### (14) in view of the interlinkages between cybersecurity and the physical security of entities , a coherent approach should be ensured between directive (eu) xxx/xxx of the european parliament and of the council17 and this directive. to achieve this , member states should ensure that critical entities , and equivalent entities , pursuant to directive (eu) xxx/xxx are considered to be essential entities under this directive. member states should also ensure that their cybersecurity strategies provide for a policy framework for enhanced coordination between the competent authority under this directive and the one under directive (eu) xxx/xxx in the context of information sharing on incidents and cyber threats and the exercise of supervisory tasks. authorities under both directives should cooperate and exchange information , particularly in relation to the identification of critical entities , cyber threats , cybersecurity risks , incidents affecting critical entities as well as on the cybersecurity measures taken by critical entities. upon request of competent authorities under directive (eu) xxx/xxx , competent authorities under this directive should be allowed to exercise their supervisory and enforcement powers on an essential entity identified as critical. both authorities should cooperate and exchange information for this purpose. ### (14) in view of the interlinkages between cybersecurity and the physical security of entities , a coherent approach should be ensured between directive (eu) xxx/xxx of the european parliament and of the council17 and this directive. to achieve this , member states should ensure that critical entities , and equivalent entities , pursuant to directive (eu) xxx/xxx are considered to be essential entities under this directive. member states should also ensure that their cybersecurity strategies provide for a policy framework for enhanced coordination between the competent authority under this directive and the one under directive (eu) xxx/xxx in the context of information sharing on incidents and cyber threats and the exercise of supervisory tasks. authorities under both directives should cooperate and exchange information on a regular basis , particularly in relation to the identification of critical entities , cyber threats , cybersecurity risks , incidents affecting critical entities as well as on the cybersecurity measures taken by critical entities. upon request of competent authorities under directive (eu) xxx/xxx , competent authorities under this directive should be allowed to exercise their supervisory and enforcement powers on an essential entity identified as critical. both authorities should cooperate and exchange information for this purpose.


### (15) upholding and preserving a reliable , resilient and secure domain name system (dns) is a key factor in maintaining the integrity of the internet and is essential for its continuous and stable operation , on which the digital economy and society depend. therefore , this directive should apply to all providers of dns services along the dns resolution chain , including operators of root name servers , top-level-domain (tld) name servers , authoritative name servers for domain names and recursive resolvers. ### (15) upholding and preserving a reliable , resilient and secure domain name system (dns) is a key factor in maintaining the integrity of the internet and is essential for its continuous and stable operation , on which the digital economy and society depend. therefore , this directive should apply to all providers of dns services along the dns resolution chain , including operators of root name servers , top-level-domain (tld) name servers , authoritative name servers for domain names and recursive resolvers , and privacy or proxy registration service providers , domain brokers or resellers , and any other services that are related to the registration of domain names.


### (20) those growing interdependencies are the result of an increasingly cross-border and interdependent network of service provision using key infrastructures across the union in the sectors of energy , transport , digital infrastructure , drinking and waste water , health , certain aspects of public administration , as well as space in as far as the provision of certain services depending on ground-based infrastructures that are owned , managed and operated either by member states or by private parties is concerned , therefore not covering infrastructures owned , managed or operated by or on behalf of the union as part of its space programmes. those interdependencies mean that any disruption , even one initially confined to one entity or one sector , can have cascading effects more broadly , potentially resulting in far-reaching and long-lasting negative impacts in the delivery of services across the internal market. the covid-19 pandemic has shown the vulnerability of our increasingly interdependent societies in the face of low-probability risks. ### (20) those growing interdependencies are the result of an increasingly cross-border and interdependent network of service provision using key infrastructures across the union in the sectors of energy , transport , digital infrastructure , drinking and waste water , health , certain aspects of public administration , as well as space in as far as the provision of certain services depending on ground-based infrastructures that are owned , managed and operated either by member states or by private parties is concerned , therefore not covering infrastructures owned , managed or operated by or on behalf of the union as part of its space programmes. infrastructure owned , managed or operated by or on behalf of the union as part of its space programmes is particularly important for the security of the union and its member states and the proper functioning of the union's common security and defence policy (csdp ) missions. such infrastructure is therefore to be adequately protected as set out in regulation (eu) 2021/696 of the european parliament and of the council.18a those interdependencies mean that any disruption , even one initially confined to one entity or one sector , can have cascading effects more broadly , potentially resulting in far-reaching and long-lasting negative impacts in the delivery of services across the internal market. the covid-19 pandemic has shown the vulnerability of our increasingly interdependent societies in the face of low-probability risks.


### (25) as regards personal data , csirts should be able to provide , in accordance with regulation (eu) 2016/679 of the european parliament and of the council19 as regards personal data , on behalf of and upon request by an entity under this directive , a proactive scanning of the network and information systems used for the provision of their services. member states should aim at ensuring an equal level of technical capabilities for all sectorial csirts. member states may request the assistance of the european union agency for cybersecurity (enisa) in developing national csirts. ### (25) as regards personal data , csirts should be able to provide , in accordance with regulation (eu) 2016/679 of the european parliament and of the council19 as regards personal data , on behalf of and upon request by an entity under this directive , or in case of a serious threat to national security , a proactive scanning of the network and information systems used for the provision of their services. the knowledge whether an entity runs a privileged management interface , affects the speed of undertaking mitigating actions. it is critical that an entity or a csirts upon an entity's request , have the ability to continuously discover , inventory , manage , and monitor all internet-facing assets , both on premises and in the cloud , to understand their overall organisational risk to newly discovered supply chain compromises or critical vulnerabilities. member states should aim at ensuring an equal level of technical capabilities for all sectorial csirts. member states may request the assistance of the european union agency for cybersecurity (enisa) in developing national csirts.


### (30) access to correct and timely information on vulnerabilities affecting ict products and services contributes to an enhanced cybersecurity risk management. in that regard , sources of publicly available information on vulnerabilities are an important tool for entities and their users , but also national competent authorities and csirts. for this reason , enisa should establish a vulnerability registry where , essential and important entities and their suppliers , as well as entities which do not fall in the scope of application of this directive may , on a voluntary basis , disclose vulnerabilities and provide the vulnerability information that allows users to take appropriate mitigating measures. ### (30) access to correct and timely information on vulnerabilities affecting ict products and services contributes to an enhanced cybersecurity risk management. in that regard , sources of publicly available information on vulnerabilities are an important tool for entities and their users , but also national competent authorities and csirts. for this reason , enisa should establish a vulnerability registry where , essential and important entities and their suppliers , as well as entities which do not fall in the scope of application of this directive may , on a voluntary basis , disclose vulnerabilities and provide the vulnerability information that allows users to take appropriate mitigating measures. in general , to encourage a culture of disclosure of incidents a voluntary disclosure should be without detriment to the reporting entity. any exchange of information shall preserve the confidentiality of that information and protect the security and commercial interests of essential or important entities


### (51) the internal market is more reliant on the functioning of the internet than ever before. the services of virtually all essential and important entities are dependent on services provided over the internet. in order to ensure the smooth provision of services provided by essential and important entities , it is important that public electronic communications networks , such as , for example , internet backbones or submarine communications cables , have appropriate cybersecurity measures in place and report incidents in relation thereto. ### (51) the internal market is more reliant on the functioning of the internet than ever before. the services of virtually all essential and important entities are dependent on services provided over the internet. in order to ensure the smooth provision of services provided by essential and important entities , it is important that public electronic communications networks , such as , for example , internet backbones or submarine communications cables , have appropriate cybersecurity measures in place and report security incidents as in article 2 (41) of the european electronic communications code (eecc).


### (53) in particular , providers of public electronic communications networks or publicly available electronic communications services , should inform the service recipients of particular and significant cyber threats and of measures they can take to protect the security of their communications , for instance by using specific types of software or encryption technologies. ### (53) in particular , providers of public electronic communications networks or publicly available electronic communications services , should inform the service recipients of particular and significant cyber threats and of measures they can take to protect the security of their communications , for instance by using specific types of software or data-centric security techniques.


### (54) in order to safeguard the security of electronic communications networks and services , the use of encryption , and in particular end-to-end encryption , should be promoted and , where necessary , should be mandatory for providers of such services and networks in accordance with the principles of security and privacy by default and by design for the purposes of article 18. the use of end-to-end encryption should be reconciled with the member state’ powers to ensure the protection of their essential security interests and public security , and to permit the investigation , detection and prosecution of criminal offences in compliance with union law. solutions for lawful access to information in end-to-end encrypted communications should maintain the effectiveness of encryption in protecting privacy and security of communications , while providing an effective response to crime. ### (54) in order to safeguard the security of electronic communications networks and services , the use of data-centric security techniques , such as encryption , tokenisation , segmentation , throttle access , marking , tagging , strong identity and access management , and automated access decisions , should be promoted for providers of such services and networks in accordance with the principles of security and privacy by default and by design for the purposes of article 18. the use of end-to-end encryption should be reconciled with the member state’ powers to ensure the protection of their essential security interests and public security , and to permit the investigation , detection and prosecution of criminal offences in compliance with union law. solutions for lawful access to information in end-to-end encrypted communications should maintain the effectiveness of encryption in protecting privacy and security of communications , while providing an effective response to crime.


### (55) this directive lays down a two-stage approach to incident reporting in order to strike the right balance between , on the one hand , swift reporting that helps mitigate the potential spread of incidents and allows entities to seek support , and , on the other hand , in-depth reporting that draws valuable lessons from individual incidents and improves over time the resilience to cyber threats of individual companies and entire sectors. where entities become aware of an incident , they should be required to submit an initial notification within 24 hours , followed by a final report not later than one month after. the initial notification should only include the information strictly necessary to make the competent authorities aware of the incident and allow the entity to seek assistance , if required. such notification , where applicable , should indicate whether the incident is presumably caused by unlawful or malicious action. member states should ensure that the requirement to submit this initial notification does not divert the reporting entity’s resources from activities related to incident handling that should be prioritised. to further prevent that incident reporting obligations either divert resources from incident response handling or may otherwise compromise the entities efforts in that respect , member states should also provide that , in duly justified cases and in agreement with the competent authorities or the csirt , the entity concerned can deviate from the deadlines of 24 hours for the initial notification and one month for the final report. ### (55) this directive lays down a two-stage approach to incident reporting in order to strike the right balance between , on the one hand , swift reporting that helps mitigate the potential spread of incidents and allows entities to seek support , and , on the other hand , in-depth reporting that draws valuable lessons from individual incidents and improves over time the resilience to cyber threats of individual companies and entire sectors. where entities become aware of an incident , they should be required to submit an initial notification within 72 hours , followed by a final report not later than one month after. the initial notification should only include the information strictly necessary to make the competent authorities aware of the incident and allow the entity to seek assistance , if required. such notification , where applicable , should indicate whether the incident is presumably caused by unlawful or malicious action. member states should ensure that the requirement to submit this initial notification does not divert the reporting entity’s resources from activities related to incident handling that should be prioritised. to further prevent that incident reporting obligations either divert resources from incident response handling or may otherwise compromise the entities efforts in that respect , member states should also provide that , in duly justified cases and in agreement with the competent authorities or the csirt , the entity concerned can deviate from the deadlines of 72 hours for the initial notification and one month for the final report.


### (55) this directive lays down a two-stage approach to incident reporting in order to strike the right balance between , on the one hand , swift reporting that helps mitigate the potential spread of incidents and allows entities to seek support , and , on the other hand , in-depth reporting that draws valuable lessons from individual incidents and improves over time the resilience to cyber threats of individual companies and entire sectors. where entities become aware of an incident , they should be required to submit an initial notification within 24 hours , followed by a final report not later than one month after. the initial notification should only include the information strictly necessary to make the competent authorities aware of the incident and allow the entity to seek assistance , if required. such notification , where applicable , should indicate whether the incident is presumably caused by unlawful or malicious action. member states should ensure that the requirement to submit this initial notification does not divert the reporting entity’s resources from activities related to incident handling that should be prioritised. to further prevent that incident reporting obligations either divert resources from incident response handling or may otherwise compromise the entities efforts in that respect , member states should also provide that , in duly justified cases and in agreement with the competent authorities or the csirt , the entity concerned can deviate from the deadlines of 24 hours for the initial notification and one month for the final report. ### (55) this directive lays down a two-stage approach to incident reporting in order to strike the right balance between , on the one hand , swift reporting that helps mitigate the potential spread of incidents and allows entities to seek support , and , on the other hand , in-depth reporting that draws valuable lessons from individual incidents and improves over time the resilience to cyber threats of individual companies and entire sectors. in this regard , the directive should also include reporting of incidents that , based on an initial assessment performed by the entity , may be assumed to lead to substantial operational disruption or financial losses or affect other natural or legal persons by causing considerable material or non-material losses. the initial assessment should take into account amongst other , the affected network and information systems and in particular their importance in the provision of the entity’s services , the severity and technical characteristics of the cyber threat , and any underlying vulnerabilities that are being exploited as well as the entity’s experience with similar incidents. where entities become aware of an incident , they should be required to submit an initial notification within 72 hours , followed by a report not later than three months after. the initial notification should only include the information strictly necessary to make the competent authorities aware of the incident and allow the entity to seek assistance , if required. such notification , where applicable , should indicate whether the incident is presumably caused by unlawful or malicious action. to further prevent that incident reporting obligations either divert resources from incident response handling or may otherwise compromise the entities efforts in that respect , member states should also provide that , in duly justified cases and in agreement with the competent authorities or the csirt , the entity concerned can deviate from the deadlines of 72 hours for the initial notification and three months for the report.


### (59) maintaining accurate and complete databases of domain names and registration data (so called ‘whois data’) and providing lawful access to such data is essential to ensure the security , stability and resilience of the dns , which in turn contributes to a high common level of cybersecurity within the union. where processing includes personal data such processing shall comply with union data protection law. ### (59) maintaining accurate , verified and complete databases of domain names and registration data (so called ‘whois data’) and providing lawful access to such data is essential to ensure the security , stability and resilience of the dns , which in turn contributes to a high common level of cybersecurity within the union. where processing includes personal data such processing shall comply with union data protection law.


### (59) maintaining accurate and complete databases of domain names and registration data (so called ‘whois data’) and providing lawful access to such data is essential to ensure the security , stability and resilience of the dns , which in turn contributes to a high common level of cybersecurity within the union. where processing includes personal data such processing shall comply with union data protection law. ### (59) maintaining accurate , verified and complete databases of domain names and registration data (so called “whois data”) and providing lawful access to such data is essential to ensure the security , stability and resilience of the dns , so that third-party rights could be protected and which in turn contributes to a high common level of cybersecurity within the union. where processing includes personal data such processing shall comply with union data protection law.


### (61) in order to ensure the availability of accurate and complete domain name registration data , tld registries and the entities providing domain name registration services for the tld (so-called registrars) should collect and guarantee the integrity and availability of domain names registration data. in particular , tld registries and the entities providing domain name registration services for the tld should establish policies and procedures to collect and maintain accurate and complete registration data , as well as to prevent and correct inaccurate registration data in accordance with union data protection rules. ### (61) in order to ensure the availability of accurate and complete domain name registration data , tld registries and the entities providing domain name registration services (including services provided by domain name registries and registrars , privacy or proxy registration service providers , domain brokers or resellers , and any other services which are related to the registration of domain names) should collect and guarantee the integrity and availability of domain names registration data. in particular , tld registries and the entities providing domain name registration services for the tld should establish policies and procedures to collect and maintain accurate and complete registration data , as well as to prevent and correct inaccurate registration data in accordance with union data protection rules.


### (62) tld registries and the entities providing domain name registration services for them should make publically available domain name registration data that fall outside the scope of union data protection rules , such as data that concern legal persons25 . tld registries and the entities providing domain name registration services for the tld should also enable lawful access to specific domain name registration data concerning natural persons to legitimate access seekers , in accordance with union data protection law. member states should ensure that tld registries and the entities providing domain name registration services for them should respond without undue delay to requests from legitimate access seekers for the disclosure of domain name registration data. tld registries and the entities providing domain name registration services for them should establish policies and procedures for the publication and disclosure of registration data , including service level agreements to deal with requests for access from legitimate access seekers. the access procedure may also include the use of an interface , portal or other technical tool to provide an efficient system for requesting and accessing registration data. with a view to promoting harmonised practices across the internal market , the commission may adopt guidelines on such procedures without prejudice to the competences of the european data protection board. ### (62) tld registries and the entities providing domain name registration services for them should make publically available domain name registration data that fall outside the scope of union data protection rules , such as data that concern legal persons25 . tld registries and the entities providing domain name registration services for the tld should also enable lawful access to specific domain name registration data concerning natural persons to legitimate access seekers , in accordance with union data protection law. member states should ensure that tld registries and the entities providing domain name registration services for them should respond without undue delay and in any event within 24 hours to requests from legitimate access seekers for the disclosure of domain name registration data. tld registries and the entities providing domain name registration services for them should establish policies and procedures for the publication and disclosure of registration data , including service level agreements to deal with requests for access from legitimate access seekers. the access procedure may also include the use of an interface , portal or other technical tool to provide an efficient system for requesting and accessing registration data. with a view to promoting harmonised practices across the internal market , the commission may adopt guidelines on such procedures without prejudice to the competences of the european data protection board.


### (68) entities should be encouraged to collectively leverage their individual knowledge and practical experience at strategic , tactical and operational levels with a view to enhance their capabilities to adequately assess , monitor , defend against , and respond to , cyber threats. it is thus necessary to enable the emergence at union level of mechanisms for voluntary information sharing arrangements. to this end , member states should actively support and encourage also relevant entities not covered by the scope of this directive to participate in such information-sharing mechanisms. those mechanisms should be conducted in full compliance with the competition rules of the union as well as the data protection union law rules. ### (68) entities should be encouraged and supported by member states to collectively leverage their individual knowledge and practical experience at strategic , tactical and operational levels with a view to enhance their capabilities to adequately assess , monitor , defend against , and respond to , cyber threats. it is thus necessary to enable the emergence at union level of mechanisms for voluntary information sharing arrangements that are based on already established internationally recognised standards. to this end , member states should actively support and encourage also relevant entities not covered by the scope of this directive to participate in such information-sharing mechanisms. those mechanisms should be conducted in full compliance with the competition rules of the union as well as the data protection union law rules.


### (68) entities should be encouraged to collectively leverage their individual knowledge and practical experience at strategic , tactical and operational levels with a view to enhance their capabilities to adequately assess , monitor , defend against , and respond to , cyber threats. it is thus necessary to enable the emergence at union level of mechanisms for voluntary information sharing arrangements. to this end , member states should actively support and encourage also relevant entities not covered by the scope of this directive to participate in such information-sharing mechanisms. those mechanisms should be conducted in full compliance with the competition rules of the union as well as the data protection union law rules. ### (68) entities should be encouraged to collectively leverage their individual knowledge and practical experience at strategic , tactical and operational levels with a view to enhance their capabilities to adequately assess , monitor , defend against , and respond to , cyber threats. it is thus necessary to enable the emergence at union level of mechanisms for voluntary information sharing arrangements. to this end , member states should actively support and encourage also relevant entities not covered by the scope of this directive to participate in such information-sharing mechanisms. in addition , member states could also explore the possibility of including entities from like-minded partner countries in the information-sharing mechanisms. those mechanisms should be conducted in full compliance with the competition rules of the union as well as the data protection union law rules.


### (69) the processing of personal data , to the extent strictly necessary and proportionate for the purposes of ensuring network and information security by entities , public authorities , certs , csirts , and providers of security technologies and services should constitute a legitimate interest of the data controller concerned , as referred to in regulation (eu) 2016/679. that should include measures related to the prevention , detection , analysis and response to incidents , measures to raise awareness in relation to specific cyber threats , exchange of information in the context of vulnerability remediation and coordinated disclosure , as well as the voluntary exchange of information on those incidents , as well as cyber threats and vulnerabilities , indicators of compromise , tactics , techniques and procedures , cybersecurity alerts and configuration tools. such measures may require the processing of the following types of personal data: ip addresses , uniform resources locators (urls) , domain names , and email addresses. ### (69) the processing of personal data , to the extent strictly necessary and proportionate for the purposes of ensuring network and information security by entities , public authorities , certs , csirts , and providers of security technologies and services should constitute a legitimate interest of the data controller concerned , as referred to in regulation (eu) 2016/679. that should include measures related to the prevention , detection , identification , containment , analysis and response to incidents , measures to raise awareness in relation to specific cyber threats , exchange of information in the context of vulnerability remediation and coordinated disclosure , as well as the voluntary exchange of information on those incidents , as well as cyber threats and vulnerabilities , indicators of compromise , tactics , techniques and procedures , cybersecurity alerts and configuration tools. such measures may require the processing of personal data.


### (70) in order to strengthen the supervisory powers and actions that help ensure effective compliance , this directive should provide for a minimum list of supervisory actions and means through which competent authorities may supervise essential and important entities. in addition , this directive should establish a differentiation of supervisory regime between essential and important entities with a view to ensuring a fair balance of obligations for both entities and competent authorities. thus , essential entities should be subject to a fully-fledged supervisory regime (ex-ante and ex-post) , while important entities should be subject to a light supervisory regime , ex-post only. for the latter , this means that important entities should not document systematically compliance with cybersecurity risk management requirements , while competent authorities should implement a reactive ex -post approach to supervision and , hence , not have a general obligation to supervise those entities. ### (70) in order to strengthen the supervisory powers and actions that help ensure effective compliance and to achieve a common high level of security throughout the digital sector including by preventing risks for users or other networks , information systems and services , this directive should provide for a minimum list of supervisory actions and means through which competent authorities may supervise essential and important entities. in addition , this directive should establish a differentiation of supervisory regime between essential and important entities with a view to ensuring a fair balance of obligations for both entities and competent authorities. thus , essential entities should be subject to a fully-fledged supervisory regime (ex-ante and ex-post) , while important entities should be subject to a light supervisory regime , ex-post only. for the latter , this means that important entities should not document systematically compliance with cybersecurity risk management requirements , while competent authorities should implement a reactive ex -post approach to supervision and , hence , not have a general obligation to supervise those entities except where there is a demonstrable breach of obligations.


### (70) in order to strengthen the supervisory powers and actions that help ensure effective compliance , this directive should provide for a minimum list of supervisory actions and means through which competent authorities may supervise essential and important entities. in addition , this directive should establish a differentiation of supervisory regime between essential and important entities with a view to ensuring a fair balance of obligations for both entities and competent authorities. thus , essential entities should be subject to a fully-fledged supervisory regime (ex-ante and ex-post) , while important entities should be subject to a light supervisory regime , ex-post only. for the latter , this means that important entities should not document systematically compliance with cybersecurity risk management requirements , while competent authorities should implement a reactive ex -post approach to supervision and , hence , not have a general obligation to supervise those entities. ### (70) in order to strengthen the supervisory powers and actions that help ensure effective compliance , this directive should provide for a minimum list of supervisory actions and means through which competent authorities may supervise essential and important entities. the supervisory regime shall , amongst other issues , verify that essential and important entities take appropriate technical and organisational measures to manage the risks posed to the security of network and information systems by implementing basic computer hygiene practices such as software updates , device configuration , network segmentation , identity and access management or user awareness and training regarding corporate email cyber threats , phishing or social engineering techniques. in addition , this directive should establish a differentiation of supervisory regime between essential and important entities with a view to ensuring a fair balance of obligations for both entities and competent authorities. thus , essential entities should be subject to a fully-fledged supervisory regime (ex-ante and ex-post) , while important entities should be subject to a light supervisory regime , ex-post only. for the latter , this means that important entities should not document systematically compliance with cybersecurity risk management requirements , while competent authorities should implement a reactive ex -post approach to supervision and , hence , not have a general obligation to supervise those entities.


### (76) in order to further strengthen the effectiveness and dissuasiveness of the penalties applicable to infringements of obligations laid down pursuant to this directive , the competent authorities should be empowered to apply sanctions consisting of the suspension of a certification or authorisation concerning part or all the services provided by an essential entity and the imposition of a temporary ban from the exercise of managerial functions by a natural person. given their severity and impact on the entities’ activities and ultimately on their consumers , such sanctions should only be applied proportionally to the severity of the infringement and taking account of the specific circumstances of each case , including the intentional or negligent character of the infringement , actions taken to prevent or mitigate the damage and/or losses suffered. such sanctions should only be applied as ultima ratio , meaning only after the other relevant enforcement actions laid down by this directive have been exhausted , and only for the time until the entities to which they apply take the necessary action to remedy the deficiencies or comply with the requirements of the competent authority for which such sanctions were applied. the imposition of such sanctions shall be subject to appropriate procedural safeguards in accordance with the general principles of union law and the charter of fundamental rights of the european union , including effective judicial protection , due process , presumption of innocence and right of defence. ### (76) in order to further strengthen the effectiveness and dissuasiveness of the penalties applicable to infringements of obligations laid down pursuant to this directive , the competent authorities should be empowered to apply sanctions consisting of the suspension of a certification or authorisation concerning part or all the services provided by an essential entity. given their severity and impact on the entities’ activities and ultimately on their consumers , such sanctions should only be applied proportionally to the severity of the infringement and taking account of the specific circumstances of each case , including the intentional or negligent character of the infringement , actions taken to prevent or mitigate the damage and/or losses suffered. such sanctions should only be applied as ultima ratio , meaning only after the other relevant enforcement actions laid down by this directive have been exhausted , and only for the time until the entities to which they apply take the necessary action to remedy the deficiencies or comply with the requirements of the competent authority for which such sanctions were applied. the imposition of such sanctions shall be subject to appropriate procedural safeguards in accordance with the general principles of union law and the charter of fundamental rights of the european union , including effective judicial protection , due process , presumption of innocence and right of defence.


### 1. this directive lays down measures with a view to ensuring a high common level of cybersecurity within the union. ### 1. this directive lays down measures with a view to ensuring a high common level of cybersecurity within the union to ensure a trustworthy digital environment for consumers and business and to improve and remove barriers to the functioning of the internal market.


### 1. this directive applies to public and private entities of a type referred to as essential entities in annex i and as important entities in annex ii. this directive does not apply to entities that qualify as micro and small enterprises within the meaning of commission recommendation 2003/361/ec.28 ### 1. this directive applies to public and private entities of a type referred to as essential entities in annex i and as important entities in annex ii in so far as they carry out in-scope activities within the union. this directive does not apply to entities that qualify as micro and small enterprises within the meaning of commission recommendation 2003/361/ec.28


### 1. this directive applies to public and private entities of a type referred to as essential entities in annex i and as important entities in annex ii. this directive does not apply to entities that qualify as micro and small enterprises within the meaning of commission recommendation 2003/361/ec.28 ### 1. this directive applies to public and private entities of a type referred to as essential entities in annex i and as important entities in annex ii , including manufacturers and providers of ict products. this directive does not apply to entities that qualify as micro and small enterprises within the meaning of commission recommendation 2003/361/ec.28


### a policy to promote and facilitate coordinated vulnerability disclosure within the meaning of article 6; ### a policy to promote and facilitate coordinated vulnerability disclosure within the meaning of article 6 including by laying down guidelines and best practices based on already established internationally recognised standards on vulnerability handling and disclosure;


### a policy on supporting academic and research institutions to develop cybersecurity tools and secure network infrastructure; ### a policy on supporting academic and research institutions to develop and enhance cybersecurity tools and secure network infrastructure;


### a policy addressing specific needs of smes , in particular those excluded from the scope of this directive , in relation to guidance and support in improving their resilience to cybersecurity threats. ### a policy promoting cybersecurity and addressing the specific needs of smes , in particular those excluded from the scope of this directive , in relation to guidance and support in improving their resilience to cybersecurity threats including , for example funding and education to support the uptake of cybersecurity measures;


### a policy addressing specific needs of smes , in particular those excluded from the scope of this directive , in relation to guidance and support in improving their resilience to cybersecurity threats. ### a policy addressing specific needs of smes , in particular those excluded from the scope of this directive , in relation to guidance , providing necessary and comprehensive information and support in improving their resilience to cybersecurity threats.


### a policy addressing specific needs of smes , in particular those excluded from the scope of this directive , in relation to guidance and support in improving their resilience to cybersecurity threats. ### a policy promoting cybersecurity and addressing specific needs of smes , in particular those excluded from the scope of this directive , including guidance and support in improving their resilience to cybersecurity threats.


### 2. enisa shall develop and maintain a european vulnerability registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures with a view in particular to enabling important and essential entities and their suppliers of network and information systems to disclose and register vulnerabilities present in ict products or ict services , as well as to provide access to the information on vulnerabilities contained in the registry to all interested parties. the registry shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , the availability of related patches and , in the absence of available patches , guidance addressed to users of vulnerable products and services as to how the risks resulting from disclosed vulnerabilities may be mitigated. ### 2. enisa shall develop and maintain a european vulnerability registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures with a view in particular to enabling important and essential entities and their suppliers of network and information systems to disclose and register only those vulnerabilities present in ict products or ict services that have a mitigation available , as well as to provide access to the information on vulnerabilities contained in the registry to all interested parties. the registry shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , the availability of related patches and , in the absence of available patches , guidance addressed to users of vulnerable products and services as to how the risks resulting from disclosed vulnerabilities may be mitigated. when several users are affected by the same vulnerability , enisa should coordinate the schedule of the installation of the mitigation patches.


### 2. enisa shall develop and maintain a european vulnerability registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures with a view in particular to enabling important and essential entities and their suppliers of network and information systems to disclose and register vulnerabilities present in ict products or ict services , as well as to provide access to the information on vulnerabilities contained in the registry to all interested parties. the registry shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , the availability of related patches and , in the absence of available patches , guidance addressed to users of vulnerable products and services as to how the risks resulting from disclosed vulnerabilities may be mitigated. ### 2. enisa shall develop and maintain a european vulnerability registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures with a view in particular to enabling important and essential entities and their suppliers of network and information systems to disclose and register vulnerabilities present in ict products or ict services , as well as to provide access to the information on vulnerabilities contained in the registry to all interested parties. the registry shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , the availability of related patches and , in the absence of available patches , enisa should not disclose the vulnerability and impose a deadline to manufacturers or providers of ict products or ict services to provide a reliable mitigation. when several players are affected by the same vulnerability , enisa should coordinate the schedule of the installation of the mitigation patches.


### 1. the commission shall establish , after consulting the cooperation group and enisa , and at the latest by 18 months following the entry into force of this directive , the methodology and content of a peer-review system for assessing the effectiveness of the member states’ cybersecurity policies. the reviews shall be conducted by cybersecurity technical experts drawn from member states different than the one reviewed and shall cover at least the following: ### 1. the commission shall establish , after consulting the cooperation group and enisa , and at the latest by 18 months following the entry into force of this directive , the methodology and content of a peer-review system for assessing the effectiveness of the member states’ cybersecurity policies. the reviews shall be conducted by cybersecurity technical experts drawn from member states different than the one reviewed , in consultation with enisa , and shall cover at least the following:


### 7. experts participating in peer reviews shall draft reports on the findings and conclusions of the reviews. the reports shall be submitted to the commission , the cooperation group , the csirts network and enisa. the reports shall be discussed in the cooperation group and the csirts network. the reports may be published on the dedicated website of the cooperation group. ### 7. experts participating in peer reviews shall draft reports on the findings and conclusions of the reviews. the reports shall be submitted to the commission , the cooperation group , the csirts network and enisa. the reports shall be discussed in the cooperation group and the csirts network.


### 1. member states shall ensure that essential and important entities shall take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which those entities use in the provision of their services. having regard to the state of the art , those measures shall ensure a level of security of network and information systems appropriate to the risk presented. ### 1. member states shall ensure that essential and important entities shall take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of networks , information systems and services. having regard to the state of the art , those measures shall ensure a level of security of network and information systems appropriate to the risk presented.


### 1. member states shall ensure that essential and important entities shall take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which those entities use in the provision of their services. having regard to the state of the art , those measures shall ensure a level of security of network and information systems appropriate to the risk presented. ### 1. member states shall ensure that essential and important entities shall take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which those entities use in the provision of their services. the corrective measures should be appropriate and proportionate in terms of time and effort , according to risk analysis. having regard to the state of the art and to international standards (such as iso31000 and isa/iec 27005) , those measures shall ensure a level of security of network and information systems appropriate to the risk presented.


### 1. member states shall ensure that essential and important entities shall take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which those entities use in the provision of their services. having regard to the state of the art , those measures shall ensure a level of security of network and information systems appropriate to the risk presented. ### 1. member states shall ensure that essential and important entities , including manufacturers and providers of ict products , shall take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which those entities use in the provision of their services. having regard to the state of the art , those measures shall ensure a level of security of network and information systems appropriate to the risk presented.


### policies and procedures (testing and auditing) to assess the effectiveness of cybersecurity risk management measures; ### policies and procedures (training , testing and auditing) to assess the effectiveness of cybersecurity risk management measures;


### the use of cryptography and encryption. ### support the use of cryptography and encryption , where appropriate.


### 3. member states shall ensure that , where considering appropriate measures referred to in point (d) of paragraph 2 , entities shall take into account the vulnerabilities specific to each supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers , including their secure development procedures. ### 3. member states shall ensure that , where considering appropriate measures referred to in point (d) of paragraph 2 , entities shall take into account the vulnerabilities specific to each first-level supplier and service provider and the overall quality of products and cybersecurity practices of their first-level suppliers and service providers , including their secure development procedures.


### 2. the commission , after consulting with the cooperation group and enisa , shall identify the specific critical ict services , systems or products that may be subject to the coordinated risk assessment referred to in paragraph 1. ### 2. the commission , after consulting with the cooperation group and enisa , shall identify the specific critical ict and ics services , systems or products that may be subject to the coordinated risk assessment referred to in paragraph 1.


### where applicable , those entities shall notify , without undue delay , the recipients of their services that are potentially affected by a significant cyber threat of any measures or remedies that those recipients can take in response to that threat. where appropriate , the entities shall also notify those recipients of the threat itself. the notification shall not make the notifying entity subject to increased liability. ### where applicable , those entities may notify the recipients of their services that are potentially affected by a significant cyber threat of any measures or remedies that those recipients can take in response to that threat. the notification shall not make the notifying entity subject to increased liability.


### 2. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt of any significant cyber threat that those entities identify that could have potentially resulted in a significant incident. ### deleted


### the incident has caused or has the potential to cause substantial operational disruption or financial losses for the entity concerned; ### the incident has caused or substantial operational disruption or financial losses for the entity concerned , or would have caused such , had it not been prevented;


### the incident has affected or has the potential to affect other natural or legal persons by causing considerable material or non-material losses. ### the incident has affected other natural or legal persons by causing considerable material or non-material losses , or would have caused such , had it not been prevented.


### without undue delay and in any event within 24 hours after having become aware of the incident , an initial notification , which , where applicable , shall indicate whether the incident is presumably caused by unlawful or malicious action; ### without undue delay and in any event no later than 72 hours after having become aware of the incident , an initial notification , which , where applicable , shall indicate whether the incident is presumably caused by unlawful or malicious action;


### a final report not later than one month after the submission of the report under point (a) , including at least the following: ### a comprehensive report not later than three months after the submission of the report under point (a) , including at least the following:


### a final report not later than one month after the submission of the report under point (a) , including at least the following: ### a status report not later than three months for an essential entity and no later than four months for an important entity after the submission of the initial notification under point (a) , including at least the following:


### 5. the competent national authorities or the csirt shall provide , within 24 hours after receiving the initial notification referred to in point (a) of paragraph 4 , a response to the notifying entity , including initial feedback on the incident and , upon request of the entity , guidance on the implementation of possible mitigation measures. where the csirt did not receive the notification referred to in paragraph 1 , the guidance shall be provided by the competent authority in collaboration with the csirt. the csirt shall provide additional technical support if the concerned entity so requests. where the incident is suspected to be of criminal nature , the competent national authorities or the csirt shall also provide guidance on reporting the incident to law enforcement authorities. ### 5. the competent national authorities or the csirt shall provide , within 24 hours after receiving the initial notification referred to in point (a) of paragraph 4 , a response to the notifying entity , including initial feedback on the incident and , upon request of the entity , guidance and actionable advice on the implementation of possible mitigation measures. where the csirt did not receive the notification referred to in paragraph 1 , the guidance and actionable advice shall be provided by the competent authority in collaboration with the csirt. the csirt shall provide additional technical support if the concerned entity so requests. where the incident is suspected to be of criminal nature , the competent national authorities or the csirt shall also provide guidance on reporting the incident to law enforcement authorities.


### 7. where public awareness is necessary to prevent an incident or to deal with an ongoing incident , or where disclosure of the incident is otherwise in the public interest , the competent authority or the csirt , and where appropriate the authorities or the csirts of other member states concerned may , after consulting the entity concerned , inform the public about the incident or require the entity to do so. ### 7. where public awareness is necessary to prevent an incident or to deal with an ongoing incident , or where disclosure of the incident is otherwise in the public interest , the competent authority or the csirt , and where appropriate the authorities or the csirts of other member states concerned may require the entity to inform the public about the incident.


### 1. in order to demonstrate compliance with certain requirements of article 18 , member states may require essential and important entities to certify certain ict products , ict services and ict processes under specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881. the products , services and processes subject to certification may be developed by an essential or important entity or procured from third parties. ### 1. in order to demonstrate compliance with certain requirements of article 18 , member states shall encourage essential and important entities to certify certain ict products , ict services and ict processes , either developed by the essential or important entity or procured from third parties , under european cybersecurity schemes adopted pursuant to article 49 of regulation (eu) 2019/881 or under similar internationally recognised certification schemes.


### 1. in order to demonstrate compliance with certain requirements of article 18 , member states may require essential and important entities to certify certain ict products , ict services and ict processes under specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881. the products , services and processes subject to certification may be developed by an essential or important entity or procured from third parties. ### 1. in order to demonstrate compliance with certain requirements of article 18 , member states shall encourage essential and important entities to certify certain ict products , ict services and ict processes under specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881. the products , services and processes subject to certification may be developed by an essential or important entity or procured from third parties.


### 2. the commission shall be empowered to adopt delegated acts specifying which categories of essential entities shall be required to obtain a certificate and under which specific european cybersecurity certification schemes pursuant to paragraph 1. the delegated acts shall be adopted in accordance with article 36. ### deleted


### 3. the commission may request enisa to prepare a candidate scheme pursuant to article 48(2) of regulation (eu) 2019/881 in cases where no appropriate european cybersecurity certification scheme for the purposes of paragraph 2 is available. ### 3. the commission , after consulting the cooperation group and the european cybersecurity certification group , may request enisa to prepare a candidate scheme pursuant to article 48(2) of regulation (eu) 2019/881.


### 1. for the purpose of contributing to the security , stability and resilience of the dns , member states shall ensure that tld registries and the entities providing domain name registration services for the tld shall collect and maintain accurate and complete domain name registration data in a dedicated database facility with due diligence subject to union data protection law as regards data which are personal data. ### 1. for the purpose of contributing to the security , stability and resilience of the dns , member states shall ensure that tld registries and entities providing domain name registration services , shall collect , verify and maintain accurate and complete domain name registration data in a dedicated database facility with due diligence subject to union data protection law as regards data which are personal data. this should take place as a pre-requisite to engaging in domain name registration services as well as at regular periods thereafter , including when changes are made to domain name registration data. where the domain name registration data collected and maintained is inaccurate , legitimate access seekers shall have the right to request that it is reverified and corrected , failure by an operator to do so resulting in termination of the service.


### 1. for the purpose of contributing to the security , stability and resilience of the dns , member states shall ensure that tld registries and the entities providing domain name registration services for the tld shall collect and maintain accurate and complete domain name registration data in a dedicated database facility with due diligence subject to union data protection law as regards data which are personal data. ### 1. for the purpose of contributing to the security , stability and resilience of the dns , member states shall ensure that tld registries and registrars shall collect and maintain accurate , verified and complete domain name registration data in a dedicated database facility with due diligence subject to union data protection law as regards data which are personal data.


### 2. member states shall ensure that the databases of domain name registration data referred to in paragraph 1 contain relevant information to identify and contact the holders of the domain names and the points of contact administering the domain names under the tlds. ### 2. member states shall ensure that the databases of domain name registration data referred to in paragraph 1 contain relevant information to identify and contact the holders of the domain names and the points of contact administering the domain names under the tlds , including at least the registrants' name , physical address , email address , and telephone number.


### 3. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld have policies and procedures in place to ensure that the databases include accurate and complete information. member states shall ensure that such policies and procedures are made publicly available. ### 3. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld have policies and procedures in place to ensure that the databases infrastructure includes accurate , verified and complete information , and that inaccurate or incomplete data should be corrected or erased by the registrant without delay. member states shall ensure that such policies and procedures are made publicly available.


### 3. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld have policies and procedures in place to ensure that the databases include accurate and complete information. member states shall ensure that such policies and procedures are made publicly available. ### 3. member states shall ensure that the tld registries and the registrars have policies and procedures in place to ensure that the databases include accurate and complete information. member states shall ensure that such policies and procedures are made publicly available.


### 4. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld publish , without undue delay after the registration of a domain name , domain registration data which are not personal data. ### 4. member states shall ensure that the tld registries and the and the registrars publish , without undue delay but no later than 24 hours after the registration of a domain name , fees , domain registration data , which are not personal data.


### 5. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld provide access to specific domain name registration data upon lawful and duly justified requests of legitimate access seekers , in compliance with union data protection law. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld reply without undue delay to all requests for access. member states shall ensure that policies and procedures to disclose such data are made publicly available. ### 5. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld provide access to specific domain name registration data upon lawful and duly justified requests of legitimate access seekers , in compliance with union data protection law. legitimate access seekers may include natural or legal persons making a duly justified request to access the dns data under union or national law , and they may include competent authorities under union or national law , certs , csirts , and as regards the data of their clients – providers of electronic communications networks and services and providers of cybersecurity technologies and services and cybersecurity researchers. such duly justified requests shall include requests made to prevent dns abuse. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld provide such access without undue delay , and in any event within 24 hours , to all requests for access. member states shall ensure that policies and procedures to disclose such data are made publicly available.


### 5. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld provide access to specific domain name registration data upon lawful and duly justified requests of legitimate access seekers , in compliance with union data protection law. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld reply without undue delay to all requests for access. member states shall ensure that policies and procedures to disclose such data are made publicly available. ### 5. member states shall ensure that the tld registries and the registrars provide access to specific domain name registration data upon lawful and duly justified requests of legitimate access seekers , in compliance with union data protection law. member states shall ensure that the tld registries and the registrars reply without undue delay to all requests for access. member states shall ensure that policies and procedures to disclose such data are made publicly available.


### 2. for the purposes of this directive , entities referred to in paragraph 1 shall be deemed to have their main establishment in the union in the member state where the decisions related to the cybersecurity risk management measures are taken. if such decisions are not taken in any establishment in the union , the main establishment shall be deemed to be in the member state where the entities have the establishment with the highest number of employees in the union. ### 2. for the purposes of this directive , entities referred to in paragraph 1 shall be deemed to have their main establishment in the union in the member state where the decisions related to the cybersecurity risk management measures are taken. if such decisions are not taken in any establishment in the union , the main establishment shall be deemed to be in the member state where the entities have the establishment with the highest number of employees in the union. this shall be done in a manner that ensures that no disproportionate burden falls on the regulatory body of one , or a small number of , member states.


### 2. for the purposes of this directive , entities referred to in paragraph 1 shall be deemed to have their main establishment in the union in the member state where the decisions related to the cybersecurity risk management measures are taken. if such decisions are not taken in any establishment in the union , the main establishment shall be deemed to be in the member state where the entities have the establishment with the highest number of employees in the union. ### 2. for the purposes of this directive , entities providing activities referred to in paragraph 1 shall be deemed to have their main establishment in the union in the member state where the decisions related to the cybersecurity risk management measures are taken. if such decisions are not taken in any establishment in the union , the main establishment shall be the place of its central administration in the union.


### 1. enisa shall create and maintain a registry for essential and important entities referred to in article 24(1). the entities shall submit the following information to enisa by [12 months after entering into force of the directive at the latest]: ### 1. enisa shall create and maintain a registry for essential and important entities referred to in article 24(1) , including the following information:


### 3. upon receipt of the information under paragraph 1 , enisa shall forward it to the single points of contact depending on the indicated location of each entity’s main establishment or , if it is not established in the union , of its designated representative. where an entity referred to in paragraph 1 has besides its main establishment in the union further establishments in other member states , enisa shall also inform the single points of contact of those member states. ### deleted


### 2. member states shall ensure that the exchange of information takes place within trusted communities of essential and important entities. such exchange shall be implemented through information sharing arrangements in respect of the potentially sensitive nature of the information shared and in compliance with the rules of union law referred to in paragraph 1. ### 2. member states shall ensure that the exchange of information takes place within trusted communities of essential and important entities. such exchange shall be implemented through information sharing arrangements in respect of the potentially sensitive nature of the information shared.


### 3. member states shall set out rules specifying the procedure , operational elements (including the use of dedicated ict platforms) , content and conditions of the information sharing arrangements referred to in paragraph 2. such rules shall also lay down the details of the involvement of public authorities in such arrangements , as well as operational elements , including the use of dedicated it platforms. member states shall offer support to the application of such arrangements in accordance with their policies referred to in article 5(2) (g). ### 3. member states , pursuant to paragraph 5 , shall set out rules specifying the procedure , operational elements (including the use of dedicated ict platforms and tools) , content and conditions of the information sharing arrangements referred to in paragraph 2. such rules shall also lay down the details of the involvement of public authorities in such arrangements , as well as operational elements , including the use of dedicated it platforms. member states shall offer support to the application of such arrangements in accordance with their policies referred to in article 5(2) (g).


### 5. in compliance with union law , enisa shall support the establishment of cybersecurity information-sharing arrangements referred to in paragraph 2 by providing best practices and guidance. ### 5. in compliance with union law , enisa shall support the establishment of cybersecurity information-sharing arrangements referred to in paragraph 2 by providing best practices and guidance; as well as by facilitating information-sharing at union level , with the aim of promoting the cross-border exchange of information between relevant trusted communities of essential and important entities as referred to in the second paragraph , taking into account union law and safeguarding business-sensitive information.


### member states shall ensure that , without prejudice to article 3 , entities falling outside the scope of this directive may submit notifications , on a voluntary basis , of significant incidents , cyber threats or near misses. when processing notifications , member states shall act in accordance with the procedure laid down in article 20. member states may prioritise the processing of mandatory notifications over voluntary notifications. voluntary reporting shall not result in the imposition of any additional obligations upon the reporting entity to which it would not have been subject had it not submitted the notification. ### member states shall ensure that , without prejudice to article 3 , entities within the scope and falling outside the scope of this directive may submit notifications , on a voluntary basis , of significant incidents , cyber threats or near misses. when processing notifications , member states shall act in accordance with the procedure laid down in article 20. member states may prioritise the processing of mandatory notifications over voluntary notifications. voluntary reporting shall not result in the imposition of any additional obligations upon the reporting entity to which it would not have been subject had it not submitted the notification.


### member states shall ensure that , without prejudice to article 3 , entities falling outside the scope of this directive may submit notifications , on a voluntary basis , of significant incidents , cyber threats or near misses. when processing notifications , member states shall act in accordance with the procedure laid down in article 20. member states may prioritise the processing of mandatory notifications over voluntary notifications. voluntary reporting shall not result in the imposition of any additional obligations upon the reporting entity to which it would not have been subject had it not submitted the notification. ### member states shall ensure that , without prejudice to article 3 , entities within the scope and those falling outside the scope of this directive may submit notifications , on a voluntary basis , of significant incidents , cyber threats or near misses. when processing notifications , member states shall act in accordance with the procedure laid down in article 20. member states may prioritise the processing of mandatory notifications over voluntary notifications.


### impose or request the imposition by the relevant bodies or courts according to national laws of a temporary ban against any person discharging managerial responsibilities at chief executive officer or legal representative level in that essential entity , and of any other natural person held responsible for the breach , from exercising managerial functions in that entity. ### deleted


### impose or request the imposition by the relevant bodies or courts according to national laws of a temporary ban against any person discharging managerial responsibilities at chief executive officer or legal representative level in that essential entity , and of any other natural person held responsible for the breach , from exercising managerial functions in that entity. ### impose or request the imposition by the relevant bodies or courts according to national laws of a temporary ban against any person discharging managerial responsibilities at chief executive officer or legal representative level in that essential entity , and of any other natural person held responsible for the breach , from exercising managerial functions in that entity , or the related manufacturers and providers of ict products.


### (3) network and information systems have developed into a central feature of everyday life with the speedy digital transformation and interconnectedness of society , including in cross-border exchanges. that development has led to an expansion of the cybersecurity threat landscape , bringing about new challenges , which require adapted , coordinated and innovative responses in all member states. the number , magnitude , sophistication , frequency and impact of cybersecurity incidents are increasing , and present a major threat to the functioning of network and information systems. as a result , cyber incidents can impede the pursuit of economic activities in the internal market , generate financial losses , undermine user confidence and cause major damage to the union economy and society. cybersecurity preparedness and effectiveness are therefore now more essential than ever to the proper functioning of the internal market. ### (3) network and information systems have developed into a central feature of everyday life with the speedy digital transformation and interconnectedness of society , contributing to growth of new models of economy , such as gig , on-demand and platform economy , including in cross-border exchanges and aas (as-a-service) approach. that development has led to an expansion of the cybersecurity threat landscape , bringing about new challenges , which require adapted , coordinated and innovative responses in all member states. the number , magnitude , sophistication , frequency and impact of cybersecurity incidents are increasing , and present a major threat to the functioning of network and information systems. as a result , cyber incidents can impede the pursuit of economic activities in the internal market , social activities , generate financial losses , undermine user and worker confidence , cause major damage to the union economy and society or constitute a terrorist threat. cybersecurity preparedness and effectiveness are therefore now more essential than ever to the proper functioning of the internal market.


### (3) network and information systems have developed into a central feature of everyday life with the speedy digital transformation and interconnectedness of society , including in cross-border exchanges. that development has led to an expansion of the cybersecurity threat landscape , bringing about new challenges , which require adapted , coordinated and innovative responses in all member states. the number , magnitude , sophistication , frequency and impact of cybersecurity incidents are increasing , and present a major threat to the functioning of network and information systems. as a result , cyber incidents can impede the pursuit of economic activities in the internal market , generate financial losses , undermine user confidence and cause major damage to the union economy and society. cybersecurity preparedness and effectiveness are therefore now more essential than ever to the proper functioning of the internal market. ### (3) network and information systems have developed into a central feature of everyday life with the speedy digital transformation and interconnectedness of society , including in cross-border exchanges. that development has led to an expansion of the cybersecurity threat landscape , bringing about new challenges , which require adapted , coordinated and innovative responses in all member states. the number , magnitude , sophistication , frequency and impact of cybersecurity incidents are increasing , and present a major threat to the functioning of network and information systems. as a result , cyber incidents can impede the pursuit of economic activities in the internal market , generate financial losses , undermine user confidence and cause major damage to the union economy and society. cybersecurity preparedness and effectiveness are therefore now more essential than ever to the proper functioning of the internal market. the use of artificial intelligence in cybersecurity has the potential of improving the detection and to stop unsophisticated attacks , enabling resources to be diverted towards more sophisticated attacks. member states should therefore encourage in their national strategies the use of automated tools in cybersecurity and the sharing of data needed to train and improve automated tools in cybersecurity.


### (17) given the emergence of innovative technologies and new business models , new cloud computing deployment and service models are expected to appear on the market in response to evolving customer needs. in that context , cloud computing services may be delivered in a highly distributed form , even closer to where data are being generated or collected , thus moving from the traditional model to a highly distributed one (‘edge computing’). ### (17) given the emergence of innovative technologies , new business models and new models of flexible and remote work , new cloud computing deployment and service models are expected to appear on the market in response to evolving customer and business needs. in that context , cloud computing services may be delivered in a highly distributed form , even closer to where data are being generated or collected , thus moving from the traditional model to a highly distributed one (‘edge computing’).


### (19) postal service providers within the meaning of directive 97/67/ec of the european parliament and of the council18 , as well as express and courier delivery service providers , should be subject to this directive if they provide at least one of the steps in the postal delivery chain and in particular clearance , sorting or distribution , including pick-up services. transport services that are not undertaken in conjunction with one of those steps should fall outside of the scope of postal services. ### (19) postal service providers within the meaning of directive 97/67/ec of the european parliament and of the council18 , as well as express and courier delivery service providers , should be subject to this directive if they provide at least one of the steps in the postal delivery chain and in particular clearance , sorting or distribution , including pick-up services. transport or delivery services that are not undertaken in conjunction with one of those steps should fall outside of the scope of postal services.


### (19) postal service providers within the meaning of directive 97/67/ec of the european parliament and of the council18 , as well as express and courier delivery service providers , should be subject to this directive if they provide at least one of the steps in the postal delivery chain and in particular clearance , sorting or distribution , including pick-up services. transport services that are not undertaken in conjunction with one of those steps should fall outside of the scope of postal services. ### (19) postal service providers within the meaning of directive 97/67/ec of the european parliament and of the council18 , as well as express and courier delivery service providers , should be subject to this directive if they provide at least one of the steps in the postal delivery chain and in particular clearance , sorting or distribution , including pick-up services while taking into account the degree of their dependence on network and information systems. transport services that are not undertaken in conjunction with one of those steps should fall outside of the scope of postal services.


### (33) when developing guidance documents , the cooperation group should consistently: map national solutions and experiences , assess the impact of cooperation group deliverables on national approaches , discuss implementation challenges and formulate specific recommendations to be addressed through better implementation of existing rules. ### (33) when developing guidance documents , the cooperation group should consistently: map national solutions and experiences , assess the impact of cooperation group deliverables on national approaches , discuss implementation challenges and formulate specific recommendations , also on the proper alignment in the transposition of the directive , to be addressed through better implementation of existing rules.


### providing guidance to competent authorities in relation to the transposition and implementation of this directive; ### providing guidance to competent authorities in relation to the transposition and implementation of this directive , so as to minimise existing disparities between cybersecurity risk management practices and standards among the member states;


### 5. the commission may adopt implementing acts in order to lay down the technical and the methodological specifications of the elements referred to in paragraph 2. where preparing those acts , the commission shall proceed in accordance with the examination procedure referred to in article 37(2) and follow , to the greatest extent possible , international and european standards , as well as relevant technical specifications. ### deleted


### 5. the commission may adopt implementing acts in order to lay down the technical and the methodological specifications of the elements referred to in paragraph 2. where preparing those acts , the commission shall proceed in accordance with the examination procedure referred to in article 37(2) and follow , to the greatest extent possible , international and european standards , as well as relevant technical specifications. ### 5. enisa , in collaboration with member states shall draw up advice and guidelines regarding the technical and methodological specifications areas to be considered in relation to paragraph 2. the commission may adopt implementing acts in order to lay down the technical and the methodological specifications of the elements referred to in paragraph 2. where preparing those acts , the commission shall proceed in accordance with the examination procedure referred to in article 37(2) and follow european and international standards , as well as relevant technical specifications. in developing implementing acts , the commission shall also consult all relevant stakeholders by means of a formal , open , transparent and inclusive consultation process.


### 5. the commission may adopt implementing acts in order to lay down the technical and the methodological specifications of the elements referred to in paragraph 2. where preparing those acts , the commission shall proceed in accordance with the examination procedure referred to in article 37(2) and follow , to the greatest extent possible , international and european standards , as well as relevant technical specifications. ### 5. the commission may adopt delegated acts in order to lay down the technical and the methodological specifications of the elements referred to in paragraph 2. where preparing those acts , the commission shall proceed in accordance with the article 36 and follow , to the greatest extent possible , international and european standards , as well as relevant technical specifications.


### 2. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt of any significant cyber threat that those entities identify that could have potentially resulted in a significant incident. ### 2. member states shall encourage that essential and important entities notify competent authorities or the csirt of any significant cyber threat that those entities identify that could have potentially resulted in a significant incident.


### without undue delay and in any event within 24 hours after having become aware of the incident , an initial notification , which , where applicable , shall indicate whether the incident is presumably caused by unlawful or malicious action; ### without undue delay and in any event within 72 hours after having become aware of the incident , an initial notification , which , where applicable , shall indicate whether the incident is presumably caused by unlawful or malicious action;


### (iii) applied and ongoing mitigation measures. ### (iii) applied and ongoing mitigation measures and results thereof.


### 11. the commission , may adopt implementing acts further specifying the type of information , the format and the procedure of a notification submitted pursuant to paragraphs 1 and 2. the commission may also adopt implementing acts to further specify the cases in which an incident shall be considered significant as referred to in paragraph 3. those implementing acts shall be adopted in accordance with the examination procedure referred to in article 37(2). ### 11. enisa shall develop a common eu-wide template further specifying the type of information , the format and the procedure of a notification submitted pursuant to paragraphs 1.


### (6) this directive leaves unaffected the ability of member states to take the necessary measures to ensure the protection of the essential interests of their security , to safeguard public policy and public security , and to allow for the investigation , detection and prosecution of criminal offences , in compliance with union law. in accordance with article 346 tfeu , no member state is to be obliged to supply information the disclosure of which would be contrary to the essential interests of its public security. in this context , national and union rules for protecting classified information , non-disclosure agreements , and informal non-disclosure agreements such as the traffic light protocol14 , are of relevance. ### (6) this directive leaves unaffected the ability of member states to take the necessary measures to ensure the protection of the essential interests of their security , to safeguard public policy and public security , and to allow for the investigation , detection and prosecution of criminal offences , in compliance with union law and fundamental rights. in accordance with article 346 tfeu , no member state is to be obliged to supply information the disclosure of which would be contrary to the essential interests of its public security. in this context , national and union rules for protecting classified information , non-disclosure agreements , and informal non-disclosure agreements such as the traffic light protocol14 , are of relevance.


### (29) member states should therefore take measures to facilitate coordinated vulnerability disclosure by establishing a relevant national policy. in this regard , member states should designate a csirt to take the role of ‘coordinator’ , acting as an intermediary between the reporting entities and the manufacturers or providers of ict products or services where necessary. the tasks of the csirt coordinator should in particular include identifying and contacting concerned entities , supporting reporting entities , negotiating disclosure timelines , and managing vulnerabilities that affect multiple organisations (multi-party vulnerability disclosure). where vulnerabilities affect multiple manufacturers or providers of ict products or services established in more than one member state , the designated csirts from each of the affected member states should cooperate within the csirts network. ### (29) member states , in cooperation with enisa , should therefore take measures to facilitate coordinated vulnerability disclosure by establishing a relevant national policy. in this regard , member states should designate a csirt to take the role of ‘coordinator’ , acting as an intermediary between the reporting entities and the manufacturers or providers of ict products or services where necessary. the tasks of the csirt coordinator should in particular include identifying and contacting concerned entities , supporting reporting entities , negotiating disclosure timelines , and managing vulnerabilities that affect multiple organisations (multi-party vulnerability disclosure). where vulnerabilities affect multiple manufacturers or providers of ict products or services established in more than one member state , the designated csirts from each of the affected member states should cooperate within the csirts network.


### sector ### subsector


### (26) given the importance of international cooperation on cybersecurity , csirts should be able to participate in international cooperation networks in addition to the csirts network established by this directive. ### (26) given the importance of international cooperation on cybersecurity , csirts should be able to participate in international cooperation networks in addition to the csirts network established by this directive. member states could also explore the possibility of increasing cooperation with like-minded partner countries and international organisations such as the council of europe , the north atlantic treaty organisation , the organisation for economic cooperation and development , the organisation for security and co-operation in europe and the united nations with the aim to create an open , free , stable and secure cyberspace based on international law.


### (36) the union should , where appropriate , conclude international agreements , in accordance with article 218 tfeu , with third countries or international organisations , allowing and organising their participation in some activities of the cooperation group and the csirts network. such agreements should ensure adequate protection of data. ### (36) the union should , where appropriate , conclude international agreements , in accordance with article 218 tfeu , with third countries or international organisations , allowing and organising their participation in some activities of the cooperation group and the csirts network. such agreements should ensure adequate protection of data. the union should also continue to support capacity building in third countries. member states should , where appropriate , encourage the participation of like-minded partner countries , which share our european values , in relevant pesco projects.


### (37) member states should contribute to the establishment of the eu cybersecurity crisis response framework set out in recommendation (eu) 2017/1584 through the existing cooperation networks , notably the cyber crisis liaison organisation network (eu-cyclone) , csirts network and the cooperation group. eu-cyclone and the csirts network should cooperate on the basis of procedural arrangements defining the modalities of that cooperation. the eu-cyclone’s rules of procedures should further specify the modalities through which the network should function , including but not limited to roles , cooperation modes , interactions with other relevant actors and templates for information sharing , as well as means of communication. for crisis management at union level , relevant parties should rely on the integrated political crisis response (ipcr) arrangements. the commission should use the argus high-level cross-sectoral crisis coordination process for this purpose. if the crisis entails an important external or common security and defence policy (csdp) dimension , the european external action service (eeas) crisis response mechanism (crm) should be activated. ### (37) member states should contribute to the establishment of the eu cybersecurity crisis response framework set out in recommendation (eu) 2017/1584 through the existing cooperation networks , notably the cyber crisis liaison organisation network (eu-cyclone) , csirts network and the cooperation group. eu-cyclone and the csirts network should cooperate on the basis of procedural arrangements defining the modalities of that cooperation. the eu-cyclone’s rules of procedures should further specify the modalities through which the network should function , including but not limited to roles , cooperation modes , interactions with other relevant actors and templates for information sharing , as well as means of communication. for crisis management at union level , relevant parties should rely on the integrated political crisis response (ipcr) arrangements. the commission should use the argus high-level cross-sectoral crisis coordination process for this purpose. if the crisis entails an important external or common security and defence policy (csdp) dimension , the european external action service (eeas) crisis response mechanism (crm) should be activated. in addition , the union shoud make full use of its cyber diplomacy toolbox.