintained by entities which are not established in the union. a european vulnerability registry maintained by enisa would provide improved transparency regarding the publication process before the vulnerability is officially disclosed , and resilience in cases of disruptions or interruptions on the provision of similar services. to avoid duplication of efforts and seek complementarity to the extent possible , enisa should explore the possibility of entering into structured cooperation agreements with similar registries in third country jurisdictions. ### (31) the european vulnerability database maintained by enisa should leverage the global common vulnerabilities and exposures (cve) registry. to avoid duplication of efforts and seek complementarity to the extent possible , enisa should explore the possibility of entering into structured cooperation agreements with the cve , including by membership in its board and by becoming a root cve numbering authority , and with other similar registries in third country jurisdictions.


### (46) to further address key supply chain risks and assist entities operating in sectors covered by this directive to appropriately manage supply chain and supplier related cybersecurity risks , the cooperation group involving relevant national authorities , in cooperation with the commission and enisa , should carry out coordinated sectoral supply chain risk assessments , as was already done for 5g networks following recommendation (eu) 2019/534 on cybersecurity of 5g networks21 , with the aim of identifying per sector which are the critical ict services , systems or products , relevant threats and vulnerabilities. ### (46) to further address key supply chain risks and assist entities operating in sectors covered by this directive to appropriately manage supply chain and supplier related cybersecurity risks , the cooperation group involving relevant national authorities , in cooperation with the commission and enisa , should carry out coordinated supply chain risk assessments , as was already done for 5g networks following recommendation (eu) 2019/534 on cybersecurity of 5g networks21 , with the aim of identifying per sector which are the critical ict services , systems or products , relevant threats and vulnerabilities. where appropriate , the cooperation group should monitor the supply chain risk assessment activities of other democratic countries.


### (47) the supply chain risk assessments , in light of the features of the sector concerned , should take into account both technical and , where relevant , non-technical factors including those defined in recommendation (eu) 2019/534 , in the eu wide coordinated risk assessment of 5g networks security and in the eu toolbox on 5g cybersecurity agreed by the cooperation group. to identify the supply chains that should be subject to a coordinated risk assessment , the following criteria should be taken into account: (i) the extent to which essential and important entities use and rely on specific critical ict services , systems or products; (ii) the relevance of specific critical ict services , systems or products for performing critical or sensitive functions , including the processing of personal data; (iii) the availability of alternative ict services , systems or products; (iv) the resilience of the overall supply chain of ict services , systems or products against disruptive events and (v) for emerging ict services , systems or products , their potential future significance for the entities’ activities. ### (47) the supply chain risk assessments , in light of the features of the sector concerned , should take into account both technical and , where relevant , non-technical factors including those defined in recommendation (eu) 2019/534 , in the eu wide coordinated risk assessment of 5g networks security and in the eu toolbox on 5g cybersecurity agreed by the cooperation group.


### (51) the internal market is more reliant on the functioning of the internet than ever before. the services of virtually all essential and important entities are dependent on services provided over the internet. in order to ensure the smooth provision of services provided by essential and important entities , it is important that public electronic communications networks , such as , for example , internet backbones or submarine communications cables , have appropriate cybersecurity measures in place and report incidents in relation thereto. ### (51) the internal market is more reliant on the functioning of the internet than ever before. the services of virtually all essential and important entities are dependent on services provided over the internet. the competent authorities should thus ensure that the integrity and availability of public electronic communications networks are maintained. in order to ensure the smooth provision of services provided by essential and important entities , it is important that all public electronic communications networks , such as , for example , internet backbones or submarine communications cables , have appropriate cybersecurity measures in place and report significant incidents in relation thereto.


### (54) in order to safeguard the security of electronic communications networks and services , the use of encryption , and in particular end-to-end encryption , should be promoted and , where necessary , should be mandatory for providers of such services and networks in accordance with the principles of security and privacy by default and by design for the purposes of article 18. the use of end-to-end encryption should be reconciled with the member state’ powers to ensure the protection of their essential security interests and public security , and to permit the investigation , detection and prosecution of criminal offences in compliance with union law. solutions for lawful access to information in end-to-end encrypted communications should maintain the effectiveness of encryption in protecting privacy and security of communications , while providing an effective response to crime. ### (54) in order to safeguard the security of electronic communications networks and services , the use of encryption , and in particular end-to-end encryption , could be promoted and , where necessary , should be implemented by providers of such services and networks in accordance with the principles of security and privacy by default and by design for the purposes of article 18. the use of end-to-end encryption should be reconciled with the member state’ powers to ensure the protection of their essential security interests and public security , and to permit the investigation , detection and prosecution of criminal offences in compliance with union law. solutions for lawful access to information in end-to-end encrypted communications should maintain the effectiveness of encryption in protecting privacy and security of communications , while providing an effective response to crime.


### (55) this directive lays down a two-stage approach to incident reporting in order to strike the right balance between , on the one hand , swift reporting that helps mitigate the potential spread of incidents and allows entities to seek support , and , on the other hand , in-depth reporting that draws valuable lessons from individual incidents and improves over time the resilience to cyber threats of individual companies and entire sectors. where entities become aware of an incident , they should be required to submit an initial notification within 24 hours , followed by a final report not later than one month after. the initial notification should only include the information strictly necessary to make the competent authorities aware of the incident and allow the entity to seek assistance , if required. such notification , where applicable , should indicate whether the incident is presumably caused by unlawful or malicious action. member states should ensure that the requirement to submit this initial notification does not divert the reporting entity’s resources from activities related to incident handling that should be prioritised. to further prevent that incident reporting obligations either divert resources from incident response handling or may otherwise compromise the entities efforts in that respect , member states should also provide that , in duly justified cases and in agreement with the competent authorities or the csirt , the entity concerned can deviate from the deadlines of 24 hours for the initial notification and one month for the final report. ### (55) this directive lays down a two-stage approach to incident reporting in order to strike the right balance between , on the one hand , swift reporting that helps mitigate the potential spread of incidents and allows entities to seek support , and , on the other hand , in-depth reporting that draws valuable lessons from individual incidents and improves over time the resilience to cyber threats of individual companies and entire sectors. where entities become aware of an significant incident , they should be required to submit an initial notification without undue delay , followed by a final report not later than one month after. the initial notification should only include the information strictly necessary to make the competent authorities aware of the incident and allow the entity to seek assistance , if required. such notification , where applicable , should indicate whether the incident is presumably caused by unlawful or malicious action. member states should ensure that the requirement to submit this initial notification does not divert the reporting entity’s resources from activities related to incident handling that should be prioritised. to further prevent that incident reporting obligations either divert resources from incident response handling or may otherwise compromise the entities efforts in that respect , member states should also provide that , in duly justified cases and in agreement with the competent authorities or the csirt , the entity concerned can deviate from the reporting deadlines.


### (68) entities should be encouraged to collectively leverage their individual knowledge and practical experience at strategic , tactical and operational levels with a view to enhance their capabilities to adequately assess , monitor , defend against , and respond to , cyber threats. it is thus necessary to enable the emergence at union level of mechanisms for voluntary information sharing arrangements. to this end , member states should actively support and encourage also relevant entities not covered by the scope of this directive to participate in such information-sharing mechanisms. those mechanisms should be conducted in full compliance with the competition rules of the union as well as the data protection union law rules. ### (68) entities should be encouraged to collectively leverage their individual knowledge and practical experience at strategic , tactical and operational levels with a view to enhance their capabilities to adequately assess , monitor , defend against , and respond to , cyber threats. it is thus necessary to enable the emergence at union level of mechanisms for voluntary information sharing arrangements. to this end , member states should actively support and encourage also relevant entities not covered by the scope of this directive , such as entities focusing on cybersecurity services and research , to participate in such information-sharing mechanisms. those mechanisms should be conducted in full compliance with the competition rules of the union as well as the data protection union law rules.


### (69) the processing of personal data , to the extent strictly necessary and proportionate for the purposes of ensuring network and information security by entities , public authorities , certs , csirts , and providers of security technologies and services should constitute a legitimate interest of the data controller concerned , as referred to in regulation (eu) 2016/679. that should include measures related to the prevention , detection , analysis and response to incidents , measures to raise awareness in relation to specific cyber threats , exchange of information in the context of vulnerability remediation and coordinated disclosure , as well as the voluntary exchange of information on those incidents , as well as cyber threats and vulnerabilities , indicators of compromise , tactics , techniques and procedures , cybersecurity alerts and configuration tools. such measures may require the processing of the following types of personal data: ip addresses , uniform resources locators (urls) , domain names , and email addresses. ### (69) the processing of personal data , to the extent strictly necessary and proportionate for the purposes of ensuring network and information security by entities , certs should constitute a legitimate interest of the data controller concerned , as referred to in regulation (eu) 2016/679 and by public authorities , namely competent authorities , single points of contact (spocs) , csirts , nis cg , csirt network , certs and cyclone should constitute a legal obligation or the public interest or the exercise of official authority of the data controller concerned , as referred to in regulation (eu) 2016/679. that should include measures related to the prevention , detection , analysis and response to incidents , measures to raise awareness in relation to specific cyber threats , exchange of information in the context of vulnerability remediation and coordinated disclosure , as well as the voluntary exchange of information on those incidents , as well as cyber threats and vulnerabilities , indicators of compromise , tactics , techniques and procedures , cybersecurity alerts and configuration tools. such measures may require the processing of the following types of personal data: ip addresses , telephone numbers , bank account numbers , geolocation data , payment data , uniform resources locators (urls) , domain names , and email addresses.


### (76) in order to further strengthen the effectiveness and dissuasiveness of the penalties applicable to infringements of obligations laid down pursuant to this directive , the competent authorities should be empowered to apply sanctions consisting of the suspension of a certification or authorisation concerning part or all the services provided by an essential entity and the imposition of a temporary ban from the exercise of managerial functions by a natural person. given their severity and impact on the entities’ activities and ultimately on their consumers , such sanctions should only be applied proportionally to the severity of the infringement and taking account of the specific circumstances of each case , including the intentional or negligent character of the infringement , actions taken to prevent or mitigate the damage and/or losses suffered. such sanctions should only be applied as ultima ratio , meaning only after the other relevant enforcement actions laid down by this directive have been exhausted , and only for the time until the entities to which they apply take the necessary action to remedy the deficiencies or comply with the requirements of the competent authority for which such sanctions were applied. the imposition of such sanctions shall be subject to appropriate procedural safeguards in accordance with the general principles of union law and the charter of fundamental rights of the european union , including effective judicial protection , due process , presumption of innocence and right of defence. ### (76) in order to further strengthen the effectiveness and dissuasiveness of the penalties applicable to infringements of obligations laid down pursuant to this directive , the competent authorities should be empowered to apply sanctions consisting of the suspension of a certification or authorisation concerning services provided by an essential entity. given their severity and impact on the entities’ activities and ultimately on their consumers , such sanctions should only be applied proportionally to the severity of the infringement and taking account of the specific circumstances of each case , including the intentional or negligent character of the infringement , actions taken to prevent or mitigate the damage and/or losses suffered. such sanctions should only be applied as ultima ratio , meaning only after the other relevant enforcement actions laid down by this directive have been exhausted , and only for the time until the entities to which they apply take the necessary action to remedy the deficiencies or comply with the requirements of the competent authority for which such sanctions were applied. the imposition of such sanctions shall be subject to appropriate procedural safeguards in accordance with the general principles of union law and the charter of fundamental rights of the european union , including effective judicial protection , due process , presumption of innocence and right of defence.


### (79) a peer-review mechanism should be introduced , allowing the assessment by experts designated by the member states of the implementation of cybersecurity policies , including the level of member states’ capabilities and available resources. ### deleted


### 1. this directive applies to public and private entities of a type referred to as essential entities in annex i and as important entities in annex ii. this directive does not apply to entities that qualify as micro and small enterprises within the meaning of commission recommendation 2003/361/ec.28 ### 1. this directive applies to public and private entities of a type referred to in annex i and annex ii. without prejudice to paragraph 2 of this article and article 27 , this directive does not apply to entities that qualify as micro and small enterprises within the meaning of commission recommendation 2003/361/ec.28


### 2. however , regardless of their size , this directive also applies to entities referred to in annexes i and ii , where: ### 2. by way of derogation from paragraph 1 of this article , regardless of their size , this directive also applies to entities of a type referred to in annexes i and ii , where:


### (4) ‘national strategy on cybersecurity’ means a coherent framework of a member state providing strategic objectives and priorities on the security of network and information systems in that member state; ### deleted


### (23) ‘public administration entity’ means an entity in a member state that complies with the following criteria: ### deleted


### coordinated vulnerability disclosure and a european vulnerability registry ### coordinated vulnerability disclosure and a european vulnerability database


### 1. each member state shall designate one of its csirts as referred to in article 9 as a coordinator for the purpose of coordinated vulnerability disclosure. the designated csirt shall act as a trusted intermediary , facilitating , where necessary , the interaction between the reporting entity and the manufacturer or provider of ict products or ict services. where the reported vulnerability concerns multiple manufacturers or providers of ict products or ict services across the union , the designated csirt of each member state concerned shall cooperate with the csirt network. ### 1. where requested , the cvd csirt coordinator referred to in article 9(1a) shall act as a trusted intermediary , facilitating the interaction between the reporting entity and the manufacturer or provider of ict products or ict services. where the reported vulnerability concerns multiple manufacturers or providers of ict products or ict services across the union , cvd csirt coordinator of each member state concerned shall cooperate with the csirt network.


### 2. enisa shall develop and maintain a european vulnerability registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures with a view in particular to enabling important and essential entities and their suppliers of network and information systems to disclose and register vulnerabilities present in ict products or ict services , as well as to provide access to the information on vulnerabilities contained in the registry to all interested parties. the registry shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , the availability of related patches and , in the absence of available patches , guidance addressed to users of vulnerable products and services as to how the risks resulting from disclosed vulnerabilities may be mitigated. ### 2. enisa shall develop and maintain a european vulnerability database leveraging the global common vulnerabilities and exposures (cve) registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures with a view in particular to enabling important and essential entities and their suppliers of network and information systems to voluntarily disclose and register vulnerabilities present in ict products or ict services , as well as to provide access to the information on vulnerabilities contained in the database to all interested parties. the database shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , the availability of related patches and , in the absence of available patches , guidance addressed to users of vulnerable products and services as to how the risks resulting from disclosed vulnerabilities may be mitigated.


### 5. csirts shall participate in peer reviews organised in accordance with article 16. ### deleted


### 2. member states shall ensure that either their competent authorities or their csirts receive notifications on incidents , and significant cyber threats and near misses submitted pursuant to this directive. where a member state decides that its csirts shall not receive those notifications , the csirts shall , to the extent necessary to carry out their tasks , be granted access to data on incidents notified by the essential or important entities , pursuant to article 20. ### 2. member states shall ensure their competent authorities and their csirts receive notifications on significant incidents , significant cyber threats and significant near misses submitted pursuant to articles 20 and 27 of this directive via the single entry point referred to in article 20(3a).


### 4. to the extent necessary to effectively carry out the tasks and obligations laid down in this directive , member states shall ensure appropriate cooperation between the competent authorities and single points of contact and law enforcement authorities , data protection authorities , and the authorities responsible for critical infrastructure pursuant to directive (eu) xxxx/xxxx [resilience of critical entities directive] and the national financial authorities designated in accordance with regulation (eu) xxxx/xxxx of the european parliament and of the council39 [the dora regulation] within that member state. ### 4. to the extent necessary to effectively carry out the tasks and obligations laid down in this directive , including supervision and enforcement , member states shall ensure appropriate cooperation between the competent authorities , single points of contact , csirts and law enforcement authorities , national regulatory authorities or other competent authorities responsible for public electronic communications networks or for publicly available electronic communications services pursuant to directive (eu) 2018/1972 , data protection authorities , the authorities responsible for critical infrastructure pursuant to directive (eu) xxxx/xxxx [resilience of critical entities directive] and the national financial authorities designated in accordance with regulation (eu) xxxx/xxxx of the european parliament and of the council39 [the dora regulation] within that member state.


### exchanging advice and cooperating with the commission on draft commission implementing or delegated acts adopted pursuant to this directive; ### exchanging advice and cooperating with the commission on draft commission implementing acts adopted pursuant to this directive;


### discussing reports on the peer review referred to in article 16(7); ### deleted


### discussing the peer-review reports referred to in article 16(7); ### deleted


### 4. for the purpose of the review referred to in article 35 and by [24 months after the date of entry into force of this directive] , and every two years thereafter , the csirts network shall assess the progress made with the operational cooperation and produce a report. the report shall , in particular , draw conclusions on the outcomes of the peer reviews referred to in article 16 carried out in relation to national csirts , including conclusions and recommendations , pursued under this article. that report shall also be submitted to the cooperation group. ### 4. for the purpose of the review referred to in article 35 and by [24 months after the date of entry into force of this directive] , and every two years thereafter , the csirts network shall assess the progress made with the operational cooperation and produce a report. that report shall also be submitted to the cooperation group.


### 4. for the purpose of the review referred to in article 35 and by 24 months after the date of entry into force of this directive , and every two years thereafter , the csirts network shall assess the progress made with the operational cooperation and produce a report. the report shall , in particular , draw conclusions on the outcomes of the peer reviews referred to in article 16 carried out in relation to national csirts , including conclusions and recommendations , pursued under this article. that report shall also be submitted to the cooperation group. ### 4. for the purpose of the review referred to in article 35 and by 24 months after the date of entry into force of this directive , and every two years thereafter , the csirts network shall assess the progress made with the operational cooperation and produce a report. that report shall also be submitted to the cooperation group.


### the technical , financial and human resources available to competent authorities and cybersecurity policies , and the implementation of supervisory measures and enforcement actions in light of the outcomes of peer reviews referred to in article 16; ### the technical , financial and human resources available to competent authorities and cybersecurity policies;


### [...] ### deleted


### 1. member states shall ensure that essential and important entities shall take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which those entities use in the provision of their services. having regard to the state of the art , those measures shall ensure a level of security of network and information systems appropriate to the risk presented. ### 1. member states shall ensure that essential and important entities shall take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which those entities use in the provision of their services and to prevent or minimise the impact of incidents on recipients of their services and on other services. having regard to the state of the art , those measures shall ensure a level of security of network and information systems appropriate to the risk presented , and differentiate between the essential and important entities and between the sectors and subsectors with higher or lower level of criticality referred to in annexes i and ii.


### the use of cryptography and encryption. ### the use of cryptography and encryption where appropriate.


### 6. the commission is empowered to adopt delegated acts in accordance with article 36 to supplement the elements laid down in paragraph 2 to take account of new cyber threats , technological developments or sectorial specificities. ### deleted


### 2. the commission , after consulting with the cooperation group and enisa , shall identify the specific critical ict services , systems or products that may be subject to the coordinated risk assessment referred to in paragraph 1. ### 2. the commission , after consulting with the cooperation group , enisa and the industry , shall identify the specific critical ict services , systems or products that may be subject to the coordinated risk assessment referred to in paragraph 1.


### 1. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt in accordance with paragraphs 3 and 4 of any incident having a significant impact on the provision of their services. where appropriate , those entities shall notify , without undue delay , the recipients of their services of incidents that are likely to adversely affect the provision of that service. member states shall ensure that those entities report , among others , any information enabling the competent authorities or the csirt to determine any cross-border impact of the incident. ### 1. member states shall ensure that essential and important entities notify the relevant competent authorities and the csirt in accordance with paragraphs 3 and 4 of any incident having a significant impact on the provision of their services (‘significant incident’). where appropriate , those entities shall notify , without undue delay , the recipients of their services of incidents that are likely to adversely affect the provision of that service. member states shall ensure that those entities report , among others , any information enabling the competent authorities or the csirt to determine any cross-border impact of the incident.


### 2. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt of any significant cyber threat that those entities identify that could have potentially resulted in a significant incident. ### deleted


### 3. an incident shall be considered significant if: ### deleted


### without undue delay and in any event within 24 hours after having become aware of the incident , an initial notification , which , where applicable , shall indicate whether the incident is presumably caused by unlawful or malicious action; ### without undue delay after having become aware of the incident , an initial notification , which , where applicable , shall indicate whether the incident is presumably caused by unlawful or malicious action;


### a final report not later than one month after the submission of the report under point (a) , including at least the following: ### a detailed incident report not later than one month after the submission of the report under point (a) , including at least the following:


### 5. the competent national authorities or the csirt shall provide , within 24 hours after receiving the initial notification referred to in point (a) of paragraph 4 , a response to the notifying entity , including initial feedback on the incident and , upon request of the entity , guidance on the implementation of possible mitigation measures. where the csirt did not receive the notification referred to in paragraph 1 , the guidance shall be provided by the competent authority in collaboration with the csirt. the csirt shall provide additional technical support if the concerned entity so requests. where the incident is suspected to be of criminal nature , the competent national authorities or the csirt shall also provide guidance on reporting the incident to law enforcement authorities. ### 5. the csirt shall provide , within 24 hours after receiving the initial notification referred to in point (a) of paragraph 4 , a response to the notifying entity , including initial feedback on the incident , particularly whether they deem it significant , and , upon request of the entity , guidance on the implementation of possible mitigation measures. the csirt shall provide additional technical support if the concerned entity so requests. where the incident is suspected to be of criminal nature , the competent authorities or the csirt shall also provide guidance on reporting the incident to law enforcement authorities. where the incident is suspected to be of nature breaching the national security , the competent authorities or the csirt shall without undue delay inform relevant national authorities.


### use of european cybersecurity certification schemes ### use of european cybersecurity certification schemes and standardisation


### 1. in order to demonstrate compliance with certain requirements of article 18 , member states may require essential and important entities to certify certain ict products , ict services and ict processes under specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881. the products , services and processes subject to certification may be developed by an essential or important entity or procured from third parties. ### 1. in order to increase the level of cybersecurity , member states may recommend essential and important entities to certify certain ict products , ict services and ict processes under specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881 or other international cybersecurity certification schemes. member states shall also encourage essential and important entities to comply with european and internationally accepted standards.


### 2. the commission shall be empowered to adopt delegated acts specifying which categories of essential entities shall be required to obtain a certificate and under which specific european cybersecurity certification schemes pursuant to paragraph 1. the delegated acts shall be adopted in accordance with article 36. ### deleted


### 3. the commission may request enisa to prepare a candidate scheme pursuant to article 48(2) of regulation (eu) 2019/881 in cases where no appropriate european cybersecurity certification scheme for the purposes of paragraph 2 is available. ### deleted


### 2. for the purposes of this directive , entities referred to in paragraph 1 shall be deemed to have their main establishment in the union in the member state where the decisions related to the cybersecurity risk management measures are taken. if such decisions are not taken in any establishment in the union , the main establishment shall be deemed to be in the member state where the entities have the establishment with the highest number of employees in the union. ### 2. for the purposes of this directive , entities referred to in paragraph 1 shall be deemed to have their main establishment in the union in the member state where the decisions related to the cybersecurity risk management measures are taken. if such decisions are not taken in any establishment in the union , the main establishment shall be deemed to be in the member state where the entities have the establishment responsible for the implementation of the main cybersecurity risk management measures in the union.


### article 25 ### deleted


### 2. member states shall ensure that the exchange of information takes place within trusted communities of essential and important entities. such exchange shall be implemented through information sharing arrangements in respect of the potentially sensitive nature of the information shared and in compliance with the rules of union law referred to in paragraph 1. ### 2. member states shall facilitate the exchange of information takes place within trusted communities of essential and important entities and other relevant entities. such exchange shall be implemented through information sharing arrangements in respect of the potentially sensitive nature of the information shared and in compliance with the rules of union law referred to in paragraph 1.


### 3. member states shall set out rules specifying the procedure , operational elements (including the use of dedicated ict platforms) , content and conditions of the information sharing arrangements referred to in paragraph 2. such rules shall also lay down the details of the involvement of public authorities in such arrangements , as well as operational elements , including the use of dedicated it platforms. member states shall offer support to the application of such arrangements in accordance with their policies referred to in article 5(2) (g). ### 3. member states shall set out recommendations specifying the procedure , operational elements (including the use of dedicated ict platforms) , content and conditions of the information sharing arrangements referred to in paragraph 2. such recommendations shall also lay down the details of the involvement of public authorities in such arrangements , as well as operational elements , including the use of dedicated it platforms. member states shall offer support to the application of such arrangements in accordance with their policies referred to in article 5(2) (g).


### 5. in compliance with union law , enisa shall support the establishment of cybersecurity information-sharing arrangements referred to in paragraph 2 by providing best practices and guidance. ### 5. in compliance with union law , enisa shall support the establishment of cybersecurity information-sharing arrangements referred to in paragraphs 2 and 3a by providing best practices and guidance.


### member states shall ensure that , without prejudice to article 3 , entities falling outside the scope of this directive may submit notifications , on a voluntary basis , of significant incidents , cyber threats or near misses. when processing notifications , member states shall act in accordance with the procedure laid down in article 20. member states may prioritise the processing of mandatory notifications over voluntary notifications. voluntary reporting shall not result in the imposition of any additional obligations upon the reporting entity to which it would not have been subject had it not submitted the notification. ### member states shall ensure that , without prejudice to article 3 , entities falling outside the scope of this directive may submit notifications to competent authorities or the csirt , on a voluntary basis , of significant incidents , significant cyber threats or significant near misses.


### impose or request the imposition by the relevant bodies or courts according to national laws of a temporary ban against any person discharging managerial responsibilities at chief executive officer or legal representative level in that essential entity , and of any other natural person held responsible for the breach , from exercising managerial functions in that entity. ### deleted


### 6. member states shall ensure that any natural person responsible for or acting as a representative of an essential entity on the basis of the power to represent it , the authority to take decisions on its behalf or the authority to exercise control of it has the powers to ensure its compliance with the obligations laid down in this directive. member states shall ensure that those natural persons may be held liable for breach of their duties to ensure compliance with the obligations laid down in this directive. ### 6. member states shall ensure that any natural person responsible for or acting as a representative of an essential entity on the basis of the power to represent it , the authority to take decisions on its behalf or the authority to exercise control of it has the powers to ensure its compliance with the obligations laid down in this directive.


### 6. without prejudice to the powers of competent authorities pursuant to articles 29 and 30 , each member state may lay down the rules on whether and to what extent administrative fines may be imposed on public administration entities referred to in article 4(23) subject to the obligations provided for by this directive. ### deleted


### article 36 ### deleted


### essential entities: ### entities with higher level of criticality:


### important enities: ### enities with lower level of criticality:


### (8) in accordance with directive (eu) 2016/1148 , member states were responsible for determining which entities meet the criteria to qualify as operators of essential services (‘identification process’). in order to eliminate the wide divergences among member states in that regard and ensure legal certainty for the risk management requirements and reporting obligations for all relevant entities , a uniform criterion should be established that determines the entities falling within the scope of application of this directive. that criterion should consist of the application of the size-cap rule , whereby all medium and large enterprises , as defined by commission recommendation 2003/361/ec15 , that operate within the sectors or provide the type of services covered by this directive , fall within its scope. member states should not be required to establish a list of the entities that meet this generally applicable size-related criterion. ### (8) in accordance with directive (eu) 2016/1148 , member states were responsible for determining which entities meet the criteria to qualify as operators of essential services (‘identification process’). in order to eliminate the wide divergences among member states in that regard and ensure legal certainty for the risk management requirements and reporting obligations for all relevant entities , a uniform criterion should be established that determines the entities falling within the scope of application of this directive. that criterion should consist of the application of the size-cap rule , whereby all medium and large enterprises , as defined by commission recommendation 2003/361/ec15 , that operate within the sectors or provide the type of services covered by this directive , fall within its scope. member states should not be required to establish a list of the entities that meet this generally applicable size-related criterion. nevertheless , taking into account the difference in composition of public administration in the member states , the identification process provided in directive (eu) 2016/1148 remains an appropriate mechanism to determine which public administration entities should fall under the scope of this directive.


### 6. where provisions of sector–specific acts of union law require essential or important entities either to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats , and where those requirements are at least equivalent in effect to the obligations laid down in this directive , the relevant provisions of this directive , including the provision on supervision and enforcement laid down in chapter vi , shall not apply. ### 6. where provisions of sector–specific acts of union law require essential or important entities to adopt cybersecurity risk management measures and to notify incidents or significant cyber threats , and where those requirements are at least equivalent in effect to the obligations laid down in this directive , the relevant provisions of this directive , including the provision on supervision and enforcement laid down in chapter vi , shall not apply.


### 3. member states shall notify their national cybersecurity strategies to the commission within three months from their adoption. member states may exclude specific information from the notification where and to the extent that it is strictly necessary to preserve national security. ### 3. member states shall notify their national cybersecurity strategies to the commission within three months from their adoption. member states may exclude specific information from the notification where and to the extent that it is necessary to preserve national security.


### 5. the commission may adopt implementing acts in order to lay down the technical and the methodological specifications of the elements referred to in paragraph 2. where preparing those acts , the commission shall proceed in accordance with the examination procedure referred to in article 37(2) and follow , to the greatest extent possible , international and european standards , as well as relevant technical specifications. ### deleted


### 11. the commission , may adopt implementing acts further specifying the type of information , the format and the procedure of a notification submitted pursuant to paragraphs 1 and 2. the commission may also adopt implementing acts to further specify the cases in which an incident shall be considered significant as referred to in paragraph 3. those implementing acts shall be adopted in accordance with the examination procedure referred to in article 37(2). ### 11. the commission , after it has consulted the industry and taking utmost account of enisa’s opinion , may adopt implementing acts further specifying the type of information , the format and the procedure of a notification submitted pursuant to paragraph 1. they shall be based on european and international standards to the greatest extent possible. those implementing acts shall be adopted in accordance with the examination procedure referred to in article 37(2).


### (21) in view of the differences in national governance structures and in order to safeguard already existing sectoral arrangements or union supervisory and regulatory bodies , member states should be able to designate more than one national competent authority responsible for fulfilling the tasks linked to the security of the network and information systems of essential and important entities under this directive. member states should be able to assign this role to an existing authority. ### (21) in view of the differences in national governance structures and in order to safeguard already existing sectoral arrangements or union supervisory and regulatory bodies , member states should be able to designate more than one national competent authority responsible for fulfilling the tasks linked to the security of the network and information systems of essential and important entities and public administration entities under this directive. member states should be able to assign this role to an existing authority.


### (21) in view of the differences in national governance structures and in order to safeguard already existing sectoral arrangements or union supervisory and regulatory bodies , member states should be able to designate more than one national competent authority responsible for fulfilling the tasks linked to the security of the network and information systems of essential and important entities under this directive. member states should be able to assign this role to an existing authority. ### (21) in view of the differences in national governance structures and in order to safeguard already existing sectoral arrangements or union supervisory and regulatory bodies , member states should be able to designate more than one national competent authority responsible for fulfilling the tasks linked to the security of the network and information systems of essential and important entities under this directive , particularly for supervision and enforcement. member states should be able to assign this role to an existing authority. the competent authorities should have the necessary means to perform their duties , including powers to request the information necessary to assess the level of security of networks or services. they should also have the power to request comprehensive and reliable data about actual security incidents that have had a significant impact on the operation of services. they should , where necessary , be assisted by csirts. in particular , csirts may be required to provide competent authorities with information about risks and security incidents affecting services and recommend ways to address them.


### (43) addressing cybersecurity risks stemming from an entity’s supply chain and its relationship with its suppliers is particularly important given the prevalence of incidents where entities have fallen victim to cyber-attacks and where malicious actors were able to compromise the security of an entity’s network and information systems by exploiting vulnerabilities affecting third party products and services. entities should therefore assess and take into account the overall quality of products and cybersecurity practices of their suppliers and service providers , including their secure development procedures. ### (43) addressing cybersecurity risks stemming from an entity’s supply chain and its relationship with its suppliers is particularly important given the prevalence of incidents where entities have fallen victim to cyber-attacks and where malicious actors were able to compromise the security of an entity’s network and information systems by exploiting vulnerabilities affecting third party products and services. entities should therefore assess and take into account the overall quality of products and cybersecurity practices of their suppliers and service providers , including their secure development procedures. entities should be in particular encouraged to incorporate the cybersecurity safeguards into the contractual arrangements with the tier-1 suppliers and service providers , including responsibility of the tier-1 suppliers for other tiers of suppliers and service providers.


### 2. eu-cyclone shall be composed of the representatives of member states’ crisis management authorities designated in accordance with article 7 , the commission and enisa. enisa shall provide the secretariat of the network and support the secure exchange of information. ### 2. eu-cyclone shall be composed of the representatives of member states’ crisis management authorities designated in accordance with article 7 and enisa. commission shall participate in the eu-cyclone as an observer. enisa shall provide the secretariat of the network and support the secure exchange of information.


### 2. member states shall ensure that members of the management body follow specific trainings , on a regular basis , to gain sufficient knowledge and skills in order to apprehend and assess cybersecurity risks and management practices and their impact on the operations of the entity. ### 2. member states shall ensure that members of the management body of essential and important entities follow specific trainings , where possible on a regular basis , to gain sufficient knowledge and skills in order to apprehend and assess cybersecurity risks and management practices and their impact on the services provided by the entity.


### incident handling (prevention , detection , and response to incidents); ### incident management (including prevention , detection , and response to incidents);


### 4. member states shall ensure that , for the purpose of the notification under paragraph 1 , the entities concerned shall submit to the competent authorities or the csirt: ### 4. member states shall ensure that , for the purpose of the notification under paragraph 1 , the entities concerned shall submit to the competent authorities and the csirt:


### upon the request of a competent authority or a csirt , an intermediate report on relevant status updates; ### upon the request of a competent authority or a csirt , without undue delay an intermediate information on relevant status updates;


### 6. where appropriate , and in particular where the incident referred to in paragraph 1 concerns two or more member states , the competent authority or the csirt shall inform the other affected member states and enisa of the incident. in so doing , the competent authorities , csirts and single points of contact shall , in accordance with union law or national legislation that complies with union law , preserve the entity’s security and commercial interests as well as the confidentiality of the information provided. ### 6. where appropriate , and in particular where the incident referred to in paragraph 1 concerns two or more member states , the competent authority or the csirt shall inform without undue delay the other affected member states and enisa of the incident. in so doing , the competent authorities , csirts and single points of contact shall , in accordance with union law or national legislation that complies with union law , preserve the entity’s security and commercial interests as well as the confidentiality of the information provided.


### 8. at the request of the competent authority or the csirt , the single point of contact shall forward notifications received pursuant to paragraphs 1 and 2 to the single points of contact of other affected member states. ### 8. at the request of the competent authority or the csirt , the single point of contact shall forward without undue delay notifications received pursuant to paragraph 1 to the single points of contact of other affected member states.


### 9. the single point of contact shall submit to enisa on a monthly basis a summary report including anonymised and aggregated data on incidents , significant cyber threats and near misses notified in accordance with paragraphs 1 and 2 and in accordance with article 27. in order to contribute to the provision of comparable information , enisa may issue technical guidance on the parameters of the information included in the summary report. ### 9. the single point of contact shall submit to enisa on a monthly basis a summary report including anonymised and aggregated data on significant incidents , significant cyber threats and significant near misses notified in accordance with paragraph 1 and in accordance with article 27. in order to contribute to the provision of comparable information , enisa may issue technical guidance on the parameters of the information included in the summary report.


### 10. competent authorities shall provide to the competent authorities designated pursuant to directive (eu) xxxx/xxxx [resilience of critical entities directive] information on incidents and cyber threats notified in accordance with paragraphs 1 and 2 by essential entities identified as critical entities , or as entities equivalent to critical entities , pursuant to directive (eu) xxxx/xxxx [resilience of critical entities directive]. ### 10. competent authorities or the csirts shall provide without undue delay to the competent authorities designated pursuant to directive (eu) xxxx/xxxx [resilience of critical entities directive] information on significant incidents , notified in accordance with paragraphs 1 by essential entities identified as critical entities , or as entities equivalent to critical entities , pursuant to directive (eu) xxxx/xxxx [resilience of critical entities directive] , as well as on the measures taken by competent authorities or csirts in response to those incidents.


### 1. dns service providers , tld name registries , cloud computing service providers , data centre service providers and content delivery network providers referred to in point 8 of annex i , as well as digital providers referred to in point 6 of annex ii shall be deemed to be under the jurisdiction of the member state in which they have their main establishment in the union. ### 1. dns service providers , tld name registries , cloud computing service providers , data centre service providers , content delivery network providers and providers of number-independent interpersonal communications services referred to in point 8 of annex i , as well as digital providers referred to in point 6 of annex ii shall be deemed to be under the jurisdiction of the member state in which they have their main establishment in the union.


### 1. without prejudice to regulation (eu) 2016/679 , member states shall ensure that essential and important entities may exchange relevant cybersecurity information among themselves including information relating to cyber threats , vulnerabilities , indicators of compromise , tactics , techniques and procedures , cybersecurity alerts and configuration tools , where such information sharing: ### 1. without prejudice to regulation (eu) 2016/679 , member states shall ensure that essential and important entities and other relevant entities not covered by the scope of this directive may exchange relevant cybersecurity information among themselves including information relating to cyber threats , vulnerabilities , indicators of compromise , tactics , techniques and procedures , cybersecurity alerts and configuration tools , where such information sharing:


### 4. essential and important entities shall notify the competent authorities of their participation in the information-sharing arrangements referred to in paragraph 2 , upon entering into such arrangements , or , as applicable , of their withdrawal from such arrangements , once the withdrawal takes effect. ### 4. essential and important entities may notify the competent authorities of their participation in the information-sharing arrangements referred to in paragraphs 2 and 3a , upon entering into such arrangements , or , as applicable , of their withdrawal from such arrangements , once the withdrawal takes effect.


### voluntary notification of relevant information ### voluntary reporting


### requests for evidence of implementation of cybersecurity policies , such as the results of security audits carried out by a qualified auditor and the respective underlying evidence. ### requests for evidence of implementation of cybersecurity policies , such as the results of security audits carried out by a qualified auditor and the respective underlying evidence; the cost of the audit shall be paid by the essential entity;


### issue binding instructions or an order requiring those entities to remedy the deficiencies identified or the infringements of the obligations laid down in this directive; ### issue binding instructions , including those regarding the measures required to remedy an incident or prevent one from occurring when a significant threat has been identified , time-limits for implementation and reporting obligations , or an order requiring those entities to remedy the deficiencies identified or the infringements of the obligations laid down in this directive;


### suspend or request a certification or authorisation body to suspend a certification or authorisation concerning part or all the services or activities provided by an essential entity; ### request a certification or authorisation body to consider suspension of a certification or authorisation concerning part or all relevant services or activities provided by an essential entity;


### 1. member states shall adopt and publish , by … [18 months after the date of entry into force of this directive] , the laws , regulations and administrative provisions necessary to comply with this directive. they shall immediately inform the commission thereof. they shall apply those measures from … [one day after the date referred to in the first subparagraph]. ### 1. member states shall adopt and publish , by … [24 months after the date of entry into force of this directive] , the laws , regulations and administrative provisions necessary to comply with this directive. they shall immediately inform the commission thereof. they shall apply those measures from … [one day after the date referred to in the first subparagraph].


### article 19 of regulation (eu) no 910/2014 is deleted. ### article 19 of regulation (eu) no 910/2014 is deleted with effect from [date of transposition deadline of the directive].


### articles 40 and 41 of directive (eu) 2018/1972 are deleted. ### directive (eu) 2018/1972 is amended with effect from [date of transposition deadline of the directive] as follows:


### this directive shall enter into force on the twentieth day following that of its publication in the official journal of the european union. ### this directive shall enter into force on the twentieth day following that of its publication in the official journal of the european union , with exception to article 39 which enters into force on the day following the day when the transposition deadline as laid down in article 38 expires.


### 9. public administration ### deleted


### proposal for a directive of the european parliament and of the council on measures for a high common level of cybersecurity across the union , repealing directive (eu) 2016/1148 (text with eea relevance) ### proposal for a directive of the european parliament and of the council on measures for a high common level of cybersecurity across the union (nis directive) , repealing directive (eu) 2016/1148 (text with eea relevance)


### (7) with the repeal of directive (eu) 2016/1148 , the scope of application by sectors should be extended to a larger part of the economy in light of the considerations set out in recitals (4) to (6). the sectors covered by directive (eu) 2016/1148 should therefore be extended to provide a comprehensive coverage of the sectors and services of vital importance for key societal and economic activities within the internal market. the rules should not be different according to whether the entities are operators of essential services or digital service providers. that differentiation has proven obsolete , since it does not reflect the actual importance of the sectors or services for the societal and economic activities in the internal market. ### (7) with the repeal of directive (eu) 2016/1148 , the scope of application by sectors should be extended to a larger part of the economy in light of the considerations set out in recitals (4) to (6). the sectors covered by directive (eu) 2016/1148 should therefore be extended to provide a comprehensive coverage of the sectors and services of vital importance for key societal and economic activities within the internal market.


### (24) member states should be adequately equipped , in terms of both technical and organisational capabilities , to prevent , detect , respond to and mitigate network and information system incidents and risks. member states should therefore ensure that they have well-functioning csirts , also known as computer emergency response teams (‘certs’) , complying with essential requirements in order to guarantee effective and compatible capabilities to deal with incidents and risks and to ensure efficient cooperation at union level. in view of enhancing the trust relationship between the entities and the csirts , in cases where a csirt is part of the competent authority , member states should consider functional separation between the operational tasks provided by csirts , notably in relation to information sharing and support to the entities , and the supervisory activities of competent authorities. ### (24) member states should be adequately equipped , in terms of both technical and organisational capabilities , to prevent , detect , respond to and mitigate network and information system incidents and risks. member states should therefore designate one or more csirts under this directive and ensure that they are well-functioning , complying with essential requirements in order to guarantee effective and compatible capabilities to deal with incidents and risks and to ensure efficient cooperation at union level. member states may as csirts designate also existing computer emergency response teams (‘certs’). in view of enhancing the trust relationship between the entities and the csirts , in cases where a csirt is part of the competent authority , member states should consider functional separation between the operational tasks provided by csirts , notably in relation to information sharing and support to the entities , and the supervisory activities of competent authorities.


### (50) given the growing importance of number-independent interpersonal communications services , it is necessary to ensure that such services are also subject to appropriate security requirements in view of their specific nature and economic importance. providers of such services should thus also ensure a level of security of network and information systems appropriate to the risk posed. given that providers of number-independent interpersonal communications services normally do not exercise actual control over the transmission of signals over networks , the degree of risk for such services can be considered in some respects to be lower than for traditional electronic communications services. the same applies to interpersonal communications services which make use of numbers and which do not exercise actual control over signal transmission. ### (50) given the growing importance of number-independent interpersonal communications services , it is necessary to ensure that such services are also subject to appropriate security requirements in view of their specific nature and economic importance. providers of such services should thus also ensure a level of security of network and information systems appropriate to the risk posed. given that providers of number-independent interpersonal communications services normally do not exercise actual control over the transmission of signals over networks , the degree of risk for such services can be considered in some respects to be lower than for traditional electronic communications services. the same applies to number-based interpersonal communications services which do not exercise actual control over signal transmission.


### (64) in order to take account of the cross-border nature of the services and operations of dns service providers , tld name registries , content delivery network providers , cloud computing service providers , data centre service providers and digital providers , only one member state should have jurisdiction over these entities. jurisdiction should be attributed to the member state in which the respective entity has its main establishment in the union. the criterion of establishment for the purposes of this directive implies the effective exercise of activity through stable arrangements. the legal form of such arrangements , whether through a branch or a subsidiary with a legal personality , is not the determining factor in that respect. whether this criterion is fulfilled should not depend on whether the network and information systems are physically located in a given place; the presence and use of such systems do not , in themselves , constitute such main establishment and are therefore not decisive criteria for determining the main establishment. the main establishment should be the place where the decisions related to the cybersecurity risk management measures are taken in the union. this will typically correspond to the place of the companies’ central administration in the union. if such decisions are not taken in the union , the main establishment should be deemed to be in the member states where the entity has an establishment with the highest number of employees in the union. where the services are carried out by a group of undertakings , the main establishment of the controlling undertaking should be considered to be the main establishment of the group of undertakings. ### (64) in order to take account of the cross-border nature of the services and operations of dns service providers , tld name registries , content delivery network providers , cloud computing service providers , data centre service providers , digital providers and providers of number-independent interpersonal communications services , only one member state should have jurisdiction over these entities. jurisdiction should be attributed to the member state in which the respective entity has its main establishment in the union. the criterion of establishment for the purposes of this directive implies the effective exercise of activity through stable arrangements. the legal form of such arrangements , whether through a branch or a subsidiary with a legal personality , is not the determining factor in that respect. whether this criterion is fulfilled should not depend on whether the network and information systems are physically located in a given place; the presence and use of such systems do not , in themselves , constitute such main establishment and are therefore not decisive criteria for determining the main establishment. the main establishment should be the place where the decisions related to the cybersecurity risk management measures are taken in the union. this will typically correspond to the place of the companies’ central administration in the union. if such decisions are not taken in the union , the main establishment should be deemed to be in the member states where the entity has an establishment implementing the main cybersecurity risk management measures in the union. where the services are carried out by a group of undertakings , the main establishment of the controlling undertaking should be considered to be the main establishment of the group of undertakings.


### (65) in cases where a dns service provider , tld name registry , content delivery network provider , cloud computing service provider , data centre service provider and digital provider not established in the union offers services within the union , it should designate a representative. in order to determine whether such an entity is offering services within the union , it should be ascertained whether it is apparent that the entity is planning to offer services to persons in one or more member states. the mere accessibility in the union of the entity’s or an intermediary's website or of an email address and of other contact details , or the use of a language generally used in the third country where the entity is established , is as such insufficient to ascertain such an intention. however , factors such as the use of a language or a currency generally used in one or more member states with the possibility of ordering services in that other language , or the mentioning of customers or users who are in the union , may make it apparent that the entity is planning to offer services within the union. the representative should act on behalf of the entity and it should be possible for competent authorities or the csirts to contact the representative. the representative should be explicitly designated by a written mandate of the entity to act on the latter's behalf with regard to the latter's obligations under this directive , including incident reporting. ### (65) in cases where a dns service provider , tld name registry , content delivery network provider , cloud computing service provider , data centre service provider , digital provider and provider of number-independent interpersonal communications services not established in the union offers services within the union , it should designate a representative. in order to determine whether such an entity is offering services within the union , it should be ascertained whether it is apparent that the entity is planning to offer services to persons in one or more member states. the mere accessibility in the union of the entity’s or an intermediary's website or of an email address and of other contact details , or the use of a language generally used in the third country where the entity is established , is as such insufficient to ascertain such an intention. however , factors such as the use of a language or a currency generally used in one or more member states with the possibility of ordering services in that other language , or the mentioning of customers or users who are in the union , may make it apparent that the entity is planning to offer services within the union. the representative should act on behalf of the entity and it should be possible for competent authorities or the csirts to contact the representative. the representative should be explicitly designated by a written mandate of the entity to act on the latter's behalf with regard to the latter's obligations under this directive , including incident reporting.


### (80) in order to take into account new cyber threats , technological developments or sectorial specificities , the power to adopt acts in accordance with article 290 tfeu should be delegated to the commission in respect of the elements in relation to risk management measures required by this directive. the commission should also be empowered to adopt delegated acts establishing which categories of essential entities shall be required to obtain a certificate and under which specific european cybersecurity certification schemes. it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level , and that those consultations be conducted in accordance with the principles laid down in the inter-institutional agreement of 13 april 2016 on better law-making26 . in particular , to ensure equal participation in the preparation of delegated acts , the european parliament and the council receive all documents at the same time as member states' experts , and their experts systematically have access to meetings of commission expert groups dealing with the preparation of delegated acts. ### deleted


### lays down cybersecurity risk management and reporting obligations for entities of a type referred to as essential entities in annex i and important entities in annex ii; ### lays down obligation on member states to introduce cybersecurity risk management and reporting obligations for entities of a type referred to as essential entities in annex i and important entities in annex ii;


### lays down obligations on cybersecurity information sharing. ### lays down obligations on member states to facilitate the cybersecurity information sharing;


### (25) ‘essential entity’ means any entity of a type referred to as an essential entity in annex i; ### (25) ‘essential entity’ means any entity of a type referred to in annex i and ii , designated by the member state as an essential entity;


### (26) ‘important entity’ means any entity of a type referred to as an important entity in annex ii. ### (26) ‘important entity’ means any entity of a type referred to in annex i and ii , unless exempted from the scope of this directive or designated by the member state as an essential entity;


### 1. each member state shall adopt a national cybersecurity strategy defining the strategic objectives and appropriate policy and regulatory measures , with a view to achieving and maintaining a high level of cybersecurity. the national cybersecurity strategy shall include , in particular , the following: ### 1. each member state shall adopt a national cybersecurity strategy , a coherent framework defining the strategic objectives and appropriate policy and regulatory measures , with a view to achieving and maintaining a high level of security of network and information systems in that member state. the national cybersecurity strategy shall include , in particular , the following:


### 2. as part of the national cybersecurity strategy , member states shall in particular adopt the following policies: ### 2. in the framework of the national cybersecurity strategy , member states shall in particular address the following policies:


### 3. each member state shall adopt a national cybersecurity incident and crisis response plan where objectives and modalities in the management of large-scale cybersecurity incidents and crises are set out. the plan shall lay down , in particular , the following: ### 3. each member state shall adopt a national cybersecurity incident and crisis response plan where objectives and modalities in the management of large-scale cybersecurity incidents and crises are set out. member states shall consider inclusion in the plan in particular of the following points:


### 4. member states shall communicate to the commission the designation of their competent authorities referred to in paragraph 1 and submit their national cybersecurity incident and crisis response plans as referred to in paragraph 3 within three months from that designation and the adoption of those plans. member states may exclude specific information from the plan where and to the extent that it is strictly necessary for their national security. ### 4. member states shall communicate to the eu-cyclone and the commission the designation of their competent authorities referred to in paragraph 1 and submit their national cybersecurity incident and crisis response plans as referred to in paragraph 3 within three months from that designation and the adoption of those plans to the eu-cyclone. member states may exclude specific information from the plan where and to the extent that it is strictly necessary for their national security.


### 3. each member state shall designate one national single point of contact on cybersecurity (‘single point of contact’). where a member state designates only one competent authority , that competent authority shall also be the single point of contact for that member state. ### 3. each member state shall designate one of the competent authorities referred to in paragraph 1 as a national single point of contact on cybersecurity (‘single point of contact’). where a member state designates only one competent authority , that competent authority shall also be the single point of contact for that member state.


### 7. member states shall communicate to the commission without undue delay the csirts designated in accordance with paragraph 1 , the csirt coordinator designated in accordance with article 6(1) and their respective tasks provided in relation to the entities referred to in annexes i and ii. ### 7. member states shall communicate to the commission without undue delay the csirts designated in accordance with paragraph 1 and their respective tasks provided in relation to the entities referred to in annexes i and ii , and the cvd csirt coordinator designated in accordance with paragraph 1a of this article.


### 3. csirts shall establish cooperation relationships with relevant actors in the private sector , with a view to better achieving the objectives of the directive. ### 3. csirts shall establish cooperation relationships with relevant entities , industry and other relevant actors in the private sector , with a view to better achieving the objectives of the directive.


### 3. each member state shall ensure that its competent authorities or csirts inform its single point of contact of notifications on incidents , significant cyber threats and near misses submitted pursuant to this directive. ### 3. each member state shall ensure that its competent authorities or csirts inform its single point of contact and other relevant authorities in accordance with article 20 of notifications on significant incidents , significant cyber threats and significant near misses.


### 5. member states shall ensure that their competent authorities regularly provide information to competent authorities designated pursuant to directive (eu) xxxx/xxxx [resilience of critical entities directive] on cybersecurity risks , cyber threats and incidents affecting essential entities identified as critical , or as entities equivalent to critical entities , pursuant to directive (eu) xxxx/xxxx [resilience of critical entities directive] , as well as the measures taken by competent authorities in response to those risks and incidents. ### deleted


### the cooperation group shall be composed of representatives of member states , the commission and enisa. the european external action service shall participate in the activities of the cooperation group as an observer. the european supervisory authorities (esas) in accordance with article 17(5)(c) of regulation (eu) xxxx/xxxx [the dora regulation] may participate in the activities of the cooperation group. ### the cooperation group shall be composed of representatives of member states nominated by the single point of contact , the commission and enisa. the european external action service shall participate in the activities of the cooperation group as an observer. the european supervisory authorities (esas) in accordance with article 17(5)(c) of regulation (eu) xxxx/xxxx [the dora regulation] may participate in the activities of the cooperation group. where appropriate , the cooperation group may invite representatives of relevant stakeholders , particularly representatives of industry , to participate in its work.


### exchanging best practices and information in relation to the implementation of this directive , including in relation to cyber threats , incidents , vulnerabilities , near misses , awareness-raising initiatives , trainings , exercises and skills , building capacity as well as standards and technical specifications; ### exchanging best practices and information in relation to the implementation of this directive , including in relation to identification of essential and important entities , cyber threats , incidents , vulnerabilities , near misses , awareness-raising initiatives , trainings , exercises and skills , capacity building as well as standards and technical specifications;


### 1. in order to support the coordinated management of large-scale cybersecurity incidents and crises at operational level and to ensure the regular exchange of information among member states and union institutions , bodies and agencies , the european cyber crises liaison organisation network (eu - cyclone) is hereby established. ### 1. in order to support the coordinated management of large-scale cybersecurity incidents and crises at operational level and to ensure the regular exchange of information among member states and union institutions , bodies and agencies considering such incidents and crises , the european cyber crises liaison organisation network (eu - cyclone) is hereby established.


### 3. eu-cyclone shall have the following tasks: ### 3. eu-cyclone , while avoiding any duplication of tasks with the csirt network , shall have the following tasks:


### developing a shared situational awareness of relevant cybersecurity events; ### deleted


### discussing national cybersecurity incident and response plans referred to in article 7(2). ### deleted


### 5. eu-cyclone shall regularly report to the cooperation group on cyber threats , incidents and trends , focusing in particular on their impact on essential and important entities. ### 5. eu-cyclone shall regularly report to the cooperation group on large scale incidents and crises , focusing in particular on their impact on essential and important entities.


### 6. a conformity assessment body shall be capable of carrying out all the conformity assessment activities mentioned in annex viii and in relation to which it has been notified , whether those tasks are carried out by the conformity assessment body itself or on its behalf and under its responsibility. ### 6. a conformity assessment body shall be capable of carrying out all the conformity assessment tasks mentioned in annex viii and in relation to which it has been notified , whether those tasks are carried out by the conformity assessment body itself or on its behalf and under its responsibility.


### (1) the european green deal24 is europe’s growth strategy that aims to transform the union into a fair and prosperous society , with a modern , resource-efficient and competitive economy where there are no net emissions of greenhouse gases in 2050 and where economic growth is decoupled from resource use. a shift from the use of fossil fuels in vehicles to electromobility is one of the prerequisites for reaching the climate neutrality goal in 2050. in order for the union’s product policies to contribute to lowering carbon emissions on a global level , it needs to be ensured that products marketed and sold in the union are sourced and manufactured in a sustainable manner. ### (1) the european green deal24 is europe’s growth strategy that aims to transform the union into a fair and prosperous society , with a modern , resource-efficient and competitive economy where there are no net emissions of greenhouse gases in 2050 and where economic growth is decoupled from resource use. a shift from the use of fossil fuels in vehicles to electromobility might be one of the prerequisites for reaching the climate neutrality goal in 2050. in order for the union’s product policies to contribute to lowering carbon emissions on a global level , it needs to be ensured that products marketed and sold in the union are sourced and manufactured in a sustainable manner.


### (2) batteries are thus an important source of energy and one of the key enablers for sustainable development , green mobility , clean energy and climate neutrality. it is expected that the demand for batteries will grow rapidly in the coming years , notably for electric road transport vehicles using batteries for traction , making this market an increasingly strategic one at the global level. significant scientific and technical progress in the field of battery technology will continue. in view of the strategic importance of batteries , and to provide legal certainty to all operators involved and to avoid discrimination , barriers to trade and distortions on the market for batteries , it is necessary to set out rules on sustainability parameters , performance , safety , collection , recycling and second life of batteries as well as on information about batteries. it is necessary to create a harmonised regulatory framework for dealing with the entire life cycle of batteries that are placed on the market in the union. ### (2) batteries are thus an important carrier of energy and one of the key enablers for sustainable development , green mobility , clean energy and climate neutrality. it is expected that the demand for batteries will grow rapidly in the coming years , notably for electric road transport vehicles using batteries for traction , making this market an increasingly strategic one at the global level. significant scientific and technical progress in the field of battery technology will continue. in view of the strategic importance of batteries , and to provide legal certainty to all operators involved and to avoid discrimination , barriers to trade and distortions on the market for batteries while taking into consideration new regulatory burden , it is necessary to set out rules on sustainability parameters , performance , safety , collection , recycling and second life of batteries as well as on information about batteries. it is necessary to create a harmonised regulatory framework for dealing with the entire life cycle of batteries that are placed on the market in the union.


### (2) batteries are thus an important source of energy and one of the key enablers for sustainable development , green mobility , clean energy and climate neutrality. it is expected that the demand for batteries will grow rapidly in the coming years , notably for electric road transport vehicles using batteries for traction , making this market an increasingly strategic one at the global level. significant scientific and technical progress in the field of battery technology will continue. in view of the strategic importance of batteries , and to provide legal certainty to all operators involved and to avoid discrimination , barriers to trade and distortions on the market for batteries , it is necessary to set out rules on sustainability parameters , performance , safety , collection , recycling and second life of batteries as well as on information about batteries. it is necessary to create a harmonised regulatory framework for dealing with the entire life cycle of batteries that are placed on the market in the union. ### (2) batteries are thus an important source of energy and one of the key enablers for sustainable development , green mobility , clean energy and climate neutrality. it is expected that the demand for batteries will grow rapidly in the coming years , notably for electric road transport vehicles using batteries for traction , making this market an increasingly strategic one at the global level. significant scientific and technical progress in the field of battery technology will continue. in view of the strategic importance of batteries , and to provide legal certainty to all operators involved and to avoid discrimination , barriers to trade and distortions on the market for batteries , it is necessary to set out rules on sustainability parameters , performance , safety , collection , recycling and second life of batteries as well as on information about batteries. considering technological and scientific progress , the chemical composition of , and substances contained in , batteries placed on the union market should be subject to the same sustainability requirements. moreover , it is necessary to create a harmonised regulatory framework for dealing with the entire life cycle of batteries that are placed on the market in the union.