### in case of disembarkation in a third country , the participating units shall identify the intercepted or rescued persons and assess their personal circumstances to the extent possible before disembarkation . they shall inform the intercepted or rescued persons of the place of disembarkation in an appropriate way and they shall give them an opportunity to express any reasons for believing that disembarkation in the proposed place would be in violation of the principle of non - refoulement . ### in case of disembarkation in a third country , unless provided for in article 3 and article 4 and , the participating units shall inform the intercepted or rescued persons of the place of disembarkation in an appropriate way and they shall give them an opportunity to express any reasons for believing that disembarkation in the proposed place would be in violation of the principle of non - refoulement .


### before deciding on disembarkation in a third country , the participating units shall take into account the general situation in that third country and intercepted or rescued persons shall not be disembarked in that third country when the host member state or the participating member states are aware or ought to be aware that this third country is engaged in practices as described in paragraph 1 . ### before and while a sea operation is taking place , the host member state and the participating member states shall examine the general situation in the neighbouring third countries . intercepted or rescued persons shall not be disembarked in a third country when the host member state or the participating member states are aware or ought to be aware that this third country is engaged in practices as described in paragraph 1 . those member states shall provide that information to the participating units . for that purpose , they may use the information prepared by the european asylum support office , the agency and the united nations high commissioner for refugees .


### this regulation respects the fundamental rights and observes the principles recognised by the charter of fundamental rights of the european union , notably the right to life , human dignity , prohibition of torture and of inhuman or degrading treatment or punishment , right to liberty and security , non - refoulement , non - discrimination , the right to an effective remedy , the right to asylum and the rights of the child . ### this regulation respects the fundamental rights and observes the principles recognised by articles 2 and 6 of the treaty on european union and by the charter of fundamental rights of the european union , in particular respect for human dignity , the right to life , the prohibition of torture and of inhuman or degrading treatment or punishment , the prohibition of trafficking in human beings , the right to liberty and security , the right to the protection of personal data , the right to asylum and to protection against removal and expulsion , non - refoulement , non - discrimination , the right to an effective remedy and the rights of the child . this regulation should be applied by member states and the agency in accordance with those rights and principles .


### ordering the ship to modify its course outside of or towards a destination other than the territorial sea or the contiguous zone , including escorting the vessel or steaming nearby until the ship is heading on such course ; ### ordering the ship to modify its course outside of or towards a destination other than the territorial sea or the contiguous zone , including escorting the ship or steaming nearby until it is heading on such course ;


### pursuant to regulation no 2007 / 2004 , border surveillance operations coordinated by the agency are conducted in accordance with an operational plan . accordingly , as regards sea operations , the operational plan should include specific information on the application of the relevant jurisdiction and legislation in the geographical area where the joint operation or pilot project takes place , including references to international and union law , regarding interception , rescue at sea and disembarkation . in turn , this regulation governs the issues of interception , rescue at sea and disembarkation in the context of sea border surveillance operations coordinated by the agency . ### pursuant to regulation no 2007 / 2004 , border surveillance operations coordinated by the agency are conducted in accordance with an operational plan . accordingly , as regards sea operations , the operational plan should include specific information on the application of the relevant jurisdiction and legislation in the geographical area where the joint operation , pilot project or rapid intervention takes place , including references to international and union law , regarding interception , rescue at sea , disembarkation and rules and procedures which ensure that persons with international protection needs , victims of human trafficking , unaccompanied minors and other vulnerable persons are identified during the operation and provided with appropriate assistance , including access to international protection . in turn , this regulation governs the issues of interception , rescue at sea and disembarkation in the context of sea border surveillance operations coordinated by the agency .


### requesting information and documentation on ownership , registration and elements relating to the voyage , and on the identity , nationality and other relevant data on persons on board ; ### requesting information and documentation on ownership , registration and elements relating to the voyage , and on the identity , nationality and other relevant data on persons on board , including their health conditions , in order to assess if there are persons with special medical needs on board ;


### in accordance with regulation no 562 / 2006 of the european parliament and of the council of 15 march 2006 establishing a community code on the rules governing the movement of persons across borders and general principles of union law , any measure taken in the course of a surveillance operation should be proportionate to the objectives pursued , non - discriminatory and it should fully respect human dignity , fundamental rights and the rights of refugees and asylum seekers , including the principle of non - refoulement . member states and the agency are bound by the provisions of the asylum acquis , and in particular of council directive 2005 / 85 / ec of 1 december 2005 on minimum standards on procedures in member states for granting and withdrawing refugee status with regard to applications for asylum made in the territory , including at the border or in the transit zones of member states . ### in accordance with regulation no 562 / 2006 of the european parliament and of the council of 15 march 2006 establishing a community code on the rules governing the movement of persons across borders and general principles of union law , any measure taken in the course of a surveillance operation should be proportionate to the objectives pursued , non - discriminatory and it should fully respect human dignity , fundamental rights , the rights of refugees and asylum seekers and the principle of non - refoulement . member states and the agency are bound by the provisions of the asylum acquis , and in particular of directive 2013 / 32 / eu of the european parliament and of the council1 with regard to applications for international protection made in the territory , including at the border , in the territorial waters or in the transit zones of member states . _________________ 1 directive 2013 / 32 / eu of the european parliament and of the council of 26 june 2013 on common procedures for granting and withdrawing international protection .


### where the ship is about to enter or it has entered the territorial sea or the contiguous zone of a member state that is not participating in the sea operation , the participating units shall communicate information about the ship to the international coordination centre , which shall convey this information to the national coordination centre of the member state concerned . ### where the ship is about to enter or it has entered the territorial sea or , where formally proclaimed , the contiguous zone of a member state that is not participating in the sea operation , the participating units shall communicate information about the ship to the international coordination centre , which shall convey this information to the national coordination centre of the member state concerned .


### in case of disembarkation in a third country , the participating units shall identify the intercepted or rescued persons and assess their personal circumstances to the extent possible before disembarkation . they shall inform the intercepted or rescued persons of the place of disembarkation in an appropriate way and they shall give them an opportunity to express any reasons for believing that disembarkation in the proposed place would be in violation of the principle of non - refoulement . ### if disembarkation in a third country is considered , the participating units shall identify the intercepted or rescued persons and assess their personal circumstances , including their medical conditions and other circumstances that might make them vulnerable , before a decision is made . they shall inform the intercepted or rescued persons of the place of disembarkation in a language which those persons understand or may reasonably be presumed to understand and they shall give them an opportunity to express any reasons for believing that disembarkation in the proposed place would be in violation of the principle of non - refoulement .


### where there are reasonable grounds to suspect that a ship without nationality or one that may be assimilated to a ship without nationality is carrying persons intending to circumvent the checks at border crossing points or is engaged in the smuggling of migrants by sea , the host member state or the participating member state in whose territorial sea the stateless ship is intercepted shall authorise and instruct the participating unit to stop it and to take any of the measures laid down in paragraph 1 . ### where there are reasonable grounds to suspect that a ship without nationality or one that may be assimilated to a ship without nationality is carrying persons intending to circumvent the checks at border crossing points or is engaged in the smuggling of migrants by sea , the host member state in whose territorial sea the stateless ship is intercepted shall authorise and instruct the participating unit to stop it and to take any of the measures laid down in paragraph 1 .


### in the territorial sea of the host member state or a participating member state , the participating units shall take one or more of the following measures when there are reasonable grounds to suspect that a ship is carrying persons intending to circumvent checks at border crossing points or is engaged in the smuggling of migrants by sea : ### in the territorial sea of the host member state or a participating member state , the participating units shall communicate the information about the intercepted ship to the international coordination centre . it shall immediately inform the national coordination centre of the competent territorial member state that takes all the necessary measures according to national law .


### ' place of safety ' means a location where rescue operations are considered to terminate and where the survivors ' safety of life including as regards the protection of their fundamental rights is not threatened , where their basic human needs can be met and from which transportation arrangements can be made for the survivors ' next destination or final destination ; ### ' place of safety ' means a location where rescue operations are considered to terminate and where the survivors ' safety of life as well as the protection of their fundamental rights are not threatened , where their basic human needs can be met and from which transportation arrangements can be made for the survivors ' next destination or final destination , in compliance with the principle of non - refoulement ;


### the participating units shall communicate information about any ship suspected of being engaged in illegal activities at sea outside the scope of a sea operation to the international coordination centre , which shall convey this information to the national coordination centre of the member state or member states concerned . ### the participating units shall communicate information about any ship suspected of being engaged in illegal activities at sea , which are outside the scope of the sea operation , to the international coordination centre , which shall convey this information to the national coordination centre of the member state or member states concerned .


### in the territorial sea of the host member state or a participating member state , the participating units shall take one or more of the following measures when there are reasonable grounds to suspect that a ship is carrying persons intending to circumvent checks at border crossing points or is engaged in the smuggling of migrants by sea : ### in the territorial sea of the host member state or a participating member state , the participating units may take one or more of the following measures when there are reasonable grounds to suspect that a ship is carrying persons intending to circumvent checks at border crossing points or is engaged in the smuggling of migrants by sea :


### no person shall be disembarked in , or otherwise handed over to the authorities of a country where there is a serious risk that such person would be subjected to the death penalty , torture or other inhuman or degrading treatment or punishment or from which there is a serious risk of expulsion , removal or extradition to another country in contravention of the principle of non - refoulement . ### no person shall be disembarked in , otherwise handed over to the authorities of , or forced to enter , a country where there is a serious risk that such person would be subjected to the death penalty , torture or other inhuman or degrading treatment or punishment or from which there is a serious risk of expulsion , removal or extradition to another country in contravention of the principle of non - refoulement .


### processed fairly and lawfully ; ### processed fairly and lawfully and in a transparent manner in relation to the data subject ;


### adequate , relevant , and not excessive in relation to the purposes for which they are processed ; ### adequate , relevant , and limited to the minimum necessary in relation to the purposes for which they are processed ; they shall only be processed where anonymous processing is not sufficient for the respective purpose ;


### member states shall ensure that , as far as possible , the different categories of personal data undergoing processing are distinguished in accordance with their degree of accuracy and reliability . ### the competent authorities shall ensure that , as far as possible , personal data are factually accurate , complete and , if necessary , up to date .


### member states shall ensure that , as far as possible , personal data based on facts are distinguished from personal data based on personal assessments . ### the competent authorities shall ensure that personal data which are inaccurate , incomplete or no longer up to date are not transmitted or made available . to that end , the competent authorities shall , as far as practicable , verify the quality of personal data before they are transmitted or made available . as far as possible , in all transmissions of data , available information shall be added which enables the receiving member state to assess the degree of accuracy , completeness , up - to - dateness and reliability . if personal data were transmitted without request the receiving authority shall verify without delay whether these data are necessary for the purpose for which they were transmitted . 3 . if it emerges that incorrect data have been transmitted or data have been unlawfully transmitted , the recipient must be notified without delay . the recipient shall be obliged to rectify the data without delay in accordance with paragraph 1 and article 15 or to erase them in accordance with article 16 .


### transporters of aquaculture animals and wild aquatic animals intended for aquaculture shall keep up - to date records on : ### transporters of aquaculture animals and wild aquatic animals intended for aquaculture or for release in a natural environment in order to replenish wild stocks shall keep up - to date records on :


### public contracts should not be awarded to economic operators that have participated in a criminal organisation or have been found guilty of corruption , fraud to the detriment of the union’s financial interests or money laundering . non - payment of taxes or social security contributions should also be sanctioned by mandatory exclusion at the level of the union . furthermore , contracting authorities should be given the possibility to exclude candidates or tenderers for violations of environmental or social obligations , including rules on accessibility for disabled persons or other forms of grave professional misconduct , such as violations of competition rules or of intellectual property rights . ### public contracts should not be awarded to economic operators that have participated in a criminal organisation or have been found guilty of corruption , fraud to the detriment of the union’s financial interests or money laundering . non - payment of taxes or social security contributions should also be sanctioned by mandatory exclusion at the level of the union . furthermore , contracting authorities should be given the possibility to exclude candidates or tenderers for violations of environmental or social obligations , or those relating to workers ' rights , including rules on working conditions , accessibility for disabled persons or other forms of grave professional misconduct , such as violations of competition rules or of intellectual property rights .


### they may also provide that contracting authorities may use a competitive procedure with negotiation or a competitive dialogue in any of the following cases : ### member states shall provide that contracting authorities may apply a competitive procedure with negotiation or a competitive dialogue as regulated in this directive in any of the following cases :


### without prejudice to national laws , regulations or administrative provisions concerning the remuneration of certain services , the criteria on which contracting authorities shall base the award of public contracts shall be one of the following : ### without prejudice to national laws , regulations or administrative provisions concerning the remuneration of certain services , contracting authorities shall award public contracts to the economically most advantageous tender .


### the most economically advantageous tender referred to in point of paragraph 1 from the point of view of the contracting authority shall be identified on the basis of criteria linked to the subject - matter of the public contract in question . those criteria shall include , in addition to the price or costs referred to in point of paragraph 1 , other criteria linked to the subject - matter of the public contract in question , such as : ### the most economically advantageous tender from the point of view of the contracting authority shall be identified on the basis of criteria linked to the subject - matter of the public contract in question . those criteria shall include price or costs and other qualitative , environmental and social criteria linked to the subject - matter of the public contract in question , such as :


### during the transition from stage iii a to stage iii b , the percentage of the number of engines used for application other than propulsion of railcars and locomotives placed on the market under the flexibility scheme , should be increased from 20% to 50% of the equipment manufacturer ' s annual sales of equipment with engines in that category . the maximum number of engines that may be placed on the market under the flexibility scheme should be adapted accordingly . ### during the stage iii b , the percentage of the number of engines used for application other than propulsion of railcars , locomotives and inland waterways vessels placed on the market under the flexibility scheme , should be 50% of the equipment manufacturer ' s annual quantity of equipment placed on the market with engines in that category . the optional alternative that a fixed number of engines that may be placed on the market under the flexibility scheme should be adapted accordingly .


### during the transition from stage iii a to stage iii b , the percentage of the number of engines used for application other than propulsion of railcars and locomotives placed on the market under the flexibility scheme , should be increased from 20% to 50% of the equipment manufacturer ' s annual sales of equipment with engines in that category . the maximum number of engines that may be placed on the market under the flexibility scheme should be adapted accordingly . ### during stage iii b , the percentage of the number of engines used for application other than propulsion of railcars and locomotives placed on the market under the flexibility scheme , should be 50% of the equipment manufacturer ' s annual quantity of equipment placed on the market with engines in that category . the optional alternative that a fixed number of engines that may be placed on the market under the flexibility scheme should be adapted accordingly .


### ' 7 . member states shall permit the placing on the market of engines , as defined in section 1 of annex i under a , a , a and a , under the flexibility scheme in accordance with the provisions in annex xiii . ' ### ' 7 . member states shall permit the placing on the market of engines , except those engines used in the construction sector , as defined in section 1 of annex i under a , a and a , under the flexibility scheme in accordance with the provisions in annex xiii . '


### 2 . 2 . as an optional alternative to section 1 . 2 . 1 . , the oem may seek permission for his engine suppliers to place on the market a fixed number of engines under the flexibility scheme . the number of engines in each engine category shall not exceed the following values : ### 2 . 2 . as an optional alternative to section 1 . 1 . 1 . , the oem may seek permission for his engine suppliers to place on the market a fixed number of engines under the flexibility scheme . the number of engines in each engine category shall not exceed the following values :


### 2 during the transition period from stage iii a to stage iii b , with the exception of engines for use in propulsion of railcars and locomotives , an oem that wishes to make use of the flexibility scheme shall request permission from any approval authority to purchase from his engine suppliers , the quantities of engines described in sections 1 . 2 . 1 . and 1 . 2 . 2 . , that do not comply with the current emission limit values , but are approved to the nearest previous stage of emission limits . ### 2 by way of derogation from point 1 . 1 , during stage iii b , but no longer than three years after the beginning of that stage , with the exception of engines for use in propulsion of railcars and locomotives , an oem that wishes to make use of the flexibility scheme shall request permission from any approval authority for the oem’s engine manufacturers to place on the market engines intended for the oem’s exclusive use . the quantities of engines shall not exceed those described in sections 1 . 2 . 1 . and 1 . 2 . 2 .


### 2 . during the transition period from stage iii a to stage iii b , with the exception of engines for use in propulsion of railcars and locomotives , an oem that wishes to make use of the flexibility scheme shall request permission from any approval authority to purchase from his engine suppliers , the quantities of engines described in sections 1 . 2 . 1 . and 1 . 2 . 2 . , that do not comply with the current emission limit values , but are approved to the nearest previous stage of emission limits . ### 2 . during stage iii b , with the exception of engines for use in propulsion of railcars and locomotives , an oem that wishes to make use of the flexibility scheme shall request permission from any approval authority for the oem’s engine manufacturers to place on the market engines intended for the oem’s exclusive use . the quantities of engines shall not exceed those described in sections 1 . 2 . 1 . and 1 . 2 . 2 . the engines shall meet the requirements of article 10 .


### network and information systems and services play a vital role in the society . their reliability and security are essential to economic activities and social welfare , and in particular to the functioning of the internal market . ### network and information systems and services play a vital role in the society . their reliability and security are essential to the freedom and overall security for the citizens of the eu as well as to economic activities and social welfare , and in particular to the functioning of the internal market .


### the magnitude and frequency of deliberate or accidental security incidents is increasing and represents a major threat to the functioning of networks and information systems . such incidents can impede the pursuit of economic activities , generate substantial financial losses , undermine user confidence and cause major damage to the economy of the union . ### the magnitude and frequency of security incidents is increasing and represents a major threat to the functioning of networks and information systems . these systems may also become an easy target for deliberate harmful actions intended to damage or interrupt the operation of the systems . such incidents can threaten the health and safety of the population , impede the pursuit of economic activities , generate substantial financial losses , undermine user confidence and cause major damage to the economy of the union .


### the magnitude and frequency of deliberate or accidental security incidents is increasing and represents a major threat to the functioning of networks and information systems . such incidents can impede the pursuit of economic activities , generate substantial financial losses , undermine user confidence and cause major damage to the economy of the union . ### the magnitude and frequency of deliberate or accidental security incidents is increasing and represents a major threat to the functioning of networks and information systems . such incidents can impede the pursuit of economic activities , generate substantial financial losses , undermine user and investor confidence and cause major damage to the economy of the union .


### the magnitude and frequency of deliberate or accidental security incidents is increasing and represents a major threat to the functioning of networks and information systems . such incidents can impede the pursuit of economic activities , generate substantial financial losses , undermine user confidence and cause major damage to the economy of the union . ### the magnitude , frequency and impact of deliberate or accidental security incidents is increasing and represents a major threat to the functioning of networks and information systems . such incidents can impede the pursuit of economic activities , generate substantial financial losses , undermine user confidence and cause major damage to the economy of the union .


### as a communication instrument without frontiers , digital information systems , and primarily the internet play an essential role in facilitating the cross - border movement of goods , services and people . due to that transnational nature , substantial disruption of those systems in one member state can also affect other member states and the union as a whole . the resilience and stability of network and information systems is therefore essential to the smooth functioning of the internal market . ### as a communication instrument without traditional frontiers , digital information systems , and primarily the internet play an essential role in facilitating the cross - border movement of goods , services , ideas and people . due to that transnational nature , substantial disruption of those systems in one member state can also affect other member states and the union as a whole . the resilience and stability of network and information systems is therefore essential to the smooth functioning of the internal market and moreover to the functioning of external markets , too .


### a cooperation mechanism should be established at union level to allow for information exchange and coordinated detection and response regarding network and information security . for that mechanism to be effective and inclusive , it is essential that all member states have minimum capabilities and a strategy ensuring a high level of nis in their territory . minimum security requirements should also apply to public administrations and operators of critical information infrastructure to promote a culture of risk management and ensure that the most serious incidents are reported . ### a cooperation mechanism should be established at union level to allow for information exchange and coordinated prevention , detection and response regarding network and information security . for that mechanism to be effective and inclusive , it is essential that all member states have minimum capabilities and a strategy ensuring a high level of nis in their territory . minimum security requirements should also apply to public administrations and operators of critical information infrastructure to promote a culture of risk management and ensure that the most serious incidents are reported .


### responding effectively to the challenges of the security of network and information systems therefore requires a global approach at union level covering common minimum capacity building and planning requirements , exchange of information and coordination of actions , and common minimum security requirements for all market operators concerned and public administrations . ### responding effectively to the challenges of the security of network and information systems therefore requires a global approach at union level covering common minimum capacity building and planning requirements , developing sufficient cybersecurity skills , exchange of information and coordination of actions , and common minimum security requirements for all market operators concerned and public administrations .


### responding effectively to the challenges of the security of network and information systems therefore requires a global approach at union level covering common minimum capacity building and planning requirements , exchange of information and coordination of actions , and common minimum security requirements for all market operators concerned and public administrations . ### responding effectively to the challenges of the security of network and information systems therefore requires a global approach at union level covering common minimum capacity building and planning requirements , exchange of information and coordination of actions , and common minimum security requirements for all market operators concerned and public administrations . minimal common standards should be applied in accordance with appropriate recommendations by the cyber security co - ordination groups .


### all member states should be adequately equipped , both in terms of technical and organisational capabilities , to prevent , detect , respond to and mitigate network and information systems ' incidents and risks . well - functioning computer emergency response teams complying with essential requirements should therefore be established in all member states to guarantee effective and compatible capabilities to deal with incidents and risks and ensure efficient cooperation at union level . ### all member states and market operators should be adequately equipped both in terms of technical and organisational capabilities , to prevent , detect , respond to and mitigate network and information systems ' incidents and risks . commonly required equipment and capabilities ought to comply with commonly agreed technical standards as well as standards procedures of operation . well - functioning computer emergency response teams complying with essential requirements should therefore be established in all member states to guarantee effective and compatible capabilities to deal with incidents and risks and ensure efficient cooperation at union level . these certs should be enabled to interact on the basis of common technical standards and spo .


### building upon the significant progress within the european forum of member states in fostering discussions and exchanges on good policy practices including the development of principles for european cyber crisis cooperation , the member states and the commission should form a network to bring them into permanent communication and support their cooperation . this secure and effective cooperation mechanism should enable structured and coordinated information exchange , detection and response at union level . ### building upon the significant progress within the european forum of member states in fostering discussions and exchanges on good policy practices including the development of principles for european cyber crisis cooperation , the member states and the commission should form a network , under the coordination of enisa , to bring them into permanent communication and support their cooperation . this secure and effective cooperation mechanism should enable structured and coordinated information exchange , detection and response at union level .


### to ensure transparency and properly inform eu citizens and market operators , the competent authorities should set up a common website to publish non confidential information on the incidents and risks . ### to ensure transparency and properly inform eu citizens and market operators , a common website should be setup by enisa and the competent authorities where non confidential information on the incidents and risks is to be published .


### on the basis in particular of national crisis management experiences and in cooperation with enisa , the commission and the member states should develop a union nis cooperation plan defining cooperation mechanisms to counter risks and incidents . that plan should be duly taken into account in the operation of early warnings within the cooperation network . ### on the basis in particular of national crisis management experiences and in cooperation with enisa , the commission and the member states should develop a union nis cooperation plan defining cooperation mechanisms to prevent , detect , report , and counter risks and incidents . that plan should be duly taken into account in the operation of early warnings within the cooperation network .


### on the basis in particular of national crisis management experiences and in cooperation with enisa , the commission and the member states should develop a union nis cooperation plan defining cooperation mechanisms to counter risks and incidents . that plan should be duly taken into account in the operation of early warnings within the cooperation network . ### on the basis in particular of national crisis management experiences and in cooperation with enisa , the commission and the member states should develop a union nis cooperation plan defining cooperation mechanisms , best practices and operation patterns to counter risks and incidents . that plan should be duly taken into account in the operation of early warnings within the cooperation network .


### responsibilities in ensuring nis lie to a great extent on public administrations and market operators . a culture of risk management , involving risk assessment and the implementation of security measures appropriate to the risks faced should be promoted and developed through appropriate regulatory requirements and voluntary industry practices . establishing a level playing field is also essential to the effective functioning of the cooperation network to ensure effective cooperation from all member states . ### responsibilities in ensuring nis lie to a great extent on public administrations and market operators . a culture of risk management and close cooperation , involving risk assessment , and the implementation of security measures appropriate to the risks faced should be promoted and developed through appropriate regulatory requirements and voluntary industry practices . establishing a level playing field is also essential to the effective functioning of the cooperation network to ensure effective cooperation from all member states .


### responsibilities in ensuring nis lie to a great extent on public administrations and market operators . a culture of risk management , involving risk assessment and the implementation of security measures appropriate to the risks faced should be promoted and developed through appropriate regulatory requirements and voluntary industry practices . establishing a level playing field is also essential to the effective functioning of the cooperation network to ensure effective cooperation from all member states . ### responsibilities in ensuring nis lie to a great extent on public administrations and market operators . a culture of risk management and trust , involving risk assessment and the implementation of security measures appropriate to the risks faced should be promoted and developed through appropriate regulatory requirements and voluntary industry practices . establishing a trustworthy level playing field is also essential to the effective functioning of the cooperation network to ensure effective cooperation from all member states .


### those obligations should be extended beyond the electronic communications sector to key providers of information society services , as defined in directive 98 / 34 / ec of the european parliament and of the council of 22 june 1998 laying down a procedure for the provision of information in the field of technical standards and regulations and of rules on information society services27 , which underpin downstream information society services or on - line activities , such as e - commerce platforms , internet payment gateways , social networks , search engines , cloud computing services , application stores . disruption of these enabling information society services prevents the provision of other information society services which rely on them as key inputs . software developers and hardware manufacturers are not providers of information society services and are therefore excluded . those obligations should also be extended to public administrations , and operators of critical infrastructure which rely heavily on information and communications technology and are essential to the maintenance of vital economical or societal functions such as electricity and gas , transport , credit institutions , stock exchange and health . disruption of those network and information systems would affect the internal market . __________________ 27 oj l 204 , 21 . 7 . 1998 , p . 37 . ### those obligations should be extended beyond the electronic communications sector and public administrations to operators of infrastructure which rely heavily on information and communications technology and are essential to the maintenance of vital economical or societal functions such as electricity and gas , transport , credit institutions , financial market infrastructures and health . disruption of those network and information systems would affect the internal market . while the obligations set out in this directive do not extend to key providers of information society services , as defined in directive 98 / 34 / ec of the european parliament and of the council of 22 june 1998 laying down a procedure for the provision of information in the field of technical standards and regulations and of rules on information society services27 , which underpin downstream information society services or on - line activities , such as e - commerce platforms , internet payment gateways , social networks , search engines , cloud computing services , application stores , these may , on a voluntary basis , inform the competent authority or single point of contact of those network security incidents they deem appropriate , and the competent authority or the single point of contact should , if reasonably possible , present the public administrations or the market operators that informed of the incident with strategically analysed information that will help overcome the security threat . __________________ 27 oj l 204 , 21 . 7 . 1998 , p . 37 .


### competent authorities should pay due attention to preserving informal and trusted channels of information - sharing between market operators and between the public and the private sectors . publicity of incidents reported to the competent authorities should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the public administrations and market operators reporting incidents . in the implementation of the notification obligations , competent authorities should pay particular attention to the need to maintain information about product vulnerabilities strictly confidential prior to the release of appropriate security fixes . ### competent authorities should pay due attention to preserving informal and trusted channels of information - sharing between market operators and between the public and the private sectors . publicity of incidents reported to the competent authorities should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the public administrations and market operators reporting incidents . in the implementation of the notification obligations , competent authorities should pay particular attention to the need to maintain information about product vulnerabilities strictly confidential prior to the release of appropriate security fixes though not delay any notification more than compulsorily required .


### competent authorities should pay due attention to preserving informal and trusted channels of information - sharing between market operators and between the public and the private sectors . publicity of incidents reported to the competent authorities should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the public administrations and market operators reporting incidents . in the implementation of the notification obligations , competent authorities should pay particular attention to the need to maintain information about product vulnerabilities strictly confidential prior to the release of appropriate security fixes . ### competent authorities and single points of contact should pay due attention to preserving informal and trusted channels of information - sharing between market operators and between the public and the private sectors . publicity of incidents reported to the competent authorities and single points of contact should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the public administrations and market operators reporting incidents . in order to safeguard trust and efficiency , publicity of incidents shall only take place after consultation with those who reported the incident and only when strictly necessary for achieving the objectives of this directive . in the implementation of the notification obligations , competent authorities and single points of contact should pay particular attention to the need to maintain information about product vulnerabilities strictly confidential prior to the deployment of appropriate security fixes . as a general rule , single points of contact should not disclose personal data of individuals involved in incidents . single points of contact should only disclose personal data where the disclosure of such data is necessary and proportionate in view of the objective pursued .


### competent authorities should have the necessary means to perform their duties , including powers to obtain sufficient information from market operators and public administrations in order to assess the level of security of network and information systems as well as reliable and comprehensive data about actual incidents that have had an impact on the operation of network and information systems . ### competent authorities should have the necessary means to perform their duties , including powers to obtain sufficient information from market operators and public administrations in order to assess the level of security of network and information systems , measure the number , scale and scope of incidents , as well as reliable and comprehensive data about actual incidents that have had an impact on the operation of network and information systems .


### competent authorities should have the necessary means to perform their duties , including powers to obtain sufficient information from market operators and public administrations in order to assess the level of security of network and information systems as well as reliable and comprehensive data about actual incidents that have had an impact on the operation of network and information systems . ### competent authorities and single points of contact should have the necessary means to perform their duties , including powers to obtain sufficient information from market operators and public administrations in order to assess the level of security of network and information systems as well as reliable and comprehensive data about actual incidents that have had an impact on the operation of network and information systems .


### personal data are in many cases compromised as a result of incidents . in this context , competent authorities and data protection authorities should cooperate and exchange information on all relevant matters to tackle the personal data breaches resulting from incidents . member states shall implement the obligation to notify security incidents in a way that minimises the administrative burden in case the security incident is also a personal data breach in line with the regulation of the european parliament and of the council on the protection of individuals with regard to the processing of personal data and on the free movement of such data28 . liaising with the competent authorities and the data protection authorities , enisa could assist by developing information exchange mechanisms and templates avoiding the need for two notification templates . this single notification template would facilitate the reporting of incidents compromising personal data thereby easing the administrative burden on businesses and public administrations . __________________ 28 sec 72 final ### personal data are in many cases compromised as a result of incidents . member states and market operators should protect personal data stored , processed or transmitted against accidental or unlawful destruction , accidental loss or alteration , and unauthorised or unlawful storage , access or disclosure , dissemination , or access ; and ensure the implementation of a security policy with respect to the processing of personal data . in this context , competent authorities and data protection authorities should cooperate and exchange information on all relevant matters to tackle the personal data breaches resulting from incidents . member states shall implement the obligation to notify security incidents in a way that minimises the administrative burden in case the security incident is also a personal data breach in line with the regulation of the european parliament and of the council on the protection of individuals with regard to the processing of personal data and on the free movement of such data28 . liaising with the competent authorities and the data protection authorities , enisa could assist by developing information exchange mechanisms and templates avoiding the need for two notification templates . this single notification template would facilitate the reporting of incidents compromising personal data thereby easing the administrative burden on businesses and public administrations . __________________ 28 sec 72 final


### personal data are in many cases compromised as a result of incidents . in this context , competent authorities and data protection authorities should cooperate and exchange information on all relevant matters to tackle the personal data breaches resulting from incidents . member states shall implement the obligation to notify security incidents in a way that minimises the administrative burden in case the security incident is also a personal data breach in line with the regulation of the european parliament and of the council on the protection of individuals with regard to the processing of personal data and on the free movement of such data28 . liaising with the competent authorities and the data protection authorities , enisa could assist by developing information exchange mechanisms and templates avoiding the need for two notification templates . this single notification template would facilitate the reporting of incidents compromising personal data thereby easing the administrative burden on businesses and public administrations . __________________ 28 sec 72 final ### personal data are in many cases compromised as a result of incidents . in this context , competent authorities , single points of contact and data protection authorities should cooperate and exchange information on all relevant matters to tackle the personal data breaches resulting from incidents . the obligation to notify security incidents should be carried out in a way that minimises the administrative burden in case the security incident is also a personal data breach that is required to be notified in accordance with applicable law . enisa should assist by developing information exchange mechanisms and a single notification template that would facilitate the reporting of incidents compromising personal data thereby easing the administrative burden on businesses and public administrations .


### standardisation of security requirements is a market - driven process . to ensure a convergent application of security standards , member states should encourage compliance or conformity with specified standards to ensure a high level of security at union level . to this end , it might be necessary to draft harmonised standards , which should be done in accordance with regulation no 1025 / 2012 of the european parliament and of the council of 25 october 2012 on european standardisation , amending council directives 89 / 686 / eec and 93 / 15 / eec and directives 94 / 9 / ec , 94 / 25 / ec , 95 / 16 / ec , 97 / 23 / ec , 98 / 34 / ec , 2004 / 22 / ec , 2007 / 23 / ec , 2009 / 23 / ec and 2009 / 105 / ec of the european parliament and of the council and repealing council decision 87 / 95 / eec and decision no 1673 / 2006 / ec of the european parliament and of the council29 . __________________ 29 oj l 316 , 14 . 11 . 2012 , p . 12 . ### standardisation of security requirements is a market - driven process of a voluntary nature that should allow market operators and public administrations to use alternative means to achieve at least similar outcomes . to ensure a convergent application of security standards , member states should encourage compliance or conformity with specified interoperable standards to ensure a high level of security at union level . to this end , it might be necessary to draft harmonised standards , which should be done in accordance with regulation no 1025 / 2012 of the european parliament and of the council of 25 october 2012 on european standardisation , amending council directives 89 / 686 / eec and 93 / 15 / eec and directives 94 / 9 / ec , 94 / 25 / ec , 95 / 16 / ec , 97 / 23 / ec , 98 / 34 / ec , 2004 / 22 / ec , 2007 / 23 / ec , 2009 / 23 / ec and 2009 / 105 / ec of the european parliament and of the council and repealing council decision 87 / 95 / eec and decision no 1673 / 2006 / ec of the european parliament and of the council29 . __________________ 29 oj l 316 , 14 . 11 . 2012 , p . 12 .


### the commission should periodically review this directive , in particular with a view to determining the need for modification in the light of changing technological or market conditions . ### the commission should periodically review this directive , in particular with a view to determining the need for modification in the light of changing societal , political , technological or market conditions .


### in order to allow for the proper functioning of the cooperation network , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission in respect of the definition of the criteria to be fulfilled for a member state to be authorized to participate to the secure information - sharing system , of the further specification of the triggering events for early warning , and of the definition of the circumstances in which market operators and public administrations are required to notify incidents . ### in order to allow for the proper functioning of the cooperation network , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission in respect of the further specification of the triggering events for early warning .


### it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and to the council . ### it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including all stakeholders and in particular at expert level . the commission , when preparing and drawing up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and to the council .


### in order to ensure uniform conditions for the implementation of this directive , implementing powers should be conferred on the commission as regards the cooperation between competent authorities and the commission within the cooperation network , the access to the secure information - sharing infrastructure , the union nis cooperation plan , the formats and procedures applicable to informing the public about incidents , and the standards and / or technical specifications relevant to nis . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by member states of the commission ' s exercise of implementing powers30 . __________________ 30 oj l 55 , 28 . 2 . 2011 , p . 13 . ### in order to ensure uniform conditions for the implementation of this directive , implementing powers should be conferred on the commission as regards the cooperation between single points of contact and the commission within the cooperation network , without prejudice to existing cooperation mechanisms at national level , the common set of interconnection and security standards for the secure information - sharing infrastructure , the union nis cooperation plan and the formats and procedures applicable to notifying significant incidents . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by member states of the commission ' s exercise of implementing powers30 . __________________ 30 oj l 55 , 28 . 2 . 2011 , p . 13 .


### in the application of this directive , the commission should liaise as appropriate with relevant sectoral committees and relevant bodies set up at eu level in particular in the field of energy , transport and health . ### in the application of this directive , the commission should liaise as appropriate with relevant sectorial committees and relevant bodies set up at eu level in particular in the field of e - government , energy , transport and health .


### information that is considered confidential by a competent authority , in accordance with union and national rules on business confidentiality , should be exchanged with the commission and other competent authorities only where such exchange is strictly necessary for the application of this directive . the information exchanged should be limited to that which is relevant and proportionate to the purpose of such exchange . ### information that is considered confidential by a competent authority or a single point of contact , in accordance with union and national rules on business confidentiality , should be exchanged with the commission and other single points of contact only where such exchange is strictly necessary for the application of this directive . the information exchanged should be limited to that which is relevant , necessary and proportionate to the purpose of such exchange .


### the sharing of information on risks and incidents within the cooperation network and compliance with the requirements to notify incidents to the national competent authorities may require the processing of personal data . such a processing of personal data is necessary to meet the objectives of public interest pursued by this directive and is thus legitimate under article 7 of directive 95 / 46 / ec . it does not constitute , in relation to these legitimate aims , a disproportionate and intolerable interference impairing the very substance of the right to the protection of personal data guaranteed by article 8 of the charter of fundamental rights . in the application of this directive , regulation no 1049 / 2001 of the european parliament and of the council of 30 may 2001 regarding public access to european parliament , council and commission documents31 should apply as appropriate . when data are processed by union institutions and bodies , such processing for the purpose of implementing this directive should comply with regulation no 45 / 2001 of the european parliament and of the council of 18 december 2000 on the protection of individuals with regard to the processing of personal data by the community institutions and bodies and on the free movement of such data . __________________ 31 oj l 145 , 31 . 5 . 2001 , p . 43 . ### the sharing of information on risks and incidents within the cooperation network and compliance with the requirements to notify incidents to the national competent authorities or single points of contact may require the processing of personal data . such a processing of personal data is necessary to meet the objectives of public interest pursued by this directive and is thus legitimate under article 7 of directive 95 / 46 / ec . it does not constitute , in relation to these legitimate aims , a disproportionate and intolerable interference impairing the very substance of the right to the protection of personal data guaranteed by article 8 of the charter of fundamental rights . in the application of this directive , regulation no 1049 / 2001 of the european parliament and of the council of 30 may 2001 regarding public access to european parliament , council and commission documents31 should apply as appropriate . when data are processed by union institutions and bodies , such processing for the purpose of implementing this directive should comply with regulation no 45 / 2001 of the european parliament and of the council of 18 december 2000 on the protection of individuals with regard to the processing of personal data by the community institutions and bodies and on the free movement of such data . __________________ 31 oj l 145 , 31 . 5 . 2001 , p . 43 .


### creates a cooperation mechanism between member states in order to ensure a uniform application of this directive within the union and , where necessary , a coordinated and efficient handling of and response to risks and incidents affecting network and information systems ; ### creates a cooperation mechanism between member states in order to ensure a uniform application of this directive within the union and , where necessary , a coordinated and efficient handling of and response to risks and incidents affecting network and information systems with the participation of relevant stakeholders ;


### the sharing of information within the cooperation network under chapter iii and the notifications of nis incidents under article 14 may require the processing of personal data . such processing , which is necessary to meet the objectives of public interest pursued by this directive , shall be authorised by the member state pursuant to article 7 of directive 95 / 46 / ec and directive 2002 / 58 / ec , as implemented in national law . ### the sharing of information within the cooperation network under chapter iii and the notifications of nis incidents under article 14 may require the processing of personal data . market operators and public administrations should not be held liable for such processing , which is necessary to meet the objectives of public interest pursued by this directive , shall be authorised by the member state pursuant to article 7 of directive 95 / 46 / ec and directive 2002 / 58 / ec , as implemented in national law .


### any device or group of inter - connected or related devices , one or more of which , pursuant to a program , perform automatic processing of computer data , as well as ### any device or group of inter - connected or related devices , one or more of which , pursuant to a program , perform automatic processing of digital data , as well as


### computer data stored , processed , retrieved or transmitted by elements covered under point and for the purposes of their operation , use , protection and maintenance . ### digital data stored , processed , retrieved or transmitted by elements covered under point and for the purposes of their operation , use , protection and maintenance .


### ‘ security’ means the ability of a network and information system to resist , at a given level of confidence , accident or malicious action that compromise the availability , authenticity , integrity and confidentiality of stored or transmitted data or the related services offered by or accessible via that network and information system ; ### ‘ security’ means the ability of a network and information system to resist , at a given level of confidence , accident or malicious action that compromise the availability , authenticity , integrity and confidentiality of stored or transmitted data or the related services offered by or accessible via that network and information system ; ' security ' as defined here includes appropriate technical devices , solutions and operating procedures ensuring the security requirements set forth in this directive .


### ‘ incident handling’ means all procedures supporting the analysis , containment and response to an incident ; ### ‘ incident handling’ means all procedures supporting the detection , prevention , analysis , containment and response to an incident ;


### operator of critical infrastructure that are essential for the maintenance of vital economic and societal activities in the fields of energy , transport , banking , stock exchanges and health , a non exhaustive list of which is set out in annex ii . ### operator of infrastructure that are essential for the maintenance of vital economic and societal activities in the fields of energy , transport , banking , financial market infrastructures and health , and the disruption or destruction of which would have a significant negative impact in a member state as a result of the failure to maintain those functions , a non exhaustive list of which is set out in annex ii .


### a risk assessment plan to identify risks and assess the impacts of potential incidents ; ### a risk management framework including the identification , prioritisation , evaluation and treatment of risks , the assessment of the impacts of potential incidents , prevention and control options , and criteria for the choice of possible countermeasures ;


### the definition of the roles and responsibilities of the various actors involved in the implementation of the plan ; ### the definition of the roles and responsibilities of the various authorities and other actors involved in the implementation of the framework ;


### national competent authority on the security of network and information systems ### national competent authorities and single points of contact on the security of network and information systems


### each member state shall designate a national competent authority on the security of network and information systems . ### each member state shall designate one or more national competent authorities on the security of network and information systems .


### member states shall ensure that the competent authorities have adequate technical , financial and human resources to carry out in an effective and efficient manner the tasks assigned to them and thereby to fulfil the objectives of this directive . member states shall ensure the effective , efficient and secure cooperation of the competent authorities via the network referred to in article 8 . ### member states shall ensure that the competent authorities and the single points of contact have adequate technical , financial and human resources to carry out in an effective and efficient manner the tasks assigned to them and thereby to fulfil the objectives of this directive . member states shall ensure the effective , efficient and secure cooperation of the single points of contact via the network referred to in article 8 .


### member states shall ensure that the competent authorities receive the notifications of incidents from public administrations and market operators as specified under article 14 and are granted the implementation and enforcement powers referred to under article 15 . ### member states shall ensure that the competent authorities and single points of contact receive the notifications of incidents from public administrations and market operators as specified under article 14 and are granted the implementation and enforcement powers referred to under article 15 .


### the competent authorities shall consult and cooperate , whenever appropriate , with the relevant law enforcement national authorities and data protection authorities . ### the competent authorities and single points of contact shall consult and cooperate , whenever appropriate , with the relevant law enforcement national authorities and data protection authorities .


### each member state shall notify to the commission without delay the designation of the competent authority , its tasks , and any subsequent change thereto . each member state shall make public its designation of the competent authority . ### each member state shall notify to the commission without delay the designation of the competent authorities and the single point of contact , its tasks , and any subsequent change thereto . each member state shall make public its designation of the competent authorities .


### the cert shall act under the supervision of the competent authority , which shall regularly review the adequacy of its resources , its mandate and the effectiveness of its incident - handling process . ### the certs shall act under the supervision of the competent authority or the single point of contact , which shall regularly review the adequacy of its resources , its mandate and the effectiveness of its incident - handling process .


### jointly discuss and assess , at the request of a member state or the commission , the effectiveness of the certs , in particular when nis exercises are performed at union level ; ### jointly discuss and assess , at the request of a member state or the commission , the effectiveness of the certs , in particular when nis exercises are performed at union level and implement measures to resolve identified weaknesses without measurable delay ;


### within the cooperation network the competent authorities shall : ### within the cooperation network the single points of contact shall :


### jointly discuss and assess , at the request of a member state or the commission , the effectiveness of the certs , in particular when nis exercises are performed at union level ; ### jointly discuss and assess , at the request of enisa , a member state or the commission , the effectiveness of the certs , in particular when nis exercises are performed at union level ;


### the exchange of sensitive and confidential information within the cooperation network shall take place through a secure infrastructure . ### the exchange of sensitive and confidential information within the cooperation network shall take place through a secure infrastructure operated under the supervision of enisa .


### the commission shall be empowered to adopt delegated acts in accordance with article 18 concerning the definition of the criteria to be fulfilled for a member state to be authorized to participate to the secure information - sharing system , regarding : ### the commission shall be empowered to adopt implementing acts in accordance with article 19 concerning the definition of the criteria to be fulfilled for a single point of contact to be authorized to participate to the secure information - sharing system , regarding :


### the commission shall adopt , by means of implementing acts , decisions on the access of the member states to this secure infrastructure , pursuant to the criteria referred to in paragraph 2 and 3 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 19 . ### the commission shall adopt , by means of implementing acts , a common set of interconnections and security standards that single points of contact must meet in order to exchange information . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 19 .


### the competent authorities or the commission shall provide early warnings within the cooperation network on those risks and incidents that fulfil at least one of the following conditions : ### the competent authorities or the commission , under the coordination of enisa , shall provide early warnings within the cooperation network on those risks and incidents that fulfil at least one of the following conditions :


### the competent authorities or the commission shall provide early warnings within the cooperation network on those risks and incidents that fulfil at least one of the following conditions : ### the single points of contact or the commission shall provide early warnings within the cooperation network on those risks and incidents that fulfil at least one of the following conditions :


### they exceed or may exceed national response capacity ; ### the single point of contact assesses that the risk or incident potentially exceeds national response capacity and they grow rapidly or may grow rapidly in scale


### in the early warnings , the competent authorities and the commission shall communicate any relevant information in their possession that may be useful for assessing the risk or incident . ### in the early warnings , the single points of contact and the commission shall communicate without undue delay any relevant non - classified information in their possession that may be useful for assessing the risk or incident .


### at the request of a member state , or on its own initiative , the commission may request a member state to provide any relevant information on a specific risk or incident . ### at the request of a member state , or on its own initiative , the commission may request a member state to provide any relevant non - classified information on a specific risk or incident .


### following an early warning referred to in article 10 the competent authorities shall , after assessing the relevant information , agree on a coordinated response in accordance with the union nis cooperation plan referred to in article 12 . ### following an early warning referred to in article 10 the single points of contact shall , after assessing the relevant information , agree without undue delay on a coordinated response in accordance with the union nis cooperation plan referred to in article 12 .


### – a definition of the format and procedures for the collection and sharing of compatible and comparable information on risks and incidents by the competent authorities , ### – a definition of the format and procedures for the collection and sharing of compatible and comparable information on risks and incidents by the single points of contact ,


### the union nis cooperation plan shall be adopted no later than one year following the entry into force of this directive and shall be revised regularly . ### the union nis cooperation plan shall be adopted no later than one year following the entry into force of this directive and shall be revised regularly . results of each revision shall be reported to the european parliament .


### member states shall ensure that public administrations and market operators take appropriate technical and organisational measures to manage the risks posed to the security of the networks and information systems which they control and use in their operations . having regard to the state of the art , these measures shall guarantee a level of security appropriate to the risk presented . in particular , measures shall be taken to prevent and minimise the impact of incidents affecting their network and information system on the core services they provide and thus ensure the continuity of the services underpinned by those networks and information systems . ### member states shall ensure that public administrations and market operators take appropriate technical and organisational measures to detect and effectively manage the risks posed to the security of the networks and information systems which they control and use in their operations . having regard to the state of the art , these measures shall guarantee a level of security appropriate to the risk presented . in particular , measures shall be taken to prevent and minimise the impact of incidents affecting their network and information system on the core services they provide and thus ensure the continuity of the services underpinned by those networks and information systems .


### member states shall ensure that public administrations and market operators take appropriate technical and organisational measures to manage the risks posed to the security of the networks and information systems which they control and use in their operations . having regard to the state of the art , these measures shall guarantee a level of security appropriate to the risk presented . in particular , measures shall be taken to prevent and minimise the impact of incidents affecting their network and information system on the core services they provide and thus ensure the continuity of the services underpinned by those networks and information systems . ### member states shall ensure that public administrations and market operators take appropriate technical and organisational measures to manage the risks posed to the security of the networks and information systems which they control and use in their operations , accordingly the commission shall ensure that the european institutions also undertake the appropriate technical and organisational measures . having regard to the state of the art , these measures shall guarantee a level of security appropriate to the risk presented . in particular , measures shall be taken to prevent and minimise the impact of incidents affecting their network and information system on the core services they provide and thus ensure the continuity of the services underpinned by those networks and information systems .


### the competent authority may inform the public , or require the public administrations and market operators to do so , where it determines that disclosure of the incident is in the public interest . once a year , the competent authority shall submit a summary report to the cooperation network on the notifications received and the action taken in accordance with this paragraph . ### after consultation with the competent authority and the public administration and market operator concerned , the single point of contact may exceptionally inform the public about individual incidents , where public awareness is necessary to prevent an incident or deal with an ongoing incident , or where the market operator , subject to an incident , has refused to address a serious structural vulnerability related to that incident without undue delay . the single point of contact must properly justify such decision . the competent authority or the single point of contact shall , if reasonably possible , present the public administrations or the market operators that informed of the incident with strategic analysed information that will help overcome the security threat . once a year , the single point of contact shall submit a summary report to the cooperation network on the notifications received and the action taken in accordance with this paragraph . publicity of any individual incidents reported to the competent authorities and single points of contact should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the public administrations and market operators that reported them and can only take place after prior consultation .


### the competent authorities shall work in close cooperation with personal data protection authorities when addressing incidents resulting in personal data breaches . ### without prejudice to applicable data protection law , and in full consultation with the relevant data controllers and processors , the competent authorities and the single points of contact shall work in close cooperation with personal data protection authorities when addressing incidents resulting in personal data breaches .


### member states shall ensure that the competent authorities have the power to require market operators and public administrations to : ### member states shall ensure that the competent authorities and the single points of contact have the power to require market operators to :


### the competent authorities shall work in close cooperation with personal data protection authorities when addressing incidents resulting in personal data breaches . ### the competent authorities and the single points of contact shall work in close cooperation with personal data protection authorities when addressing incidents resulting in personal data breaches . the single points of contact and the data protection authorities shall develop , in cooperation with enisa , information exchange mechanisms and a single template to be used both for notifications under article 14 of this directive and regulation 95 / 46 of the european parliament and of the council on the protection of individuals with regard to the processing of personal data and on the free movement of such data .


### the commission shall periodically review the functioning of this directive and report to the european parliament and the council . the first report shall be submitted no later than three years after the date of transposition referred to in article 21 . for this purpose , the commission may request member states to provide information without undue delay . ### the commission shall periodically review the functioning of this directive and report to the european parliament and the council . the main focus of the review should be the provisions of annex ii , in particular the provisions regarding the internet enablers . the first report shall be submitted no later than two years after the date of transposition referred to in article 21 . for this purpose , the commission may request member states to provide information without undue delay . the review should also evaluate the voluntary incentives for stock listed companies set forth in this directive : the effectiveness of this voluntary approach is to be evaluated by the competent national authority every 2 years . results ought to be reported to the european commission without delay . should the voluntary approach aimed at protecting customers and investors interests not prove sufficient member states shall introduce legal obligations .


### requirements and tasks of the computer emergency response team ### requirements and tasks of the computer emergency response teams


### the requirements and tasks of the cert shall be adequately and clearly defined and supported by national policy and / or regulation . they shall include the following elements : ### the requirements and tasks of the certs shall be adequately and clearly defined and supported by national policy and / or regulation . they shall include the following elements :


### the cert shall ensure high availability of its communications services by avoiding single points of failure and have several means for being contacted and for contacting others . furthermore , the communication channels shall be clearly specified and well known to the constituency and cooperative partners . ### the certs shall ensure high availability of its communications services by avoiding single points of failure and have several means for being contacted and for contacting others at all times . furthermore , the communication channels shall be clearly specified and well known to the constituency and cooperative partners .


### – monitoring incidents at a national level , ### – detection and monitoring incidents at a national level ,


### list of market operators ### list of market operators - this list is non - exhaustive and shall be reviewed every 2 years :


### financial market infrastructures : stock exchanges and central counterparty clearing houses ### financial market infrastructures : regulated markets , multilateral trading facilities , organised trading facilities and central counterparty clearing houses


### in recent years the european commission has presented several reports taking stock of the situation concerning gender diversity in economic decision - making . the commission has encouraged publicly listed companies in the european union to increase the number of women on their boards by self - regulatory measures and to make concrete voluntary commitments in that regard . in its women ' s charter of 5 march 2010 , the european commission underlined that women still do not have full access to the sharing of power and decision - making in political and economic life and reaffirmed its commitment to use its powers to promote a fairer representation of women and men in positions of responsibility . improving the gender balance in decision - making was defined by the commission ' s strategy for equality between women and men 2010 - 2015 as one of its priority tasks . ### in recent years the european commission has presented several reports taking stock of the situation concerning gender diversity in economic decision - making . the commission has encouraged publicly listed companies in the european union to increase the number of women on their boards by self - regulatory measures and to make concrete voluntary commitments in that regard . in its women ' s charter of 5 march 2010 , the european commission reaffirmed its commitment to promote a fairer representation of women and men in positions of responsibility . improving the gender balance in decision - making was defined by the commission ' s strategy for equality between women and men 2010 - 2015 as one of its priority tasks .


### in the european pact for gender equality 2011 - 2020 , which was adopted on 7 march 2011 , the council acknowledged that gender equality policies are vital to economic growth , prosperity and competitiveness , reaffirmed its commitment to close the gender gaps with a view to meeting the objectives of the europe 2020 strategy , especially in three areas of great relevance to gender equality , namely employment , education and social inclusion , and urged action to promote the equal participation of women and men in decision - making at all levels and in all fields , in order to make full use of all available talent . ### in the european pact for gender equality 2011 - 2020 , which was adopted on 7 march 2011 , the council acknowledged that gender equality policies are vital to economic growth , prosperity and competitiveness , reaffirmed its commitment to close the gender gaps with a view to meeting the objectives of the europe 2020 strategy , and urged action to promote the equal participation of women and men in decision - making at all levels and in all fields , in order to make full use of all available talent .


### the efficient use of human capital is the most important determinant of an economy ' s competitiveness and is key to addressing the eu ' s demographic challenges , to competing successfully in a globalised economy and to ensuring a comparative advantage vis - à - vis third countries . the pool of highly trained and qualified women is constantly growing as evidenced by the fact that 60 per cent of university graduates are female . a continued failure to draw on this pool in appointments to economic decision - making positions would amount to a failure to fully exploit skilled human capital . ### the efficient use of human capital is an important determinant to compete successfully in a globalised economy and to ensure a comparative advantage vis - à - vis third countries . the pool of highly trained and qualified women is constantly growing as evidenced by the fact that 60 per cent of current university graduates are female . by drawing on this pool in future appointments to economic decision - making positions at all levels would contribute to better exploitation of capital .


### at company level , it is widely acknowledged that the presence of women on boards improves corporate governance , because team performance and the quality of decision - making are enhanced due to a more diverse and collective mind - set incorporating a wider range of perspectives and therefore reaching more balanced decisions . numerous studies have also shown that there is a positive relationship between gender diversity at top management level and a company ' s financial performance and profitability . enhancing female representation on the boards of publicly listed companies in the union can therefore have a positive impact on the performance of companies concerned . ### studies have shown that there can be a positive relationship between gender diversity at all levels and a company ' s performance and profitability . measures to encourage career progression for the underrepresented sex can therefore have a positive impact on the performance of companies concerned .


### despite the existing union legislation aimed at preventing and combating sex discrimination , the council recommendations aimed specifically at increasing the presence of women in economic decision - making and union - level actions encouraging self - regulation , women continue to be strongly outnumbered by men in the highest decision - making bodies of companies throughout the union . in the private sector and especially in listed companies this gender imbalance is particularly significant and acute . the commission ' s key indicator of gender representation on corporate boards shows that the proportion of women involved in top - level business decision - making remains very low . in january 2012 , women occupied on average just 13 . 7 per cent of board seats in the largest publicly listed companies in member states . among non - executive directors only 15 per cent were women . ### despite the existing union legislation aimed at preventing and combating sex discrimination , the council recommendations aimed at a more balanced participation of women and men in economic decision - making and union - level actions encouraging self - regulation , gender imbalance is still significant in the private sector .


### the union should therefore aim to increase the presence of women on company boards , in order both to boost economic growth and the competitiveness of european companies and to achieve effective gender equality on the labour market . this aim should be pursued through minimum requirements on positive action in the form of binding measures aiming at attaining a quantitative objective for the gender composition of boards of listed companies , in the view of the fact that member states and other countries which have chosen this or a similar method have achieved the best results in reducing the under - representation of women in economic decision - making positions . ### the union should therefore aim to increase gender balance in companies , in order both to boost economic growth and the competitiveness of european companies . this aim should be pursued through minimum requirements on positive action aiming at promoting gender balance at all levels .


### in line with that case - law , member states should ensure that the selection of the best qualified candidates for non - executive directors is based on a comparative analysis of the qualifications of each candidate on the basis of pre - established , clear , neutrally formulated and unambiguous criteria . examples of types of selection criteria that companies could apply include professional experience in managerial and / or supervisory tasks , knowledge in specific relevant areas such as finance , controlling or human resources management , leadership and communication skills and networking abilities . priority should be given to the candidate of the under - represented sex if that candidate is equally qualified as the candidate of the other sex in terms of suitability , competence and professional performance , and if an objective assessment taking account of all criteria specific to the individual candidates does not tilt the balance in favour of a candidate of the other sex . ### in line with that case - law , member states should ensure that the selection of the best qualified candidates for non - executive directors is based on a comparative analysis of the qualifications of each candidate on the basis of pre - established , clear , neutrally formulated and unambiguous criteria . examples of types of selection criteria that companies could apply include professional experience in managerial and / or supervisory tasks , knowledge in specific relevant areas such as finance , controlling or human resources management , leadership , international experience and communication skills and networking abilities . priority should be given to the candidate of the under - represented sex if that candidate is equally qualified as the candidate of the other sex in terms of suitability , competence and professional performance , and if an objective assessment taking account of all criteria specific to the individual candidates does not tilt the balance in favour of a candidate of the other sex .


### while some member states have taken regulatory action or encouraged self - regulation with mixed results , the majority of member states have not taken action or indicated their willingness to act in a way that would bring about sufficient improvement . projections based on a comprehensive analysis of all available information on past and current trends as well as intentions show that a balanced gender representation among non - executive board members across the union in line with the objectives set out in this directive will not be achieved by member states acting individually at any point in the foreseeable future . in the light of those circumstances and given the growing discrepancies between member states in terms of the representation of women and men on company boards , the gender balance on corporate boards across the union can only be improved through a common approach , and the potential for gender equality , competitiveness and growth can be better achieved through coordinated action at union level rather than through national initiatives of varying scope , ambition and effectiveness . since the objectives of this directive cannot be sufficiently achieved by the member states and can , therefore , by reason of the scale and effect of action , be better achieved at union level , the union may adopt measures in accordance with the principle of subsidiarity as set out in article 5 of the treaty on european union . ### while some member states have taken regulatory action or encouraged self - regulation with mixed results , the majority of member states have not taken action or indicated their willingness to act in a way that would bring about sufficient improvement in more gender balanced representation within companies at all levels . as these aims will not be achieved by member states acting individually and given the growing discrepancies between member states in terms of the representation of women and men within companies , the gender balance across the union can be more effectively improved through a common approach , and the potential for gender equality , competitiveness and growth can be better achieved through coordinated action at union level rather than through national initiatives of varying scope , ambition and effectiveness . since the objectives of this directive cannot be sufficiently achieved by the member states and can , therefore , by reason of the scale and effect of action , be better achieved at union level , the union may adopt measures in accordance with the principle of subsidiarity as set out in article 5 of the treaty on european union .


### in accordance with the principle of proportionality , as set out in that same article , this directive is limited to setting common objectives and principles and does not go beyond what is necessary in order to achieve those objectives . member states are given sufficient freedom to determine how the objectives laid down in this directive should best be achieved taking national circumstances into account , in particular rules and practices concerning recruitment for board positions . this directive does not interfere with the possibility for companies to appoint the most qualified board members , and it grants a sufficiently long period of adaptation for all listed companies . ### in accordance with the principle of proportionality , as set out in that same article , this directive is limited to setting common objectives and principles and does not go beyond what is necessary in order to achieve those objectives . member states are given sufficient freedom to determine how the objectives laid down in this directive should best be achieved taking national circumstances into account , in particular rules and practices concerning recruitment and promotion . this directive does not interfere with the possibility for companies to appoint the most qualified candidate , and it grants a sufficiently long period of adaptation for all companies .


### in accordance with the principle of proportionality , the objective to be met by listed companies should be limited in time and remain in force only until sustainable progress has been achieved in the gender composition of boards . for that reason , the commission should regularly review the application of this directive and report to the european parliament and the council . the directive is due to expire on 31 december 2028 . the commission should assess , in its review , if there is a need to extend the duration of the directive beyond that period . ### in order to achieve the aims of this directive , member states should cooperate with social partners and the management oft the company with the elected representatives of the employees . the commission should regularly review the application of this directive and report to the european parliament and the council .


### this directive lays down measures to ensure a more balanced representation of men and women among the non - executive directors of listed companies by establishing measures aimed at accelerated progress towards gender balance while allowing companies sufficient time to make the necessary arrangements . ### this directive lays down minimum requirements on positive action to ensure a more balanced representation of men and women within companies at all levels .


### member states shall ensure that listed companies are obliged to disclose , on the request of an unsuccessful candidate , the qualification criteria upon which the selection was based , the objective comparative assessment of those criteria and , where relevant , the considerations tilting the balance in favour of a candidate of the other sex . ### member states shall ensure that companies are obliged to disclose , on the request of an unsuccessful candidate , the qualification criteria upon which the selection was based , the objective comparative assessment of those criteria and , where relevant , the considerations tilting the balance in favour of a candidate of the other sex .


### member states shall take the necessary measures , in accordance with their national judicial systems , to ensure that where an unsuccessful candidate of the under - represented sex establishes facts from which it may be presumed that that candidate was equally qualified as the appointed candidate of the other sex , it shall be for the listed company to prove that there has been no breach of the rule laid down in paragraph 3 . ### member states shall take the necessary measures , in accordance with their national judicial systems , to ensure that where an unsuccessful candidate of the under - represented sex who considers him - or herself wronged because the provisions of paragraph 3 have not been applied to him or her produces evidence before a court or other competent authority that he or she was equally qualified as the appointed candidate of the other sex , it shall be for the listed company to prove that there has been no breach of the rule laid down in paragraph 3 .