### the commission shall adopt delegated acts , in accordance with article 142 , laying down the modalities of the exchange of information in paragraph 2 . 9 . the commission shall adopt delegated acts , in accordance with article 142 , laying down rules concerning arrangements for the audit trail referred to in paragraph 4 . 10 . the commission shall adopt , by means of implementing acts , the model for the management declaration referred to in paragraph 4 . those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 143 . ### the commission shall be empowered to adopt delegated acts , in accordance with article 142 laying down rules specifying the information in relation to the data to be recorded and stored in computerised form within monitoring system established under point of paragraph 2 . the commission shall adopt implementing acts laying down the technical specifications of the system established under point of paragraph 2 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 143 . 9 . the commission shall be empowered to adopt delegated acts , in accordance with article 142 , laying down the detailed minimum requirements for the audit trail referred to in paragraph 4 in respect of the accounting records to be maintained and the supporting documents to be held at the level of the certifying authority , managing authority , intermediate bodies and beneficiaries . 101 . the commission shall adopt implementing acts , in accordance with the advisory procedure referred to in article 143 laying down uniform conditions on the model for the management declaration referred to in paragraph 4 of this article . 1 note : the appropriate linguistic formulation for ia provisions to be further discussed following input . input from whom ?


### member states shall concentrate support , in accordance with the fund - specific rules , on actions bringing the greatest added value in relation to the union strategy for smart , sustainable and inclusive growth , addressing the challenges identified in the country - specific recommendations under article 121 of the treaty and the relevant council recommendations adopted under 148 of the treaty , and taking into account national and regional needs . ### member states shall concentrate support , in accordance with the fund - specific rules , on interventions bringing the greatest added value in relation to the union strategy for smart , sustainable and inclusive growth taking into account the key territorial challenges for different types of territories in line with the csf , the challenges identified in the national reform programme , where appropriate , and relevant country - specific recommendations under article 121 of the treaty on the functioning of the european union and the relevant council recommendations adopted under article 148 of the treaty on the functioning of the european union . provisions on thematic concentration under the fund - specific rules do not apply to technical assistance .


### functions of the audit authority the audit authority shall ensure that audits are carried out on the management and control systems , on an appropriate sample of operations and on the annual accounts . the commission shall be empowered to adopt delegated acts in accordance with article 142 to set out the conditions which those audits shall fulfil . 2 . where audits are carried out by a body other than the audit authority , the audit authority shall ensure that any such body has the necessary functional independence . 3 . the audit authority shall ensure that audit work takes account of internationally accepted audit standards . 4 . the audit authority shall , within six months of adoption of an operational programme , prepare an audit strategy for performance of audits . the audit strategy shall set out the audit methodology , the sampling method for audits on operations and the planning of audits in relation to the current accounting year and the two subsequent accounting years . the audit strategy shall be updated annually from 2016 until and including 2022 . where a common management and control system applies to more than one operational programme , a single audit strategy may be prepared for the operational programmes concerned . the audit authority shall submit the audit strategy to the commission upon request . 5 . the audit authority shall draw up : an audit opinion on the annual accounts for the preceding accounting year , whose scope shall cover the completeness , accuracy and veracity of the annual accounts , the functioning of the management and control system and the legality and regularity of the underlying transactions ; an annual control report setting out the findings of the audits carried out during the preceding accounting year . the report under point shall set out any deficiencies found in the management and control system and any corrective measures taken or proposed to be taken . where a common management and control system applies to more than one operational programme , the information required under point may be grouped in a single report . 6 . the commission shall adopt , by means of implementing acts , models for the audit strategy , the audit opinion and the annual control report , as well as the methodology for the sampling method referred to in paragraph 4 . these implementing acts shall be adopted in accordance with the examination procedure referred to in article 143 . 7 . implementing rules concerning the use of data collected during audits carried out by commission officials or authorised commission representatives shall be adopted by the commission in accordance with the examination procedure referred to in article 143 . ### functions of the audit authority the audit authority shall ensure that audits are carried out on the proper functioning of the management and control system of the operational programme and on an appropriate sample of operations on the basis of the declared expenditure . the declared expenditure shall be audited based on a representative sample and as a general rule on statistical sampling methods . a non - statistical sampling method may be used on the professional judgement of the audit authority in duly justified cases in accordance with international audit standards and in any case when the number of operations for an accounting year is insufficient to allow the use of statistical method . in such cases the size of the sample shall be sufficient to enable the audit authority to draw up a valid audit opinion in accordance with article 59 of the financial regulation . the non - statistical sample method shall cover a minimum of 5% of operations for which expenditure has been declared to the commission during an accounting year and 10% of the expenditure which has been declared to the commission during an accounting year . deleted 2 . where audits are carried out by a body other than the audit authority , the audit authority shall ensure that any such body has the necessary functional independence . 3 . the audit authority shall ensure that audit work takes account of internationally accepted audit standards . 4 . the audit authority shall , within eight months of adoption of an operational programme , prepare an audit strategy for performance of audits . the audit strategy shall set out the audit methodology , the sampling method for audits on operations and the planning of audits in relation to the current accounting year and the two subsequent accounting years . the audit strategy shall be updated annually from 2016 until and including 2022 . where a common management and control system applies to more than one operational programme , a single audit strategy may be prepared for the operational programmes concerned . the audit authority shall submit the audit strategy to the commission upon request . 5 . the audit authority shall draw up : an audit opinion in accordance with article 59 of the financial regulation ; a control report setting out the main findings , including deficiencies found in the management and control systems , of the audits carried out according to paragraph 116 and the proposed and implemented corrective actions . deleted where a common management and control system applies to more than one operational programme , the information required under point may be grouped in a single report . 6 . the commission shall adopt , by means of implementing acts , models for the audit strategy , the audit opinion and the control report . these implementing acts shall be adopted in accordance with the advisory procedure referred to in article 143 . 6a . the commission shall be empowered to adopt delegated acts in accordance with article 142 to set out the scope and content of audits of operations and audits of the accounts and the methodology for the selection of the sample of operations referred to in paragraph 1 . 7 . the commission shall be empowered to adopt delegated acts , in accordance with article 142 , laying down detailed rules on the use of data collected during audits carried out by commission officials or authorised commission representatives .


### commission powers and responsibilities the commission shall satisfy itself on the basis of available information , including the accreditation procedure , annual management declaration , annual control reports , annual audit opinion , annual implementation report and audits carried out by national and union bodies , that the member states have set up management and control systems that comply with this regulation and the fund - specific rules and that these systems function effectively during the implementation of programmes . 2 . without prejudice to audits carried out by member states , commission officials or authorised commission representatives may carry out on - the - spot audits or checks upon giving adequate prior notice . the scope of such audits or checks may include , in particular , verification of the effective functioning of management and control systems in a programme or a part thereof , operations and assessment of the sound financial management of operations or programmes . officials or authorised representatives of the member state may take part in such audits . commission officials or authorised commission representatives , duly empowered to carry out on - the - spot audits , shall have access to all records , documents and metadata , irrespective of the medium in which they are stored , relating to operations supported by the csf funds or to management and control systems . member states shall provide copies of such records , documents and metadata to the commission upon request . the powers set out in this paragraph shall not affect the application of national provisions which reserve certain acts for agents specifically designated by national legislation . commission officials and authorised representatives shall not take part , inter alia , in home visits or the formal questioning of persons within the framework of national legislation . however , they shall have access to the information thus obtained . 3 . the commission may require a member state to take the actions necessary to ensure the effective functioning of their management and control systems or the correctness of expenditure in accordance with the fund - specific rules . 4 . the commission may require a member state to examine a complaint submitted to the commission concerning the selection or implementation of operations co - financed by the csf funds or the functioning of the management and control system . ### commission powers and responsibilities the commission shall satisfy itself , on the basis of available information , including information on the designation of bodies responsible for the management and control , the documents provided each year by the designated bodies under article 59 of the financial regulation , control reports , annual implementation reports and audits carried out by national and union bodies , that the member states have set up management and control systems that comply with this regulation and the fund - specific rules and that these systems function effectively during the implementation of programmes . 2 . commission officials or authorised commission representatives may carry out on - the - spot audits or checks upon giving at least twelve working days notice to the competent national authority , except in urgent cases . the commission shall respect the principle of proportionality by taking into account the need to avoid unjustified duplication of audits or checks carried out by member states , the level of risk to the union budget and the need to minimise administrative burdens for beneficiaries in accordance with the fund - specific rules . the scope of such audits or checks may include , in particular , verification of the effective functioning of management and control systems in a programme or a part thereof , operations and assessment of the sound financial management of operations or programmes . officials or authorised representatives of the member state may take part in such audits or checks . commission officials or authorised commission representatives , duly empowered to carry out on - the - spot audits or checks , shall have access to all necessary records , documents and metadata , irrespective of the medium in which they are stored , relating to operations supported by the european structural and investment funds or to management and control systems . member states shall provide copies of such records , documents and metadata to the commission upon request . the powers set out in this paragraph shall not affect the application of national provisions which reserve certain acts for agents specifically designated by national legislation . commission officials and authorised representatives shall not take part , inter alia , in home visits or the formal questioning of persons within the framework of national legislation . however , they shall have access to the information thus obtained without prejudice to the competences of national courts and in full respect of the fundamental rights of the concerned legal subjects . 3 . the commission may require a member state to take the actions necessary to ensure the effective functioning of their management and control systems or the correctness of expenditure in accordance with the fund - specific rules . deleted


### the member states and the commission shall ensure that environmental protection requirements , resource efficiency , climate change mitigation and adaptation , disaster resilience and risk prevention and management are promoted in the preparation and implementation of partnership contracts and programmes . member states shall provide information on the support for climate change objectives using the methodology adopted by the commission . the commission shall adopt this methodology by means of an implementing act . the implementing act shall be adopted in accordance with the examination procedure referred to in article 143 . ### the member states and the commission shall ensure that environmental protection requirements , resource efficiency , climate change mitigation and adaptation , biodiversity and ecosystem protection , disaster resilience and risk prevention and management are promoted in the preparation and implementation of partnership agreements and programmes . member states shall provide information on the support for climate change objectives using the methodology based on the categories of intervention or measures adopted by the commission . this methodology shall consist of attaching weights to expenditure under the european structural and investment funds at an appropriate level to reflect the contribution to climate change mitigation and adaptation goals . the commission shall lay down uniform conditions on the implementation of this methodology to each of the european structural and investment funds by means of implementing acts . the implementing act shall be adopted in accordance with the examination procedure referred to in article 143 .


### non - transferability of resources the total appropriations allocated to each member state in respect of less developed regions , transition regions and more developed regions shall not be transferable between each of those categories of regions . 2 . by way of derogation from paragraph 1 , the commission may accept , in duly justified circumstances which are linked to the implementation of one or more thematic objectives , a proposal by a member state in its first submission of the partnership contract to transfer up to 2% of the total appropriation for a category of regions to other categories of regions . ### non - transferability of resources the total appropriations allocated to each member state in respect of less developed regions , transition regions and more developed regions shall not be transferable between each of those categories of regions . 2 . by way of derogation from paragraph 1 , the commission may accept , in duly justified circumstances which are linked to the implementation of one or more thematic objectives , a proposal by a member state in its first submission of the partnership agreement to transfer up to 4% of the total appropriation for a category of regions to other categories of regions .


### the audit authority shall draw up : an audit opinion on the annual accounts for the preceding accounting year , whose scope shall cover the completeness , accuracy and veracity of the annual accounts , the functioning of the management and control system and the legality and regularity of the underlying transactions ; an annual control report setting out the findings of the audits carried out during the preceding accounting year . the report under point shall set out any deficiencies found in the management and control system and any corrective measures taken or proposed to be taken . where a common management and control system applies to more than one operational programme , the information required under point may be grouped in a single report . ### the audit authority shall draw up : an audit opinion in accordance with article 59 of the financial regulation ; a control report setting out the main findings , including deficiencies found in the management and control systems , of the audits carried out according to paragraph 116 and the proposed and implemented corrective measures . deleted where a common management and control system applies to more than one operational programme , the information required under point may be grouped in a single report .


### each csf fund shall support the following thematic objectives in accordance with its mission in order to contribute to the union strategy for smart , sustainable and inclusive growth : strengthening research , technological development and innovation ; enhancing access to , and use and quality of , information and communication technologies ; enhancing the competitiveness of small and medium - sized enterprises , the agricultural sector and the fisheries and aquaculture sector ; supporting the shift towards a low - carbon economy in all sectors ; promoting climate change adaptation , risk prevention and management ; protecting the environment and promoting resource efficiency ; promoting sustainable transport and removing bottlenecks in key network infrastructures ; promoting employment and supporting labour mobility ; promoting social inclusion and combating poverty ; investing in education , skills and lifelong learning ; enhancing institutional capacity and an efficient public administration . thematic objectives shall be translated into priorities specific to each csf fund and set out in the fund - specific rules . ### each european structural and investment fund , in order to contribute to the union strategy for smart , sustainable and inclusive growth , including economic , social and territorial cohesion shall support the following thematic objectives . strengthening research , technological development and innovation ; enhancing access to , and use and quality of , information and communication technologies ; enhancing the competitiveness of small and medium - sized enterprises , the agricultural sector and the fisheries and aquaculture sector ; supporting the shift towards a low - carbon economy in all sectors ; promoting climate change adaptation , risk prevention and management ; preserving and protecting the environment , and promoting resource efficiency ; removing bottlenecks in key network infrastructures and filling in missing links ; promoting sustainable and quality employment and supporting labour mobility ; promoting social inclusion , combating poverty and any discrimination ; investing in education , training and vocational training for skills and lifelong learning ; enhancing institutional capacity of public authorities and stakeholders and efficient public administration ; thematic objectives shall be translated into priorities specific to each of the european structural and investment funds and set out in the fund - specific rules .


### the commission shall be empowered to adopt delegated acts in accordance with article 142 to provide for a european code of conduct that lays down objectives and criteria to support the implementation of partnership and to facilitate the sharing of information , experience , results and good practices among member states . ### deleted


### article 174 of the treaty provides that , in order to strengthen its economic , social and territorial cohesion , the union shall aim at reducing disparities between the levels of development of the various regions and the backwardness of the least favoured regions or islands , particular rural areas , areas affected by industrial transition , and regions which suffer from severe and permanent natural or demographic handicaps . article 175 of the treaty requires that the union would support the achievement of these objectives by action it takes through the european agricultural guidance and guarantee fund , guidance section , the european social fund , the european regional development fund , the european investment bank and other instruments . ### article 174 of the treaty provides that , in order to strengthen its economic , social and territorial cohesion , the union shall aim at reducing disparities between the levels of development of the various regions and the backwardness of the least favoured regions . among the regions concerned particular attention shall be paid to rural areas , areas affected by industrial transition , and regions which suffer from severe and permanent natural or demographic handicaps such as the northernmost regions with very low population density and island , cross - border and mountain regions . article 175 of the treaty requires that the union would support the achievement of these objectives by action it takes through the european agricultural guidance and guarantee fund , guidance section , the european social fund , the european regional development fund , the european investment bank and other instruments .


### information to be submitted to the commission the member state or the managing authority shall submit the following information on major projects to the commission as soon as preparatory work has been completed : information on the body to be responsible for implementation of the major project , and its capacity ; a description of and information on the investment and its location ; total cost and total eligible cost , taking account of the requirements set out in article 54 ; information on the feasibility studies carried out , including the options analysis , the results , and independent quality review ; a cost - benefit analysis , including an economic and a financial analysis , and a risk assessment ; an analysis of the environmental impact , taking into account climate change adaptation and mitigation needs , and disaster resilience ; the consistency with the relevant priority axes of the operational programme or programmes concerned , and its expected contribution to achieving the specific objectives of those priority axes ; the financing plan showing the total planned financial resources and the planned support from the funds , the eib , and all other sources of financing , together with physical and financial indicators for monitoring progress , taking account of the identified risks ; the timetable for implementing the major project and , where the implementation period is expected to be longer than the programming period , the phases for which support from the funds is requested during the 2014 to 2020 programming period . the commission shall provide indicative guidance on the methodology to be used in carrying out the cost - benefit analysis referred to in point above in accordance with the advisory procedure referred to in article 143 . the format for the information on major projects to be submitted shall be set up in accordance with the model adopted by the commission , by means of implementing acts . those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 143 . 2 . major projects submitted to the commission for approval shall be contained in the list of major projects in an operational programme . the list shall be reviewed by the member state or the managing authority two years following the adoption of an operational programme and may at the request of the member state be adjusted in accordance with the procedure set out in article 26 , in particular to include major projects with an expected completion date by the end of 2022 . ### information necessary for the approval of major projects before a major project is approved , the managing authority shall ensure that the following information is available : the body responsible for implementation of the major project , and its capacity ; a description of the investment and its location ; total cost and total eligible cost , taking account of the requirements set out in article 54 ; feasibility studies carried out , including the options analysis , and the results ; a cost - benefit analysis , including an economic and a financial analysis , and a risk assessment ; an analysis of the environmental impact , taking into account climate change adaptation and mitigation needs , and disaster resilience ; the consistency with the relevant priority axes of the operational programme or operational programmes concerned , and its expected contribution to achieving the specific objectives of those priority axes and the expected contribution to socio - economic development ; the financing plan showing the total planned financial resources and the planned support from the funds , the eib , and all other sources of financing , together with physical and financial indicators for monitoring progress , taking account of the identified risks ; the timetable for implementing the major project and , where the implementation period is expected to be longer than the programming period , the phases for which support from the funds is requested during the 2014 to 2020 programming period . the commission shall adopt implementing acts establishing the methodology to be used based on recognised best practices , in carrying out the cost - benefit analysis referred to in point , in accordance with the advisory procedure referred to in article 143 . at the initiative of a member state , the information in article 91 to may be assessed by independent experts supported by technical assistance of the commission or , in agreement with the commission , by other independent experts . in other cases , the member state shall submit to the commission the information set out in article 91 to as soon as it is available . the commission shall be empowered to adopt delegated acts , in accordance with article 142 , laying down the methodology to be used in carrying out the quality review of a major project . the commission shall adopt implementing acts establishing the format for submission of the information set out in points to of the first subparagraph . those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 143 . deleted


### the co - financing rate at the level of each priority axis of operational programmes under the investment for growth and jobs goal shall be no higher than : 85 % for the cohesion fund ; 85 % for the less developed regions of member states whose average gdp per capita for the period 2007 to 2009 was below 85 % of the eu - 27 average during the same period and for the outermost regions ; 80% for the less developed regions of member states other than those referred to in point eligible for the transitional regime of the cohesion fund on 1 january 2014 ; 75% for the less developed regions of member states other than those referred to in points and , and for all regions whose gdp per capita for the 2007 - 2013 period was less than 75% of the average of the eu - 25 for the reference period but whose gdp per capita is above 75% of the gdp average of the eu - 27 ; 60 % for the transition regions other than those referred to in point ; 50 % for the more developed regions other than those referred to in point . the co - financing rate at the level of each priority axis of operational programmes under the european territorial cooperation goal shall be no higher than 75% . 4 . the co - financing rate of the additional allocation in accordance with article 84 shall be no higher than 50% . the same co - financing rate shall apply to the additional allocation under article 4 of regulation no [ … ] / 2012 [ etc regulation ] . ### the co - financing rate at the level of each priority axis of operational programmes under the investment for growth and jobs goal shall be no higher than : 85 % for the cohesion fund ; 85 % for the less developed regions of member states , for the outermost regions including additional funding and for member states consisting of one single nuts level 2 region eligible for the transitional regime of the cohesion fund on 1 january 2014 ; 80 % for the transition regions and for regions which were eligible for funding under transitional support pursuant to article 8 of regulation no 1083 / 2006 ; deleted deleted 50 % for the more developed regions other than those referred to in point . the co - financing rate at the level of each priority axis of operational programmes under the european territorial cooperation goal shall be no higher than 85% . 4 . the co - financing rate of the additional allocation for nuts level 2 regions fulfilling the criteria laid down in article 2 of protocol no 6 to the treaty of accession of austria , finland and sweden will be not higher than 50% . deleted


### the co - financing rate of the additional allocation in accordance with article 84 shall be no higher than 50% . the same co - financing rate shall apply to the additional allocation under article 4 of regulation no [ … ] / 2012 [ etc regulation ] . ### deleted deleted


### each of the funds may finance technical assistance operations eligible under any of the other funds . the amount of the funds allocated to technical assistance shall be limited to 4% of the total amount of the funds allocated to operational programmes under each category of region of the investment for growth and jobs goal . 2 . technical assistance shall take the form of a mono - fund priority axis within an operational programme or of a specific operational programme . 3 . the allocation for technical assistance from a fund shall not exceed 10% of the total allocation of that fund to operational programmes in a member state under each category of region of the investment for growth and jobs goal . ### the amount of the funds allocated to technical assistance shall be limited to 4% of the total amount of the funds allocated to operational programmes in a member state under each category of region of the investment for growth and jobs goal , and 4% of the cohesion fund allocated to operational programmes in a member state . 1a . without prejudice to the provisions of paragraph 1 , each fund may support technical assistance operations eligible under any of the other funds . the allocation for technical assistance from the erdf and the esf respectively shall not exceed 10% of the total allocation of each fund to operational programmes in a member state under each category of region of the investment for growth and jobs goal . 1b . by derogation from article 60 and , technical assistance operations may be implemented outside the programme area , but within the union , provided that the operations are for the benefit of the operational programme , or , in the case of a technical assistance operational programme for the other programmes concerned . 1c . where the funds are used to support technical assistance operations relating to more than one category of region , for the purposes of attributing the costs of the operations to technical assistance allocations for different categories of regions , a pro rata basis may be applied taking into account the allocation under each category of region as a share of the total allocation to the member state . 1d . by way of derogation from paragraph 1 , when the total amount of the funds allocated to a member state under the investment for growth and jobs goal is up to eur 1 billion , the percentage referred to in paragraph 1 shall be 6% but the total amount allocated to technical assistance shall not exceed eur 50 000 000 whichever is the lower . 2 . technical assistance shall take the form of a mono - fund priority axis within an operational programme or of a specific operational programme , or both . deleted


### enhancing institutional capacity and an efficient public administration . ### enhancing institutional capacity and efficient public administration and promoting capacity building for stakeholders .


### method for establishing the performance framework the performance framework shall consist of milestones established for each priority for the years 2016 and 2018 and targets established for 2022 . the milestones and targets shall be presented in accordance with the format set out in table 1 . 2 . milestones are intermediate targets for the achievement of the specific objective of a priority , expressing the intended progress towards the targets set for the end of the period . milestones established for 2016 shall include financial indicators and output indicators . milestones established for 2018 shall include financial indicators , output indicators and where appropriate , result indicators . milestones may also be established for key implementation steps . 3 . milestones shall be : – relevant , capturing essential information on the progress of a priority ; – transparent , with objectively verifiable targets and the source data identified and publicly available ; – verifiable , without imposing a disproportionate administrative burden ; – consistent across operational programmes , where appropriate . ### method for establishing the performance framework the performance framework shall consist of milestones established for each priority for the year 2018 and targets established for 2022 . the milestones and targets shall be presented in accordance with the format set out in table 1 . 2 . milestones are intermediate targets , directly linked to the achievement of the specific objective of a priority , expressing the intended progress towards the targets set for the end of the period . milestones established for 2018 shall include financial indicators , output indicators and where appropriate , result indicators , which are closely linked to the supported policy interventions . result indicators shall not be taken into account for the purposes of article 20 and article 20 . milestones may also be established for key implementation steps . 3 . milestones and targets shall be – realistic , achievable , relevant , capturing essential information on the progress of a priority ; – consistent with the nature and character of the specific objectives of the priority ; – transparent , with objectively verifiable targets and the source data identified and , where possible , publicly available ; – verifiable , without imposing a disproportionate administrative burden ; – consistent across operational programmes , where appropriate . 3 a . in duly justified cases , such as a significant change in the economic , environmental and labour market conditions in a member state or region , and in addition to amendments resulting from changes in allocations for a given priority , the member state may propose the revision of milestones and targets in accordance with article 26 of this regulation .


### to ensure the availability of essential and up to date information on programme implementation , it is necessary that member states provide the commission with the key data on a regular basis . in order to avoid an additional burden on member states , this should be limited to data collected continuously , and the transmission should be performed by way of electronic data exchange . ### to ensure the availability of essential and up to date information on programme implementation , it is necessary that member states provide the commission with the key data on a regular basis . in order to avoid an additional burden on member states , this should be limited to data collected continuously , and the transmission should be performed by way of electronic data exchange . insofar as these transfers include personal data , the provisions of directive 95 / 46 / ec and of regulation 45 / 2001 should apply .


### reimbursement of management costs incurred and payment of management fees of the financial instrument . ### reimbursement of management costs incurred and payment of management fees of the financial instruments and additionally reimbursement of refinancing costs of the national cofinancing element where this is provided by a financial institution within the meaning of article&#160 ; 33 and .


### the entities referred to in paragraph 4 to which implementation tasks have been entrusted shall open fiduciary accounts in their name and on behalf of the managing authority . the assets held on such fiduciary accounts shall be managed in accordance with the principle of sound financial management following appropriate prudential rules and shall have appropriate liquidity . ### the bodies referred to in paragraph 4 to which implementation tasks have been entrusted shall open fiduciary accounts in their name and on behalf of the managing authority , or set up the financial instrument as a separate block of finance within a financial institution . in case of a separate block of finance , separate accounting shall distinguish programme resources invested in the financial instrument from the other resources available in the financial institution . the assets held on fiduciary accounts and such separate blocks of finance shall be managed in accordance with the principle of sound financial management following appropriate prudential rules and shall have appropriate liquidity .


### preferential remuneration of investors operating under the market economy investor principle , who provide counterpart resources to the support from the csf funds to the financial instrument or who co - invest at the level of final recipients ; ### where applicable , preferential remuneration of private investors , or public investors operating under the market economy principle , who provide counterpart resources to the support from the european structural and investment funds to the financial instrument or who co - invest at the level of final recipients ; the need and the level for preferential remuneration pursuant to paragraph shall be established in the ex ante assessment . the preferential remuneration shall not exceed what is necessary to create the incentives for attracting private counterpart resources and shall not over compensate private investors , or public investors operating under the market economy principle . the alignment of interest shall be ensured through an appropriate sharing of risk and profit and must be carried out on a normal commercial basis and be compatible with eu state aid rules .


### allocation of performance reserve where the review of performance undertaken in 2017 reveals that a priority within a programme has not attained its milestones set for the year 2016 , the commission shall make recommendations to the member state concerned . 2 . on the basis of the review undertaken in 2019 , the commission shall adopt a decision , by means of implementing acts , to determine for each csf fund and member state the programmes and priorities which have attained their milestones . the member state shall propose the attribution of the performance reserve for the programmes and priorities set out in that commission decision . the commission shall approve the amendment of the programmes concerned in accordance with article 26 . where a member state fails to submit the information in accordance with article 46 and , the performance reserve for the programmes or the priorities concerned shall not be allocated . 3 . where there is evidence resulting from a performance review that a priority has failed to achieve the milestones set out in the performance framework , the commission may suspend all or part of an interim payment of a priority of a programme in accordance with the procedure laid down in fund - specific rules . 4 . where the commission , based on the examination of the final implementation report of the programme , establishes a serious failure to achieve the targets set out in the performance framework , it may apply financial corrections in respect of the priorities concerned in accordance with fund - specific rules . the commission shall be empowered to adopt delegated acts in accordance with article 142 to establish criteria and the methodology for determining the level of financial correction to be applied . 5 . paragraph 2 shall not apply to programmes under the european territorial cooperation goal and to title v of the emff regulation . ### application of the performance framework deleted 2 . on the basis of the review undertaken in 2019 , the commission shall adopt a decision , by means of implementing acts , to determine for each european structural and investment fund and member state the programmes and priorities which have attained their milestones . 3 . where there is evidence , resulting from a performance review , that there has been a serious failure with regards to a priority achieving the milestones relating only to financial and output indicators and key implementation steps set out in the performance framework and that that failure is due to clearly identified implementation weaknesses , which the commission has previously communicated pursuant to article 44 following close consultations with the member state concerned , and that member state has failed to take the necessary corrective action to address such weaknesses , the commission may , not earlier than&#160 ; four &#160 ; months of such communication , suspend all or part of an interim payment of a priority of a programme in accordance with the procedure laid down in fund - specific rules . the commission shall without delay lift the suspension of interim payments when the member state has taken the necessary corrective action . where the corrective action concerns the transfer of financial allocations to other programmes or priorities , which have attained their milestones , the commission shall approve , by means of an implementing act , the necessary amendment of the programmes concerned in accordance with article 26 . by way of derogation , in such case the commission shall decide on the amendment no later than two months of the submission of the member state request . 4 . where the commission , based on the examination of the final implementation report of the programme , establishes a serious failure to achieve the targets relating only to financial indicators , output indicators and key implementation steps set out in the performance framework due to clearly identified implementation weaknesses , which the commission has previously communicated pursuant to article 44 following close consultations with the member state concerned , and the member state has failed to take the necessary corrective action to address such weaknesses , the commission may notwithstanding article 77 apply financial corrections in respect of the priorities concerned in accordance with fund - specific rules . when applying financial corrections , the commission shall take into account - with due respect to the principle of proportionality - the absorption level , and external factors contributing to the failure . financial corrections shall not be applied where the failure to achieve targets is because of the impact of socio - economic or environmental factors , significant changes in the economic or environmental conditions in a member state or because of reasons of force majeure seriously affecting implementation of the priorities concerned . the commission shall be empowered to adopt delegated acts in accordance with article 142 to establish detailed rules on criteria for determining the level of financial correction to be applied . 5 . paragraph 2 shall not apply to programmes under the european territorial cooperation goal and to title v of the emff regulation .


### by 30 april 2016 and by 30 april of each subsequent year until and including 2022 the member state shall submit to the commission an annual report in accordance with article 44 . the report submitted in 2016 shall cover the financial years 2014 and 2015 , as well as the period between the starting date for eligibility of expenditure and 31 december 2013 . 2 . annual implementation reports shall set out information on : implementation of the operational programme in accordance with article 44 ; progress in preparation and implementation of major projects and joint action plans . 3 . the annual implementation reports submitted in 2017 and 2019 shall set out and assess the information required under articles 44 and respectively , the information set out in paragraph 2 , together with : progress in implementation of the integrated approach to territorial development , including sustainable urban development , and community - led local development under the operational programme ; progress in implementation of actions to reinforce the capacity of member state authorities and beneficiaries to administer and use the funds ; progress in implementation of any interregional and transnational actions ; progress in implementation of the evaluation plan and the follow - up given to the findings of evaluations ; the specific actions taken to promote equality between men and women and to prevent discrimination , including accessibility for disabled persons , and the arrangements implemented to ensure the integration of the gender perspective in the operational programme and operations ; actions taken to promote sustainable development in accordance with article 8 ; the results of the information and publicity measures of the funds carried out under the communication strategy ; progress in the implementation of actions in the field of social innovation , where appropriate ; progress in the implementation of measures to address the specific needs of geographical areas most affected by poverty or of target groups at highest risk of discrimination or exclusion , with special regard to marginalised communities including , where appropriate , the financial resources used ; the involvement of the partners in the implementation , monitoring and evaluation of the operational programme . 4 . the annual and final implementation reports shall be drawn up following models adopted by the commission by means of implementing acts . these implementing acts shall be adopted in accordance with the advisory procedure referred to in article 143 . ### by 31 may 2016 and by 31 may of each subsequent year until and including 2022 the member state shall submit to the commission an annual implementation report in accordance with article 44 . the report submitted in 2016 shall cover the financial years 2014 and 2015 , as well as the period between the starting date for eligibility of expenditure and 31 december 2013 . 1a . for the reports submitted in 2017 and 2019 , the deadline referred to in paragraph 1 shall be 30 june . 2 . annual implementation reports shall set out information on : implementation of the operational programme in accordance with article 44 ; progress in preparation and implementation of major projects and joint action plans . 3 . the annual implementation reports submitted in 2017 and 2019 shall set out and assess the information required under articles 44 and respectively , the information set out in paragraph 2 together with information on the elements set out under , and below and may dependent on the content and objectives of operational programmes and information on the other elements : progress in implementation of the integrated approach to territorial development , including development of regions facing demographic challenges and permanent or natural handicaps , sustainable urban development , and community - led local development under the operational programme ; progress in implementation of actions to reinforce the capacity of member state authorities and beneficiaries to administer and use the funds ; progress in implementation of any interregional and transnational actions ; where appropriate , contribution to macro - regional and sea basin strategies ; progress in implementation of the evaluation plan and the follow - up given to the findings of evaluations ; the specific actions taken to promote equality between men and women and to prevent discrimination , in particular accessibility for disabled persons , and the arrangements implemented to ensure the integration of the gender perspective in the operational programme and operations ; actions taken to promote sustainable development in accordance with article 8 ; the results of the information and publicity measures of the funds carried out under the communication strategy ; progress in the implementation of actions in the field of social innovation , where appropriate ; progress in the implementation of measures to address the specific needs of geographical areas most affected by poverty or of target groups at highest risk of poverty , discrimination or social exclusion , with special regard to marginalised communities and persons with disabilities , long term unemployed and young people not in employment including , where appropriate , the financial resources used . the involvement of the partners in the implementation , monitoring and evaluation of the operational programme . by derogation , and in order to ensure consistency between the partnership agreement and the progress report , the member states with no more than one operational programme per fund may include information related to ex ante conditionalities referred to in article 44 , the information required by article 44 and the information referred to in points , , and of this paragraph in the progress report instead of the annual implementation reports submitted in 2017 and 2019 respectively and the final report respectively , without prejudice to article 100 . 4 . the annual and final implementation reports shall be drawn up following models adopted by the commission by means of implementing acts . these implementing acts shall be adopted in accordance with the advisory procedure referred to in article 143 .


### technical assistance of the member states each of the funds may finance technical assistance operations eligible under any of the other funds . the amount of the funds allocated to technical assistance shall be limited to 4% of the total amount of the funds allocated to operational programmes under each category of region of the investment for growth and jobs goal . 2 . technical assistance shall take the form of a mono - fund priority axis within an operational programme or of a specific operational programme . 3 . the allocation for technical assistance from a fund shall not exceed 10% of the total allocation of that fund to operational programmes in a member state under each category of region of the investment for growth and jobs goal . ### technical assistance of the member states the amount of the funds allocated to technical assistance shall be limited to 4% of the total amount of the funds allocated to operational programmes in a member state under each category of region , where applicable , of the investment for growth and jobs goal . 1a . each fund may support technical assistance operations eligible under any of the other funds . without prejudice to the provisions of paragraph 1 , the allocation for technical assistance from a fund shall not exceed 10% of the total allocation of that fund to operational programmes in a member state under each category of region , where applicable , of the investment for growth and jobs goal . 1b . by derogation from article 60 and , technical assistance operations may be implemented outside the programme area , but within the union , provided that the operations are for the benefit of the operational programme , or , in the case of a technical assistance operational programme for the other programmes concerned . 1c . where the structural funds allocations referred to in paragraph 1 are used to support technical assistance operations relating to more than one category of region , the expenditure relating to the operations may be implemented under a priority axis combining different categories of region and attributed on a pro rata basis taking into account the allocation under each category of region as a share of the total allocation to the member state . 1d . by way of derogation from paragraph 1 , when the total amount of the funds allocated to a member state under the investment for growth and jobs goal is up to eur 1 billion , the amount allocated to technical assistance may increase up to the lower of 6% or eur 50 000 000 . 2 . technical assistance shall take the form of a mono - fund priority axis within an operational programme or of a specific operational programme , or both . deleted


### the member states and the commission shall ensure that environmental protection requirements , resource efficiency , climate change mitigation and adaptation , disaster resilience and risk prevention and management are promoted in the preparation and implementation of partnership contracts and programmes . member states shall provide information on the support for climate change objectives using the methodology adopted by the commission . the commission shall adopt this methodology by means of an implementing act . the implementing act shall be adopted in accordance with the examination procedure referred to in article 143 . ### the member states and the commission shall ensure that environmental protection requirements , resource efficiency , climate change mitigation and adaptation , biodiversity and ecosystem protection , disaster resilience and risk prevention and management are promoted in the preparation and implementation of partnership agreements and programmes . member states shall provide information on the support for climate change objectives using the methodology based on the categories of intervention or measures adopted by the commission . this methodology shall consist of attaching weights to expenditure under the european structural and investment funds at an appropriate level to reflect the contribution to climate change mitigation and adaptation goals . the commission shall lay down uniform conditions on the implementation of this methodology to each of the european structural and investment funds by means of implementing acts . the implementing act shall be adopted in accordance with the examination procedure referred to in article 143 .


### financial instruments the csf funds may be used to support financial instruments under a programme , including when organised through funds of funds , in order to contribute to the achievement of specific objectives set out under a priority , based on an ex ante assessment which has identified market failures or sub - optimal investment situations , and investment needs . financial instruments may be combined with grants , interest rate subsidies and guarantee fee subsidies . in this case , separate records must be maintained for each form of financing . the commission shall be empowered to adopt delegated acts in accordance with article 142 laying down detailed rules concerning the ex ante assessment of financial instruments , the combination of support provided to final recipients through grants , interest rate subsidies , guarantee fee subsidies and financial instruments , additional specific rules on eligibility of expenditure and rules specifying the types of activities which shall not be supported through financial instruments . ### financial instruments the european structural and investment funds may be used to support financial instruments under one or more programmes , including when organised through funds of funds , in order to contribute to the achievement of specific objectives set out under a priority . financial instruments shall be implemented to support investments which are expected to be financially viable and do not give rise to sufficient funding from market sources . when applying this title , the managing authority , the fund of funds , and the bodies implementing the financial instrument shall comply with applicable union and national law , in particular on state aid and public procurement . deleted


### it is necessary to evaluate the effectiveness , efficiency and impact of assistance from the csf funds in order to improve the quality of implementation and design of programmes , and to determine the impact of programmes in relation to the targets for the union strategy for smart sustainable and inclusive growth and in relation to gdp and unemployment , where relevant . the responsibilities of member states and the commission in this regard should be specified . ### it is necessary to evaluate the effectiveness , efficiency and impact of assistance from the european structural and investment funds in order to improve the quality of implementation and design of programmes , and to determine the impact of programmes in relation to the targets for the union strategy for smart sustainable and inclusive growth and in relation to gdp , regional and local needs , climate targets and unemployment and gender mainstreaming where relevant . the responsibilities of member states and the commission in this regard should be specified .


### without prejudice to the possibility for the cooperation network to have informal international cooperation , the union may conclude international agreements with third countries or international organisations allowing and organizing their participation in some activities of the cooperation network . such agreement shall take into account the need to ensure adequate protection of the personal data circulating on the cooperation network . ### without prejudice to the possibility for the cooperation network to have informal international cooperation , the union may conclude international agreements with third countries or international organisations allowing and organizing their participation in some activities of the cooperation network . such agreement shall take into account the need to ensure adequate protection of the personal data circulating on the cooperation network . on international level the union shall aim at influencing the social networking service providers so that finding adequate security arrangements is not left to the user but automatically maximum security and encryption of messages is provided , after which the user may consciously allow the security settings to be adjusted leaner for specific purposes .


### member states shall ensure that the competent authorities receive the notifications of incidents from public administrations and market operators as specified under article 14 and are granted the implementation and enforcement powers referred to under article 15 . ### member states shall ensure that the competent authorities and single points of contact , where applicable according to paragraph 2a of this article , receive the notifications of incidents from market operators as specified under article 14 and are granted the implementation and enforcement powers referred to under article 15 .


### competent authorities should pay due attention to preserving informal and trusted channels of information - sharing between market operators and between the public and the private sectors . publicity of incidents reported to the competent authorities should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the public administrations and market operators reporting incidents . in the implementation of the notification obligations , competent authorities should pay particular attention to the need to maintain information about product vulnerabilities strictly confidential prior to the release of appropriate security fixes . ### competent authorities and single points of contact should pay due attention to preserving informal and trusted channels of information - sharing between market operators and between the public and the private sectors . publicity of incidents reported to the competent authorities and single points of contact should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the market operators reporting incidents . in the implementation of the notification obligations , competent authorities and single points of contact should pay particular attention to the need to maintain information about product vulnerabilities strictly confidential prior to the release of appropriate security fixes . as a general rule , single points of contact should not disclose personal data of individuals involved in incidents . single points of contact should only disclose personal data where the disclosure of such data is necessary and proportionate in view of the objective pursued .


### competent authorities should pay due attention to preserving informal and trusted channels of information - sharing between market operators and between the public and the private sectors . publicity of incidents reported to the competent authorities should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the public administrations and market operators reporting incidents . in the implementation of the notification obligations , competent authorities should pay particular attention to the need to maintain information about product vulnerabilities strictly confidential prior to the release of appropriate security fixes . ### competent authorities and single points of contact should pay due attention to preserving informal and trusted channels of information - sharing between market operators and between the public and the private sectors . previously unknown vulnerabilities or incidents reported to competent authorities should be notified to the manufacturers and service providers of affected ict products and services . publicity of incidents reported to the competent authorities and single points of contact should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the market operators reporting incidents . in order to safeguard trust and efficiency , publicity of incidents shall only take place after consultation with those who reported the incident and only when strictly necessary for achieving the objectives of this directive . in the implementation of the notification obligations , competent authorities and single points of contact should pay particular attention to the need to maintain information about product vulnerabilities strictly confidential prior to the deployment of appropriate security fixes though not delay any notification more than compulsorily required . as a general rule , single points of contact should not disclose personal data of individuals involved in incidents . single points of contact should only disclose personal data where the disclosure of such data is necessary and proportionate in view of the objective pursued .


### responsibilities in ensuring nis lie to a great extent on public administrations and market operators . a culture of risk management , involving risk assessment and the implementation of security measures appropriate to the risks faced should be promoted and developed through appropriate regulatory requirements and voluntary industry practices . establishing a level playing field is also essential to the effective functioning of the cooperation network to ensure effective cooperation from all member states . ### responsibilities in ensuring nis lie to a great extent on market operators . a culture of risk management , involving risk assessment and the implementation of security measures appropriate to the risks faced should be promoted and developed through appropriate regulatory requirements and voluntary industry practices . establishing a level playing field is also essential to the effective functioning of the cooperation network to ensure effective cooperation from all member states .


### where the risk or incident subject to an early warning is of a suspected criminal nature , the competent authorities or the commission shall inform the european cybercrime centre within europol . ### where the risk or incident subject to an early warning is of a suspected serious criminal nature and where the concerned market operator has reported incidents of a suspected serious criminal nature as referred to in article 15 , the member states shall ensure that the european cybercrime centre within europol is informed , where appropriate .


### the competent authorities and the commission shall form a network to cooperate against risks and incidents affecting network and information systems . ### the single points of contact and the commission shall form a network to cooperate against risks and incidents affecting network and information systems .


### each member state shall designate a national competent authority on the security of network and information systems . ### each member state shall designate one or more national competent authorities on the security of network and information systems .


### criminal activities are in many cases underlying an incident . the criminal nature of incidents can be suspected even if the evidence to support it may not be sufficiently clear from the start . in this context , appropriate co - operation between competent authorities and law enforcement authorities should form part of an effective and comprehensive response to the threat of security incidents . in particular , promoting a safe , secure and more resilient environment requires a systematic reporting of incidents of a suspected serious criminal nature to law enforcement authorities . the serious criminal nature of incidents should be assessed in the light of eu laws on cybercrime . ### criminal or cyberwar activities are in many cases underlying an incident . the criminal nature of incidents can be suspected even if the evidence to support it may not be sufficiently clear from the start . in this context , appropriate co - operation between competent authorities , single points of contact and law enforcement authorities as well as cooperation with the ec3 and enisa should form part of an effective and comprehensive response to the threat of security incidents . in particular , promoting a safe , secure and more resilient environment requires a systematic reporting of incidents of a suspected serious criminal nature to law enforcement authorities . the serious criminal nature of incidents should be assessed in the light of eu laws on cybercrime .


### member states shall ensure that the competent authorities receive the notifications of incidents from public administrations and market operators as specified under article 14 and are granted the implementation and enforcement powers referred to under article 15 . ### member states shall ensure that the competent authorities and single points of contact receive the notifications of incidents from market operators as specified under article 14 and are granted the implementation and enforcement powers referred to under article 15 .


### upon receipt of an early warning and its assessment , the competent authorities should agree on a coordinated response under the union nis cooperation plan . competent authorities as well as the commission should be informed about the measures adopted at national level as a result of the coordinated response . ### upon receipt of an early warning and its assessment , the single points of contact should agree on a coordinated response under the union nis cooperation plan . the single points of contact as well as the commission should be informed about the measures adopted at national level as a result of the coordinated response .


### each member state shall set up a computer emergency response team responsible for handling incidents and risks according to a well - defined process , which shall comply with the requirements set out in point of annex i . a cert may be established within the competent authority . ### each member state shall set up at least one computer emergency response team responsible for handling incidents and risks according to a well - defined process , which shall comply with the requirements set out in point of annex i . a cert may be established within the competent authority .


### the cooperation network shall bring into permanent communication the commission and the competent authorities . when requested , the european network and information security agency shall assist the cooperation network by providing its expertise and advice . ### the cooperation network shall bring into permanent communication the commission and the single points of contact . when requested , the european network and information security agency shall assist the cooperation network by providing its expertise and advice . where appropriate , market operators may also be invited to participate in the activities of the cooperation network referred to in points , and of paragraph 3 .


### to ensure transparency and properly inform eu citizens and market operators , the competent authorities should set up a common website to publish non confidential information on the incidents and risks . ### to ensure transparency and properly inform eu citizens and market operators , the single points of contact should set up a common union - wide website to publish non confidential information on the incidents and risks .


### operator of critical infrastructure that are essential for the maintenance of vital economic and societal activities in the fields of energy , transport , banking , stock exchanges and health , a non exhaustive list of which is set out in annex ii . ### operator of infrastructure that are essential for the maintenance of vital economic and societal activities in the fields of energy , transport , banking , financial market infrastructures and health , and the disruption or destruction of which would have a significant impact in a member state as a result of the failure to maintain those functions , a non exhaustive list of which is set out in annex ii .


### personal data are in many cases compromised as a result of incidents . in this context , competent authorities and data protection authorities should cooperate and exchange information on all relevant matters to tackle the personal data breaches resulting from incidents . member states shall implement the obligation to notify security incidents in a way that minimises the administrative burden in case the security incident is also a personal data breach in line with the regulation of the european parliament and of the council on the protection of individuals with regard to the processing of personal data and on the free movement of such data . liaising with the competent authorities and the data protection authorities , enisa could assist by developing information exchange mechanisms and templates avoiding the need for two notification templates . this single notification template would facilitate the reporting of incidents compromising personal data thereby easing the administrative burden on businesses and public administrations . ### personal data are in many cases compromised as a result of incidents . in this context , competent authorities , single points of contact and data protection authorities should cooperate and exchange information on all relevant matters to tackle the personal data breaches resulting from incidents . the obligation to notify security incidents should be carried out in a way that minimises the administrative burden in case the security incident is also a personal data breach that requires to be notified in accordance with regulation 2013 / xx / eu of the european parliament and of the council1 . enisa should assist by developing information exchange mechanisms and a single notification template that would facilitate the reporting of incidents compromising personal data thereby easing the administrative burden on businesses and public administrations . __________________ 1 regulation xxx of the european parliament and of the council on the protection of individuals with regard to the processing of personal data and on the free movement of such data .


### establishes security requirements for market operators and public administrations . ### establishes security requirements for market operators .


### member states shall ensure that the competent authorities have adequate technical , financial and human resources to carry out in an effective and efficient manner the tasks assigned to them and thereby to fulfil the objectives of this directive . member states shall ensure the effective , efficient and secure cooperation of the competent authorities via the network referred to in article 8 . ### member states shall ensure that the competent authorities and the single points of contact have adequate technical , financial and human resources to carry out in an effective and efficient manner the tasks assigned to them and thereby to fulfil the objectives of this directive . member states shall ensure the effective , efficient and secure cooperation of the single points of contact via the network referred to in article 8 .


### member states shall ensure that the competent authorities have all the powers necessary to investigate cases of non - compliance of public administrations or market operators with their obligations under article 14 and the effects thereof on the security of networks and information systems . ### member states shall ensure that the competent authorities and the single points of contact have the powers necessary to examine cases of non - compliance of market operators with their obligations under article 14 and the effects thereof on the security of networks and information systems .


### undergo a security audit carried out by a qualified independent body or national authority and make the results thereof available to the competent authority . ### provide evidence of effective implementation of security policies , such as the results of a security audit carried out by a qualified independent body or national authority , and make the evidence available to the competent authority or to the single point of contact .


### undergo a security audit carried out by a qualified independent body or national authority and make the results thereof available to the competent authority . ### provide evidence of effective implementation of security policies , such as results of a security audit carried out by internal auditors , a qualified independent body or national authority , and make the evidence available to the competent authority or to the single point of contact . where necessary , the competent authority or the single point of contact may require additional evidence or carry out an additional audit .


### personal data are in many cases compromised as a result of incidents . in this context , competent authorities and data protection authorities should cooperate and exchange information on all relevant matters to tackle the personal data breaches resulting from incidents . member states shall implement the obligation to notify security incidents in a way that minimises the administrative burden in case the security incident is also a personal data breach in line with the regulation of the european parliament and of the council on the protection of individuals with regard to the processing of personal data and on the free movement of such data28 . liaising with the competent authorities and the data protection authorities , enisa could assist by developing information exchange mechanisms and templates avoiding the need for two notification templates . this single notification template would facilitate the reporting of incidents compromising personal data thereby easing the administrative burden on businesses and public administrations . __________________ 28 sec 72 final ### personal data are in many cases compromised as a result of incidents . member states and market operators should protect personal data stored , processed or transmitted against accidental or unlawful destruction , accidental loss or alteration , and unauthorised or unlawful storage , access or disclosure , dissemination , or access ; and ensure the implementation of a security policy with respect to the processing of personal data . in this context , competent authorities , single points of contact and data protection authorities should cooperate and exchange information on all relevant matters to tackle the personal data breaches resulting from incidents . the obligation to notify security incidents should be carried out in a way that minimises the administrative burden in case the security incident is also a personal data breach that is required to be notified in accordance with applicable law . enisa should assist by developing information exchange mechanisms and a single notification template that would facilitate the reporting of incidents compromising personal data thereby easing the administrative burden on businesses and public administrations .


### each member state shall set up a computer emergency response team responsible for handling incidents and risks according to a well - defined process , which shall comply with the requirements set out in point of annex i . a cert may be established within the competent authority . ### each member state shall set up at least one computer emergency response team for each of the sectors established in annex ii , responsible for handling incidents and risks according to a well - defined process , which shall comply with the requirements set out in point of annex i . a cert may be established within the competent authority .


### each member state shall notify to the commission without delay the designation of the competent authority , its tasks , and any subsequent change thereto . each member state shall make public its designation of the competent authority . ### each member state shall notify to the commission without delay the designation of the competent authorities and the single point of contact , its tasks , and any subsequent change thereto . each member state shall make public its designation of the competent authorities .


### criminal activities are in many cases underlying an incident . the criminal nature of incidents can be suspected even if the evidence to support it may not be sufficiently clear from the start . in this context , appropriate co - operation between competent authorities and law enforcement authorities should form part of an effective and comprehensive response to the threat of security incidents . in particular , promoting a safe , secure and more resilient environment requires a systematic reporting of incidents of a suspected serious criminal nature to law enforcement authorities . the serious criminal nature of incidents should be assessed in the light of eu laws on cybercrime . ### criminal activities are in many cases underlying an incident . the criminal nature of incidents can be suspected even if the evidence to support it may not be sufficiently clear from the start . in this context , appropriate co - operation between competent authorities , single points of contact and law enforcement authorities should form part of an effective and comprehensive response to the threat of security incidents . in particular , promoting a safe , secure and more resilient environment requires a systematic reporting of incidents of a suspected serious criminal nature to law enforcement authorities . the serious criminal nature of incidents should be assessed in the light of eu laws on cybercrime .


### the competent authorities shall work in close cooperation with personal data protection authorities when addressing incidents resulting in personal data breaches . ### the competent authorities and the single points of contact shall work in close cooperation with personal data protection authorities when addressing incidents resulting in personal data breaches . the single points of contact and the data protection authorities shall develop , in cooperation with enisa , information exchange mechanisms and a single template to be used both for notifications under article 14 of this directive and regulation [ xxx ] of the european parliament and of the council on the protection of individuals with regard to the processing of personal data and on the free movement of such data .


### upon receipt of an early warning and its assessment , the competent authorities should agree on a coordinated response under the union nis cooperation plan . competent authorities as well as the commission should be informed about the measures adopted at national level as a result of the coordinated response . ### upon receipt of an early warning and its assessment , the single points of contact should agree on a coordinated response under the union nis cooperation plan . the single points of contact , enisa as well as the commission should be informed about the measures adopted at national level as a result of the coordinated response .


### the definition of the roles and responsibilities of the various actors involved in the implementation of the plan ; ### the definition of the roles and responsibilities of the various authorities and other actors involved in the implementation of the framework ;


### the commission shall periodically review the functioning of this directive and report to the european parliament and the council . the first report shall be submitted no later than three years after the date of transposition referred to in article 21 . for this purpose , the commission may request member states to provide information without undue delay . ### the commission shall periodically review the functioning of this directive and report to the european parliament and the council . the first report shall be submitted no later than two years after the date of transposition referred to in article 21 . for this purpose , the commission may request member states to provide information without undue delay .


### the competent authority may inform the public , or require the public administrations and market operators to do so , where it determines that disclosure of the incident is in the public interest . once a year , the competent authority shall submit a summary report to the cooperation network on the notifications received and the action taken in accordance with this paragraph . ### after consultation with the competent authority and the market operator concerned , the single point of contact may inform the public about individual incidents , where public awareness is necessary to prevent an incident or deal with an ongoing incident , or where the market operator , subject to an incident , has refused to address a serious structural vulnerability related to that incident without undue delay . once a year , the single point of contact shall submit a summary report to the cooperation network on the notifications received and the action taken in accordance with this paragraph .


### the competent authorities or the commission shall provide early warnings within the cooperation network on those risks and incidents that fulfil at least one of the following conditions : ### the single points of contact or the commission shall provide early warnings within the cooperation network on those risks and incidents that fulfil at least one of the following conditions :


### those obligations should be extended beyond the electronic communications sector to key providers of information society services , as defined in directive 98 / 34 / ec of the european parliament and of the council of 22 june 1998 laying down a procedure for the provision of information in the field of technical standards and regulations and of rules on information society services27 , which underpin downstream information society services or on - line activities , such as e - commerce platforms , internet payment gateways , social networks , search engines , cloud computing services , application stores . disruption of these enabling information society services prevents the provision of other information society services which rely on them as key inputs . software developers and hardware manufacturers are not providers of information society services and are therefore excluded . those obligations should also be extended to public administrations , and operators of critical infrastructure which rely heavily on information and communications technology and are essential to the maintenance of vital economical or societal functions such as electricity and gas , transport , credit institutions , stock exchange and health . disruption of those network and information systems would affect the internal market . __________________ 27 oj l 204 , 21 . 7 . 1998 , p . 37 . ### those obligations should be extended beyond the electronic communications sector to operators of infrastructure which rely heavily on information and communications technology and are essential to the maintenance of vital economical or societal functions such as electricity and gas , transport , credit institutions , financial market infrastructures and health . disruption of those network and information systems would affect the internal market . while the obligations set out in this directive do not extend to key providers of information society services , as defined in directive 98 / 34 / ec of the european parliament and of the council of 22 june 1998 laying down a procedure for the provision of information in the field of technical standards and regulations and of rules on information society services27 , which underpin downstream information society services or on - line activities , such as e - commerce platforms , internet payment gateways , social networks , search engines , cloud computing services in general or application stores , these may , on a voluntary basis , inform the competent authority or single point of contact of those network security incidents they deem appropriate , and the competent authority or the single point of contact should , if reasonably possible , present the market operators that informed of the incident with strategically analysed information that will help overcome the security threat . __________________ 27 oj l 204 , 21 . 7 . 1998 , p . 37 .


### competent authorities should have the necessary means to perform their duties , including powers to obtain sufficient information from market operators and public administrations in order to assess the level of security of network and information systems as well as reliable and comprehensive data about actual incidents that have had an impact on the operation of network and information systems . ### competent authorities and single points of contact should have the necessary means to perform their duties , including powers to obtain sufficient information from market operators in order to assess the level of security of network and information systems as well as reliable and comprehensive data about actual incidents that have had an impact on the operation of network and information systems .


### personal data are in many cases compromised as a result of incidents . in this context , competent authorities and data protection authorities should cooperate and exchange information on all relevant matters to tackle the personal data breaches resulting from incidents . member states shall implement the obligation to notify security incidents in a way that minimises the administrative burden in case the security incident is also a personal data breach in line with the regulation of the european parliament and of the council on the protection of individuals with regard to the processing of personal data and on the free movement of such data . liaising with the competent authorities and the data protection authorities , enisa could assist by developing information exchange mechanisms and templates avoiding the need for two notification templates . this single notification template would facilitate the reporting of incidents compromising personal data thereby easing the administrative burden on businesses and public administrations . ### personal data are in many cases compromised as a result of incidents . in this context , competent authorities , single points of contact and data protection authorities should cooperate and exchange information on all relevant matters to tackle the personal data breaches resulting from incidents . the obligation to notify security incidents should be carried out in a way that minimises the administrative burden in case the security incident is also a personal data breach that requires to be notified in accordance with regulation 2013 / xx / eu of the european parliament and of the council1 . enisa should assist by developing information exchange mechanisms and a single notification template that would facilitate the reporting of incidents compromising personal data thereby easing the administrative burden on businesses and public administrations . __________________ 1 regulation xxx of the european parliament and of the council on the protection of individuals with regard to the processing of personal data and on the free movement of such data .


### the competent authorities shall notify incidents of a suspected serious criminal nature to law enforcement authorities . ### the competent authorities and the single point of contact shall inform the market operators concerned about the possibility of reporting incidents of a suspected serious criminal nature to the law enforcement authorities .


### in order to allow for the proper functioning of the cooperation network , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission in respect of the definition of the criteria to be fulfilled for a member state to be authorized to participate to the secure information - sharing system , of the further specification of the triggering events for early warning , and of the definition of the circumstances in which market operators and public administrations are required to notify incidents . ### in order to allow for the proper functioning of the cooperation network , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission in respect of the further specification of the triggering events for early warning .


### in order to ensure uniform conditions for the implementation of this directive , implementing powers should be conferred on the commission as regards the cooperation between competent authorities and the commission within the cooperation network , the access to the secure information - sharing infrastructure , the union nis cooperation plan , the formats and procedures applicable to informing the public about incidents , and the standards and / or technical specifications relevant to nis . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by member states of the commission ' s exercise of implementing powers30 . __________________ 30 oj l 55 , 28 . 2 . 2011 , p . 13 . ### in order to ensure uniform conditions for the implementation of this directive , implementing powers should be conferred on the commission as regards the cooperation between single points of contact and the commission within the cooperation network , without prejudice to existing cooperation mechanisms at national level , the common set of interconnection and security standards for the secure information - sharing infrastructure , the union nis cooperation plan and the formats and procedures applicable to notifying significant incidents . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by member states of the commission ' s exercise of implementing powers30 . __________________ 30 oj l 55 , 28 . 2 . 2011 , p . 13 .


### member states shall ensure that public administrations and market operators take appropriate technical and organisational measures to manage the risks posed to the security of the networks and information systems which they control and use in their operations . having regard to the state of the art , these measures shall guarantee a level of security appropriate to the risk presented . in particular , measures shall be taken to prevent and minimise the impact of incidents affecting their network and information system on the core services they provide and thus ensure the continuity of the services underpinned by those networks and information systems . ### member states shall ensure that market operators take appropriate technical and organisational measures to manage the risks posed to the security of the networks and information systems which they control and use in their operations . having regard to the state of the art , these measures shall guarantee a level of security appropriate to the risk presented . in particular , measures shall be taken to prevent and minimise the impact of incidents affecting their network and information system on the core services they provide and thus ensure the continuity of the services underpinned by those networks and information systems .


### following an early warning referred to in article 10 the competent authorities shall , after assessing the relevant information , agree on a coordinated response in accordance with the union nis cooperation plan referred to in article 12 . ### following an early warning referred to in article 10 the single points of contact shall , after assessing the relevant information , agree on a coordinated response in accordance with the union nis cooperation plan referred to in article 12 .


### technical and organisational measures imposed to public administrations and market operators should not require that a particular commercial information and communications technology product be designed , developed or manufactured in a particular manner . ### technical and organisational measures imposed to market operators should not require that a particular commercial information and communications technology product be designed , developed or manufactured in a particular manner .


### to ensure transparency and properly inform eu citizens and market operators , the competent authorities should set up a common website to publish non confidential information on the incidents and risks . ### to ensure transparency and properly inform eu citizens and market operators , the single points of contact should set up a common union - wide website to publish non confidential information on the incidents and risks .


### information that is considered confidential by a competent authority , in accordance with union and national rules on business confidentiality , should be exchanged with the commission and other competent authorities only where such exchange is strictly necessary for the application of this directive . the information exchanged should be limited to that which is relevant and proportionate to the purpose of such exchange . ### information that is considered confidential by a competent authority or a single point of contact , in accordance with union and national rules on business confidentiality , should be exchanged with the commission , its relevant agencies , single points of contact and / or other national competent authorities only where such exchange is strictly necessary for the application of this directive . the information exchanged should be limited to that which is relevant , necessary and proportionate to the purpose of such exchange , while respecting pre - defined criteria for confidentiality and security and classification protocols , governing the information sharing procedure .


### the competent authority may inform the public , or require the public administrations and market operators to do so , where it determines that disclosure of the incident is in the public interest . once a year , the competent authority shall submit a summary report to the cooperation network on the notifications received and the action taken in accordance with this paragraph . ### after consultation with the notified competent authority and the market operator concerned , the single point of contact may inform the public about individual incidents , where public awareness is necessary to prevent an incident or deal with an on - going incident , or where that market operator , subject to an incident , has refused to address a serious structural vulnerability related to that incident without undue delay . before any public disclosure , the notified competent authority shall ensure that the market operator concerned has the possibility to be heard . once a year , the single point of contact shall submit a summary report to the cooperation network on the notifications received and the action taken in accordance with this paragraph .


### the competent authorities shall consult and cooperate , whenever appropriate , with the relevant law enforcement national authorities and data protection authorities . ### the competent authorities and single points of contact shall consult and cooperate , whenever appropriate , with the relevant law enforcement national authorities and data protection authorities .