### (55) business users that use large core platform services provided by gatekeepers and end users of such business users provide and generate a vast amount of data , including data inferred from such use. in order to ensure that business users have access to the relevant data thus generated , the gatekeeper should , upon their request , allow unhindered access , free of charge , to such data. such access should also be given to third parties contracted by the business user , who are acting as processors of this data for the business user. data provided or generated by the same business users and the same end users of these business users in the context of other services provided by the same gatekeeper may be concerned where this is inextricably linked to the relevant request. to this end , a gatekeeper should not use any contractual or other restrictions to prevent business users from accessing relevant data and should enable business users to obtain consent of their end users for such data access and retrieval , where such consent is required under regulation (eu) 2016/679 and directive 2002/58/ec. gatekeepers should also facilitate access to these data in real time by means of appropriate technical measures , such as for example putting in place high quality application programming interfaces. ### (55) business users that use large core platform services provided by gatekeepers and end users of such business users provide and generate a vast amount of data , including data inferred from such use. in order to ensure that business users have access to the relevant data thus generated , the gatekeeper should , upon their request , allow unhindered access , free of charge , to such data. such access should also be given to third parties contracted by the business user , who are acting as processors of this data for the business user. data provided or generated by the same business users and the same end users of these business users in the context of other services provided by the same gatekeeper may be concerned where this is inextricably linked to the relevant request. to this end , a gatekeeper should not use any contractual or other restrictions to prevent business users from accessing relevant data and should enable business users to obtain consent of their end users for such data access and retrieval under regulation (eu) 2016/679 and directive 2002/58/ec. gatekeepers should also facilitate access to these data in real time by means of appropriate technical measures , such as for example putting in place high quality application programming interfaces.


### (56) the value of online search engines to their respective business users and end users increases as the total number of such users increases. providers of online search engines collect and store aggregated datasets containing information about what users searched for , and how they interacted with , the results that they were served. providers of online search engine services collect these data from searches undertaken on their own online search engine service and , where applicable , searches undertaken on the platforms of their downstream commercial partners. access by gatekeepers to such ranking , query , click and view data constitutes an important barrier to entry and expansion , which undermines the contestability of online search engine services. gatekeepers should therefore be obliged to provide access , on fair , reasonable and non-discriminatory terms , to these ranking , query , click and view data in relation to free and paid search generated by consumers on online search engine services to other providers of such services , so that these third-party providers can optimise their services and contest the relevant core platform services. such access should also be given to third parties contracted by a search engine provider , who are acting as processors of this data for that search engine. when providing access to its search data , a gatekeeper should ensure the protection of the personal data of end users by appropriate means , without substantially degrading the quality or usefulness of the data. ### (56) the value of online search engines to their respective business users and end users increases as the total number of such users increases. providers of online search engines collect and store aggregated and anonymised datasets containing information about what users searched for , and how they interacted with , the results that they were served. providers of online search engine services collect these data from searches undertaken on their own online search engine service and , where applicable , searches undertaken on the platforms of their downstream commercial partners. access by gatekeepers to such ranking , query , click and view data constitutes an important barrier to entry and expansion , which undermines the contestability of online search engine services. gatekeepers should therefore be obliged to provide access and technical cooperation , on fair , reasonable and non-discriminatory terms , to these ranking , query , click and view data in relation to free and paid search generated by consumers on online search engine services to other providers of such services , so that these third-party providers can optimise their services and contest the relevant core platform services. such access should also be given to third parties contracted by a search engine provider , who are acting as processors of this data for that search engine. when providing access to its search data , a gatekeeper should ensure the protection of the personal data of end users by appropriate means , without substantially degrading the quality or usefulness of the data. furthermore , gatekeepers should ensure organic search results are given an equal ranking as sponsored and paid-for results.


### (61) the data protection and privacy interests of end users are relevant to any assessment of potential negative effects of the observed practice of gatekeepers to collect and accumulate large amounts of data from end users. ensuring an adequate level of transparency of profiling practices employed by gatekeepers facilitates contestability of core platform services , by putting external pressure on gatekeepers to prevent making deep consumer profiling the industry standard , given that potential entrants or start-up providers cannot access data to the same extent and depth , and at a similar scale. enhanced transparency should allow other providers of core platform services to differentiate themselves better through the use of superior privacy guaranteeing facilities. to ensure a minimum level of effectiveness of this transparency obligation , gatekeepers should at least provide a description of the basis upon which profiling is performed , including whether personal data and data derived from user activity is relied on , the processing applied , the purpose for which the profile is prepared and eventually used , the impact of such profiling on the gatekeeper’s services , and the steps taken to enable end users to be aware of the relevant use of such profiling , as well as to seek their consent. ### (61) the data protection and privacy interests of end users are relevant to any assessment of potential negative effects of the observed practice of gatekeepers to collect and accumulate large amounts of data from end users. in order to ensure an adequate level of data and consumer protection , external pressure should be put on gatekeepers to prevent making deep consumer profiling the industry standard , in particular given that potential entrants or start-up providers cannot access data to the same extent and depth , and at a similar scale. providers of core platform services should commit to superior privacy guaranteeing facilities. business models that are based on the commercial tracking and profiling of consumers should be proscribed. to that end the mixing of data from different services should be prohibited. gatekeepers should provide a description of the basis upon which profiling is performed , including whether personal data and data derived from user activity is relied on , the processing applied , the purpose for which the profile is prepared and eventually used , the impact of such profiling on the gatekeeper’s services , and the steps taken to enable end users to be aware of the relevant use of such profiling , as well as to seek their consent. such information should be shared with other relevant enforcement authorities , in particular data protection authorities.


### 1. this regulation lays down harmonised rules ensuring contestable and fair markets in the digital sector across the union where gatekeepers are present. ### 1. this regulation lays down harmonised rules ensuring contestable and fair markets in the digital sector and plurality of media across the union where gatekeepers are present.


### 6. this regulation is without prejudice to the application of articles 101 and 102 tfeu. it is also without prejudice to the application of: national rules prohibiting anticompetitive agreements , decisions by associations of undertakings , concerted practices and abuses of dominant positions; national competition rules prohibiting other forms of unilateral conduct insofar as they are applied to undertakings other than gatekeepers or amount to imposing additional obligations on gatekeepers; council regulation (ec) no 139/200438 and national rules concerning merger control; regulation (eu) 2019/1150 and regulation (eu) …./.. of the european parliament and of the council39 . ### 6. this regulation is without prejudice to the application of articles 101 and 102 tfeu. it is also without prejudice to the application of: national rules prohibiting anticompetitive agreements , decisions by associations of undertakings , concerted practices and abuses of dominant positions; national competition rules prohibiting other forms of unilateral conduct insofar as they are applied to undertakings other than gatekeepers or amount to imposing additional obligations on gatekeepers; council regulation (ec) no 139/200438 and national rules concerning merger control; regulation (eu) 2019/1150 and regulation (eu) …./.. of the european parliament and of the council39. it is as well without prejudice to regulation (eu) 2019/1150; regulation (eu) 2016/679; directive 2002/58/ec and directive 2005/29/ec of the european parliament and of the council and council directive 93/13/eec.


### (18) ‘ranking’ means the relative prominence given to goods or services offered through online intermediation services or online social networking services , or the relevance given to search results by online search engines , as presented , organised or communicated by the providers of online intermediation services or of online social networking services or by providers of online search engines , respectively , whatever the technological means used for such presentation , organisation or communication; ### (18) ‘ranking’ means the relative prominence given to goods or services offered or provided through online intermediation services , online social networking services , video-sharing platform services , operating systems , web browsers , or the relevance given to search results by online search engines , as presented , organised or communicated by the providers of such services , respectively , whatever the technological means used for such presentation , organisation or communication;


### refrain from preventing or restricting business users from raising issues with any relevant public authority relating to any practice of gatekeepers; ### not directly or indirectly prevent or restrict business users and end users from raising issues with any relevant public authority or judicial authority relating to any practice of gatekeepers;


### refrain from requiring business users or end users to subscribe to or register with any other core platform services identified pursuant to article 3 or which meets the thresholds in article 3(2)(b) as a condition to access , sign up or register to any of their core platform services identified pursuant to that article; ### not require business users or end users to use , subscribe to or register with any other service of the gatekeeper as a condition to access , sign up or register to any of their core platform services nor achieve the same result through product design , nor automatically sign users of a core platform service into any such services owned or controlled by the gatekeeper;


### provide advertisers and publishers to which it supplies advertising services , upon their request , with information concerning the price paid by the advertiser and publisher , as well as the amount or remuneration paid to the publisher , for the publishing of a given ad and for each of the relevant advertising services provided by the gatekeeper. ### provide advertisers and publishers to which it supplies advertising services on a continuous and real-time basis , with complete information concerning the price-setting mechanisms and schemes for the calculation of the fees as well as the price and fees paid by the advertiser and publisher , including any deductions and surcharges as well as the amount or remuneration paid to the publisher , for the publishing of a given ad and for each of the relevant advertising services provided by the gatekeeper;


### allow end users to un-install any pre-installed software applications on its core platform service without prejudice to the possibility for a gatekeeper to restrict such un-installation in relation to software applications that are essential for the functioning of the operating system or of the device and which cannot technically be offered on a standalone basis by third-parties; ### deleted


### allow the installation and effective use of third party software applications or software application stores using , or interoperating with , operating systems of that gatekeeper and allow these software applications or software application stores to be accessed by means other than the core platform services of that gatekeeper. the gatekeeper shall not be prevented from taking proportionate measures to ensure that third party software applications or software application stores do not endanger the integrity of the hardware or operating system provided by the gatekeeper; ### allow and technically enable business users and end users to install and effective use third party software applications or software application stores using , or interoperating with , operating systems of that gatekeeper and allow and enable these software applications and software application stores to be accessed by means other than the core platform services of that gatekeeper. the end user shall be required to decide which application or application store should become the default. the gatekeeper shall not be prevented from taking proportionate measures to ensure that third party software applications or software application stores do not endanger the integrity of the hardware or operating system provided by the gatekeeper provided that the gatekeeper can prove that such measures are necessary , proportionate and justified to safeguard the integrity of the hardware or operating system;


### provide advertisers and publishers , upon their request and free of charge , with access to the performance measuring tools of the gatekeeper and the information necessary for advertisers and publishers to carry out their own independent verification of the ad inventory; ### provide advertisers and publishers , upon their request a continuous , real-time and free of charge access to the performance measuring tools of the gatekeeper and provide for full disclosure and transparency of the parameters and data used for decision making , execution and measurement of the intermediation services.


### provide effective portability of data generated through the activity of a business user or end user and shall , in particular , provide tools for end users to facilitate the exercise of data portability , in line with regulation eu 2016/679 , including by the provision of continuous and real-time access ; ### provide effective portability of data , including by implementing appropriate technical and organisational measures , generated through or in the context of the activity of a business user or end user and shall , in particular , provide tools for end users to facilitate the exercise of data portability that is adequate , relevant and limited to what is necessary , in line with regulation eu 2016/679 , including by the provision of continuous and real-time access;


### provide to any third party providers of online search engines , upon their request , with access on fair , reasonable and non-discriminatory terms to ranking , query , click and view data in relation to free and paid search generated by end users on online search engines of the gatekeeper , subject to anonymisation for the query , click and view data that constitutes personal data; ### provide to any third party providers of online search engines , upon their request , with access on fair , reasonable and non-discriminatory terms to ranking , query , click and view data in relation to free and paid search generated by end users on online search engines of the gatekeeper , subject to anonymisation for the ranking , query , click and view data that constitutes personal data;


### apply fair and non-discriminatory general conditions of access for business users to its software application store designated pursuant to article 3 of this regulation. ### apply transparent , fair and non-discriminatory general conditions of access for business users and end users to any of its core platform services by default through implementing appropriate technical and organisational measures to its software application store designated pursuant to article 3 of this regulation.


### 2. for the purposes of point (a) of paragraph 1 data that is not publicly available shall include any aggregated and non-aggregated data generated by business users that can be inferred from , or collected through , the commercial activities of business users or their customers on the core platform service of the gatekeeper. ### 2. for the purposes of point (a) of paragraph 1 data that is not publicly available shall include any aggregated and non-aggregated data generated by business users that can be inferred from , or collected through , the commercial activities of business users or their customers on the core platform service of the gatekeeper. the commission shall publish the technical specifications for individual gatekeepers , without prejudice to business secrets.


### 2. gatekeepers , undertakings and associations of undertakings concerned may submit their observations to the commission’s preliminary findings within a time limit which shall be fixed by the commission in its preliminary findings and which may not be less than 14 days. ### 2. gatekeepers , undertakings , associations of undertakings concerned and third parties with a legitimate interest may submit their observations to the commission’s preliminary findings within a time limit which shall be fixed by the commission in its preliminary findings and which may not be less than 14 days.


### (29) designated gatekeepers should comply with the obligations laid down in this regulation in respect of each of the core platform services listed in the relevant designation decision. the mandatory rules should apply taking into account the conglomerate position of gatekeepers , where applicable. furthermore , implementing measures that the commission may by decision impose on the gatekeeper following a regulatory dialogue should be designed in an effective manner , having regard to the features of core platform services as well as possible circumvention risks and in compliance with the principle of proportionality and the fundamental rights of the undertakings concerned as well as those of third parties. ### (29) gatekeepers should comply with the obligations laid down in this regulation in respect of each of the core platform services. the mandatory rules should apply taking into account the conglomerate position of gatekeepers , where applicable. furthermore , implementing measures that the commission may by decision impose on the gatekeeper following a regulatory dialogue should be designed in an effective manner , having regard to the features of core platform services as well as possible circumvention risks and in compliance with the principle of proportionality and the fundamental rights of the undertakings concerned as well as those of third parties.


### advertising services , including any advertising networks , advertising exchanges and any other advertising intermediation services , provided by a provider of any of the core platform services listed in points (a) to (g); ### advertising services , including any advertising networks , advertising exchanges and any other advertising intermediation services , provided by any undertaking of the provider of any of the core platform services listed in points (a) to (g);


### 1. a provider of core platform services shall be designated as gatekeeper if: ### 1. a provider of core platform services is a gatekeeper if:


### 2. a provider of core platform services shall be presumed to satisfy: ### 2. a provider of core platform services shall be deemed to satisfy:


### the requirement in paragraph 1 point (c) where the thresholds in point (b) were met in each of the last three financial years. ### the requirement in paragraph 1 point (c) where the thresholds in point (b) were met in each of the last two financial years.


### the financial liability of each undertaking in respect of the payment of the fine shall not exceed 10 % of its total turnover in the preceding financial year. ### the financial liability of each undertaking in respect of the payment of the fine shall not exceed 30 % of its total turnover in the preceding financial year.


### where the gatekeeper presents such sufficiently substantiated arguments to demonstrate that it does not satisfy the requirements of paragraph 1 , the commission shall apply paragraph 6 to assess whether the criteria in paragraph 1 are met. ### deleted


### business user or end user lock-in; ### entrenched lack of choice , business user or end user dependency or lock-in;


### 4. in view of adopting the decision under paragraph 2 , the commission shall communicate its preliminary findings within three months from the opening of the proceedings. in the preliminary findings , the commission shall explain the measures it considers to take or it considers that the provider of core platform services concerned should take in order to effectively address the preliminary findings. ### 4. in view of adopting the decision under paragraph 2 , the commission shall communicate its preliminary findings within six weeks from the opening of the proceedings. in the preliminary findings , the commission shall explain the measures it considers to take or it considers that the provider of core platform services concerned should take in order to effectively address the preliminary findings.


### 1. the commission may by simple request or by decision require information from undertakings and associations of undertakings to provide all necessary information , including for the purpose of monitoring , implementing and enforcing the rules laid down in this regulation. the commission may also request access to data bases and algorithms of undertakings and request explanations on those by a simple request or by a decision. ### 1. the commission may by simple request or by decision require information from undertakings and associations of undertakings to provide all necessary information , including for the purpose of monitoring , implementing and enforcing the rules laid down in this regulation. the commission may also request access to data bases , algorithms and a/b testing of undertakings and request explanations on those by a simple request or by a decision. where the simple request is not fulfilled within a period of 3 weeks , the commission may require this information by decision.


### (68) in order to ensure effective implementation and compliance with this regulation , the commission should have strong investigative and enforcement powers , to allow it to investigate , enforce and monitor the rules laid down in this regulation , while at the same time ensuring the respect for the fundamental right to be heard and to have access to the file in the context of the enforcement proceedings. the commission should dispose of these investigative powers also for the purpose of carrying out market investigations for the purpose of updating and reviewing this regulation. ### (68) in order to ensure effective implementation and compliance with this regulation , the commission , supported by the member states authorities , should have strong investigative and enforcement powers , to allow it to investigate , enforce and monitor the rules laid down in this regulation , while at the same time ensuring the respect for the fundamental right to be heard and to have access to the file in the context of the enforcement proceedings. the commission should dispose of these investigative powers also for the purpose of carrying out market investigations for the purpose of updating and reviewing this regulation.


### 4. a gatekeeper shall be deemed to have further strengthened or extended its gatekeeper position in relation to the characteristics under article 3(1) , where its impact on the internal market has further increased , its importance as a gateway for business users to reach end users has further increased or the gatekeeper enjoys a further entrenched and durable position in its operations. ### deleted


### 3. should the commission consider that the commitments submitted by the gatekeeper concerned cannot ensure effective compliance with the obligations laid down in articles 5 and 6 , it shall explain the reasons for not making those commitments binding in the decision concluding the relevant proceedings. ### 3. should the commission consider that the commitments submitted by the gatekeeper concerned cannot ensure effective compliance with the obligations laid down in articles 5 and 6 , it shall explain the reasons for not making those commitments binding in the decision concluding the relevant proceedings and , following an investigation , require changes to the commitments in order to make them effective.


### 4. the gatekeeper shall provide the commission with the description of the measures it took to ensure compliance with the decision adopted pursuant to paragraph 1. ### 4. the gatekeeper shall provide the commission with the description of the measures it took to ensure compliance with the decision adopted pursuant to paragraph 1. if the commission , following an investigation , finds that the measures are not effective to ensure compliance by the gatekeeper with its obligations under articles 5 and 6 , the commission shall be entitled to require changes to these measures.


### 1. the power of the commission to enforce decisions taken pursuant to articles 26 and 27 shall be subject to a limitation period of five years. ### 1. the power of the commission to enforce decisions taken pursuant to articles 26 and 27 shall be subject to a limitation period of seven years.


### 1. the information collected pursuant to articles 3 , 12 , 13 , 19 , 20 and 21 shall be used only for the purposes of this regulation. ### 1. the information collected pursuant to articles 3 , 19 , 20 and 21 shall be used only for the purposes of this regulation.


### 2. without prejudice to the exchange and to the use of information provided for the purpose of use pursuant to articles 32 and 33 , the commission , the authorities of the member states , their officials , servants and other persons working under the supervision of these authorities and any natural or legal person , including auditors and experts appointed pursuant to article 24(2) , shall not disclose information acquired or exchanged by them pursuant to this regulation and of the kind covered by the obligation of professional secrecy. this obligation shall also apply to all representatives and experts of member states participating in any of the activities of the digital markets advisory committee pursuant to article 32. ### 2. without prejudice to the exchange and to the use of information provided for the purpose of use pursuant to articles 12 , 13 , 32 and 33 , the commission , the authorities of the member states , their officials , servants and other persons working under the supervision of these authorities and any natural or legal person , including auditors and experts appointed pursuant to article 24(2) , shall not disclose information acquired or exchanged by them pursuant to this regulation and of the kind covered by the obligation of professional secrecy. this obligation shall also apply to all representatives and experts of member states participating in any of the activities of the digital markets advisory committee pursuant to article 32.


### 33 request for a market investigation ### 33 request for a market investigation and non-compliance proceedings


### cloud computing services; ### software as a service including cloud computing services;


### 3 designation of gatekeepers ### 3 qualification as gatekeepers


### 4. the commission shall , without undue delay and at the latest 60 days after receiving the complete information referred to in paragraph 3 , designate the provider of core platform services that meets all the thresholds of paragraph 2 as a gatekeeper , unless that provider , with its notification , presents sufficiently substantiated arguments to demonstrate that , in the circumstances in which the relevant core platform service operates , and taking into account the elements listed in paragraph 6 , the provider does not satisfy the requirements of paragraph 1. ### deleted


### obligations for gatekeepers susceptible of being further specified ### obligations for gatekeepers susceptible of being further technically specified


### (11) depending on the sector in which they operate or the type of service they provide , the entities falling within the scope of this directive should be classified into two categories: essential and important. that categorisation should take into account the level of criticality of the sector or of the type of service , as well as the level of dependency of other sectors or types of services. both essential and important entities should be subject to the same risk management requirements and reporting obligations. the supervisory and penalty regimes between these two categories of entities should be differentiated to ensure a fair balance between requirements and obligations on one hand , and the administrative burden stemming from the supervision of compliance on the other hand. ### (11) depending on the sector in which they operate or the type of service they provide , the entities falling within the scope of this directive should be classified into two categories: essential and important. that categorisation should take into account the level of criticality of the sector or of the type of service , as well as the level of dependency of other sectors or types of services. both essential and important entities should be subject to the same risk management requirements and reporting obligations. the supervisory and penalty regimes between these two categories of entities should be differentiated to ensure a fair balance between requirements and obligations on one hand , and the administrative burden stemming from the supervision of compliance on the other hand. the provisions of this directive apply to entities with complex business models or operating environments , whereby an entity may simultaneously fulfil the criteria assigned to both essential and important entities. in order to enable the effective supervision and enforcement of risk management measures and reporting obligations for entities falling within the scope of this directive , competent authorities or csirts shall enforce the provisions of this directive to a function or unit level within an entity , in order to appropriately and sufficiently address the level of criticality.


### (12) sector-specific legislation and instruments can contribute to ensuring high levels of cybersecurity , while taking full account of the specificities and complexities of those sectors. where a sector–specific union legal act requires essential or important entities to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats of at least an equivalent effect to the obligations laid down in this directive , those sector-specific provisions , including on supervision and enforcement , should apply. the commission may issue guidelines in relation to the implementation of the lex specialis. this directive does not preclude the adoption of additional sector-specific union acts addressing cybersecurity risk management measures and incident notifications. this directive is without prejudice to the existing implementing powers that have been conferred to the commission in a number of sectors , including transport and energy. ### (12) sector-specific legislation and instruments can contribute to ensuring high levels of cybersecurity , while taking full account of the specificities and complexities of those sectors. sector-specific legislation and instruments that require essential or important entities to adopt cybersecurity risk management measures , or impose reporting obligations for significant incidents , shall , where possible , be consistent with the terminology , and refer to the definitions in article 4 of this directive. where a sector–specific union legal act requires essential or important entities to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats of at least an equivalent effect to the obligations laid down in this directive , and apply to the entirety of the security aspects of the operations and services provided by essential and important entities , those sector-specific provisions , including on supervision and enforcement , should apply. the commission may issue guidelines in relation to the implementation of the lex specialis. this directive does not preclude the adoption of additional sector-specific union acts addressing cybersecurity risk management measures and incident notifications. this directive is without prejudice to the existing implementing powers that have been conferred to the commission in a number of sectors , including transport and energy.


### (15) upholding and preserving a reliable , resilient and secure domain name system (dns) is a key factor in maintaining the integrity of the internet and is essential for its continuous and stable operation , on which the digital economy and society depend. therefore , this directive should apply to all providers of dns services along the dns resolution chain , including operators of root name servers , top-level-domain (tld) name servers , authoritative name servers for domain names and recursive resolvers. ### (15) upholding and preserving a reliable , resilient and secure domain name system (dns) is a key factor in maintaining the integrity of the internet and is essential for its continuous and stable operation , on which the digital economy and society depend. therefore , this directive should apply to top-level-domain (tld) name servers , public and open recursive domain name resolution services , and authoritative domain name resolution services. this directive should not apply to decentralised services for which centralised administration does not exist , such as the root name servers.


### (28) since the exploitation of vulnerabilities in network and information systems may cause significant disruption and harm , swiftly identifying and remedying those vulnerabilities is an important factor in reducing cybersecurity risk. entities that develop such systems should therefore establish appropriate procedures to handle vulnerabilities when they are discovered. since vulnerabilities are often discovered and reported (disclosed) by third parties (reporting entities) , the manufacturer or provider of ict products or services should also put in place the necessary procedures to receive vulnerability information from third parties. in this regard , international standards iso/iec 30111 and iso/iec 29417 provide guidance on vulnerability handling and vulnerability disclosure respectively. as regards vulnerability disclosure , coordination between reporting entities and manufacturers or providers of ict products or services is particularly important. coordinated vulnerability disclosure specifies a structured process through which vulnerabilities are reported to organisations in a manner allowing the organisation to diagnose and remedy the vulnerability before detailed vulnerability information is disclosed to third parties or to the public. coordinated vulnerability disclosure should also comprise coordination between the reporting entity and the organisation as regards the timing of remediation and publication of vulnerabilities. ### (28) since the exploitation of vulnerabilities in network and information systems may cause significant disruption and harm , swiftly identifying and remedying those vulnerabilities is an important factor in reducing cybersecurity risk. entities that develop such systems should therefore establish appropriate procedures to handle vulnerabilities when they are discovered. since vulnerabilities are often discovered and reported (disclosed) by third parties (reporting entities) , the manufacturer or provider of ict products or services should also put in place the necessary procedures to receive vulnerability information from third parties. in this regard , international standards iso/iec 30111 and iso/iec 29417 provide guidance on vulnerability handling and vulnerability disclosure respectively. as regards vulnerability disclosure , coordination between reporting entities and manufacturers or providers of ict products or services is particularly important. voluntary coordinated vulnerability disclosure specifies a structured process through which vulnerabilities are reported to organisations in a manner allowing the organisation to diagnose and remedy the vulnerability before detailed vulnerability information is disclosed to third parties or to the public. coordinated vulnerability disclosure should also comprise coordination between the reporting entity and the organisation as regards the timing of remediation and publication of vulnerabilities. strengthening the coordination and timely exchange of relevant information between the manufacturer or provider of ict products or services and the reporting entities is essential to facilitate the voluntary framework of vulnerability disclosure.


### (31) although similar vulnerability registries or databases do exist , these are hosted and maintained by entities which are not established in the union. a european vulnerability registry maintained by enisa would provide improved transparency regarding the publication process before the vulnerability is officially disclosed , and resilience in cases of disruptions or interruptions on the provision of similar services. to avoid duplication of efforts and seek complementarity to the extent possible , enisa should explore the possibility of entering into structured cooperation agreements with similar registries in third country jurisdictions. ### (31) although similar vulnerability registries or databases do exist , these are hosted and maintained by entities which are not established in the union. a european vulnerability registry maintained by enisa would provide improved transparency regarding the publication process before the vulnerability is officially disclosed , and resilience in cases of disruptions or interruptions on the provision of similar services. to avoid duplication of efforts and seek complementarity to the extent possible , enisa should explore the possibility of entering into structured cooperation agreements with similar registries in third country jurisdictions. enisa could play a more central management role either by exploring the option of becoming a “root cve numbering authority” in the global common vulnerabilities and exposures (cve) registry , or setting up a database to leverage the existing cve programme for vulnerability identification and registration to enable interoperability and reference between the european and third country jurisdiction registries.


### (35) the competent authorities and csirts should be empowered to participate in exchange schemes for officials from other member states in order to improve cooperation. the competent authorities should take the necessary measures to enable officials from other member states to play an effective role in the activities of the host competent authority. ### (35) the competent authorities and csirts should be empowered to participate in exchange schemes for officials from other member states , within structured rules and mechanisms underpinning the scope and , where applicable , the required security clearance of officials participating in such exchange schemes , in order to improve cooperation. the competent authorities should take the necessary measures to enable officials from other member states to play an effective role in the activities of the host competent authority or csirt.


### (44) among service providers , managed security services providers (mssps) in areas such as incident response , penetration testing , security audits and consultancy play a particularly important role in assisting entities in their efforts to detect and respond to incidents. those mssps have however also been the targets of cyberattacks themselves and through their close integration in the operations of operators pose a particular cybersecurity risk. entities should therefore exercise increased diligence in selecting an mssp. ### (44) among service providers , managed security services providers (mssps) in areas such as incident response , penetration testing , security audits and consultancy play a particularly important role in assisting entities in their efforts to prevent , detect and respond to incidents. those mssps have however also been the targets of cyberattacks themselves and through their close integration in the operations of operators pose a particular cybersecurity risk. entities should therefore exercise increased diligence in selecting an mssp , not only in terms of the close operational integration but also as regards the need for such outsourced activities involving personal data by a controller to be in full compliance with regulation (eu) 2016/679 , in particular the processing by a processor on behalf of a controller.


### (46) to further address key supply chain risks and assist entities operating in sectors covered by this directive to appropriately manage supply chain and supplier related cybersecurity risks , the cooperation group involving relevant national authorities , in cooperation with the commission and enisa , should carry out coordinated sectoral supply chain risk assessments , as was already done for 5g networks following recommendation (eu) 2019/534 on cybersecurity of 5g networks21 , with the aim of identifying per sector which are the critical ict services , systems or products , relevant threats and vulnerabilities. ### (46) to further address key supply chain risks and assist entities operating in sectors covered by this directive to appropriately manage supply chain and supplier related cybersecurity risks , the cooperation group involving relevant national authorities , in cooperation with the commission and enisa , and in consultation with the european data protection board (edpb) , should carry out coordinated sectoral supply chain risk assessments , as was already done for 5g networks following recommendation (eu) 2019/534 on cybersecurity of 5g networks21 , with the aim of identifying per sector which are the critical ict services , systems or products , relevant threats and vulnerabilities. particular emphasis should be placed on ict services , systems or products subject to specific requirements , in particular in third country jurisdictions serving as the country of origin.


### (47) the supply chain risk assessments , in light of the features of the sector concerned , should take into account both technical and , where relevant , non-technical factors including those defined in recommendation (eu) 2019/534 , in the eu wide coordinated risk assessment of 5g networks security and in the eu toolbox on 5g cybersecurity agreed by the cooperation group. to identify the supply chains that should be subject to a coordinated risk assessment , the following criteria should be taken into account: (i) the extent to which essential and important entities use and rely on specific critical ict services , systems or products; (ii) the relevance of specific critical ict services , systems or products for performing critical or sensitive functions , including the processing of personal data; (iii) the availability of alternative ict services , systems or products; (iv) the resilience of the overall supply chain of ict services , systems or products against disruptive events and (v) for emerging ict services , systems or products , their potential future significance for the entities’ activities. ### (47) the supply chain risk assessments , in light of the features of the sector concerned , should take into account both technical and , where relevant , non-technical factors including those defined in recommendation (eu) 2019/534 , in the eu wide coordinated risk assessment of 5g networks security and in the eu toolbox on 5g cybersecurity agreed by the cooperation group. to identify the supply chains that should be subject to a coordinated risk assessment , the following criteria should be taken into account: (i) the extent to which essential and important entities use and rely on specific critical ict services , systems or products; (ii) the relevance of specific critical ict services , systems or products for performing critical or sensitive functions , including the processing of personal data; (iii) the availability of alternative ict services , systems or products; (iv) the resilience of the overall supply chain of ict services , systems or products against disruptive events across the entire lifecycle of the service , system or product and (v) for emerging ict services , systems or products , their potential future significance for the entities’ activities. such risk assessments should identify best practices for managing risks associated with risks in the ict supply chain and explore ways to further incentivise their wider adoption by entities within each sector under examination.


### (54) in order to safeguard the security of electronic communications networks and services , the use of encryption , and in particular end-to-end encryption , should be promoted and , where necessary , should be mandatory for providers of such services and networks in accordance with the principles of security and privacy by default and by design for the purposes of article 18. the use of end-to-end encryption should be reconciled with the member state’ powers to ensure the protection of their essential security interests and public security , and to permit the investigation , detection and prosecution of criminal offences in compliance with union law. solutions for lawful access to information in end-to-end encrypted communications should maintain the effectiveness of encryption in protecting privacy and security of communications , while providing an effective response to crime. ### (54) in order to safeguard the security of electronic communications networks and services , the use of encryption , and in particular end-to-end encryption , should be promoted and , where necessary , should be mandatory for providers of such services and networks in accordance with the principles of security and privacy by default and by design for the purposes of article 18. the use of end-to-end encryption should be reconciled with the member state’ powers to ensure the protection of their essential security interests and public security , and to permit the investigation , detection and prosecution of criminal offences in compliance with union law. the effectiveness of encryption in protecting the privacy and security of communications must not be undermined in any circumstance , as any loophole in encryption is open to be explored or exploited by actors , regardless of their legitimacy or intent.


### (55) this directive lays down a two-stage approach to incident reporting in order to strike the right balance between , on the one hand , swift reporting that helps mitigate the potential spread of incidents and allows entities to seek support , and , on the other hand , in-depth reporting that draws valuable lessons from individual incidents and improves over time the resilience to cyber threats of individual companies and entire sectors. where entities become aware of an incident , they should be required to submit an initial notification within 24 hours , followed by a final report not later than one month after. the initial notification should only include the information strictly necessary to make the competent authorities aware of the incident and allow the entity to seek assistance , if required. such notification , where applicable , should indicate whether the incident is presumably caused by unlawful or malicious action. member states should ensure that the requirement to submit this initial notification does not divert the reporting entity’s resources from activities related to incident handling that should be prioritised. to further prevent that incident reporting obligations either divert resources from incident response handling or may otherwise compromise the entities efforts in that respect , member states should also provide that , in duly justified cases and in agreement with the competent authorities or the csirt , the entity concerned can deviate from the deadlines of 24 hours for the initial notification and one month for the final report. ### (55) this directive lays down a three-stage approach to incident reporting in order to strike the right balance between , on the one hand , swift reporting that helps mitigate the potential spread of incidents and allows entities to seek support , and , on the other hand , in-depth reporting that draws valuable lessons from individual incidents and improves over time the resilience to cyber threats of individual companies and entire sectors. in this regard , the directive should also include reporting of incidents that , based on an initial assessment performed by the entity , may be assumed to lead to substantial operational disruption or financial losses or affect other natural or legal persons by causing considerable material or non-material losses. the initial assessment should take into account amongst others , the affected network and information systems and , in particular , their importance in the provision of the entity’s services , the severity and technical characteristics of the cyber threat , and any underlying vulnerabilities that are being exploited , as well as the entity’s experience with similar incidents. where entities become aware of an incident , they should provide an early warning within 24 hours , without any obligation to disclose additional information. entities should be required to submit an initial notification within 72 hours , followed by a comprehensive report not later than one month after the incident has been handled. the initial incident notification timeline of 72 hours should not preclude entities from reporting incidents earlier , therefore allowing entities to seek support from competent authorities or csirts swiftly , and enabling competent authorities or csirts to mitigate the potential spread of the reported incident. where an incident requires a longer period to be handled , an entity should be required to submit regular reports on the mitigation measures in place to contain , respond to , attribute and recover from the incident , and a comprehensive report not later than one month after the incident has been handled. the initial notification should allow the entity to seek assistance , if required. such notification , where applicable , should indicate whether the incident is presumably caused by unlawful or malicious action. member states should ensure that the requirement to submit this initial notification does not divert the reporting entity’s resources from activities related to incident handling that should be prioritised. to further prevent that incident reporting obligations either divert resources from incident response handling or may otherwise compromise the entities efforts in that respect , member states should also provide that , in duly justified cases and in agreement with the competent authorities or the csirt , the entity concerned can deviate from the deadlines of 72 hours for the initial notification and one month for the comprehensive report.


### (60) the availability and timely accessibility of these data to public authorities , including competent authorities under union or national law for the prevention , investigation or prosecution of criminal offences , certs , (csirts , and as regards the data of their clients to providers of electronic communications networks and services and providers of cybersecurity technologies and services acting on behalf of those clients , is essential to prevent and combat domain name system abuse , in particular to prevent , detect and respond to cybersecurity incidents. such access should comply with union data protection law insofar as it is related to personal data. ### (60) the availability and timely accessibility of the domain name registration data to legitimate access seekers is essential to protect the online ecosystem , prevent dns abuse , detect and prevent crime and fraud , protect minors , protect intellectual property , and protect against hate speech. for the purposes of this directive , legitimate access seekers are natural or legal persons making a justified request on the basis of a legitimate interest under union or national law to access dns data , and they may include competent authorities under union or national law for the prevention , investigation or prosecution of criminal offences , certs , csirts , and as regards the data of their clients , providers of electronic communications networks and services and providers of cybersecurity technologies. such access should comply with union data protection law insofar as it is related to personal data.


### (61) in order to ensure the availability of accurate and complete domain name registration data , tld registries and the entities providing domain name registration services for the tld (so-called registrars) should collect and guarantee the integrity and availability of domain names registration data. in particular , tld registries and the entities providing domain name registration services for the tld should establish policies and procedures to collect and maintain accurate and complete registration data , as well as to prevent and correct inaccurate registration data in accordance with union data protection rules. ### (61) in order to ensure the availability of accurate and complete domain name registration data , tld registries and the entities providing domain name registration services for the tld (so-called registrars) should collect and guarantee the integrity and availability of domain names registration data. in particular , tld registries and entities providing domain name registration services should establish policies and procedures to collect and maintain accurate and complete registration data , as well as to prevent and correct inaccurate registration data in accordance with union data protection rules.


### (62) tld registries and the entities providing domain name registration services for them should make publically available domain name registration data that fall outside the scope of union data protection rules , such as data that concern legal persons25 . tld registries and the entities providing domain name registration services for the tld should also enable lawful access to specific domain name registration data concerning natural persons to legitimate access seekers , in accordance with union data protection law. member states should ensure that tld registries and the entities providing domain name registration services for them should respond without undue delay to requests from legitimate access seekers for the disclosure of domain name registration data. tld registries and the entities providing domain name registration services for them should establish policies and procedures for the publication and disclosure of registration data , including service level agreements to deal with requests for access from legitimate access seekers. the access procedure may also include the use of an interface , portal or other technical tool to provide an efficient system for requesting and accessing registration data. with a view to promoting harmonised practices across the internal market , the commission may adopt guidelines on such procedures without prejudice to the competences of the european data protection board. ### (62) tld registries and entities providing domain name registration services should be required to make publically available domain name registration data of legal persons25. tld registries and entities providing domain name registration services should also enable lawful access to specific domain name registration data concerning natural persons to legitimate access seekers , in accordance with union data protection law. member states should ensure that tld registries and entities providing domain name registration services should respond within 72 hours to requests from legitimate access seekers for the disclosure of domain name registration data. tld registries and entities providing domain name registration services should establish policies and procedures for the publication and disclosure of registration data , including service level agreements to deal with requests for access from legitimate access seekers. the access procedure may also include the use of an interface , portal or other technical tool to provide an efficient system for requesting and accessing registration data. with a view to promoting harmonised practices across the internal market , the commission may adopt guidelines on such procedures without prejudice to the competences of the european data protection board.


### (69) the processing of personal data , to the extent strictly necessary and proportionate for the purposes of ensuring network and information security by entities , public authorities , certs , csirts , and providers of security technologies and services should constitute a legitimate interest of the data controller concerned , as referred to in regulation (eu) 2016/679. that should include measures related to the prevention , detection , analysis and response to incidents , measures to raise awareness in relation to specific cyber threats , exchange of information in the context of vulnerability remediation and coordinated disclosure , as well as the voluntary exchange of information on those incidents , as well as cyber threats and vulnerabilities , indicators of compromise , tactics , techniques and procedures , cybersecurity alerts and configuration tools. such measures may require the processing of the following types of personal data: ip addresses , uniform resources locators (urls) , domain names , and email addresses. ### (69) the processing of personal data , to the extent strictly necessary and proportionate for the purposes of ensuring network and information security by essential and important entities , public authorities , certs , csirts , and providers of security technologies and services is necessary to comply with a legal obligation under this directive and constitutes a legitimate interest of the data controller concerned , as referred to in point (c) paragraph 1 , and point (f) paragraph 1 respectively of article 6 of regulation (eu) 2016/679. that should include measures related to the prevention , detection , analysis and response to incidents , measures to raise awareness in relation to specific cyber threats , exchange of information in the context of vulnerability remediation and coordinated disclosure , as well as the voluntary exchange of information on those incidents , as well as cyber threats and vulnerabilities , indicators of compromise , tactics , techniques and procedures , cybersecurity alerts and configuration tools. such measures may require the processing of the following types of personal data: ip addresses , uniform resources locators (urls) , domain names , and email addresses.


### (76) in order to further strengthen the effectiveness and dissuasiveness of the penalties applicable to infringements of obligations laid down pursuant to this directive , the competent authorities should be empowered to apply sanctions consisting of the suspension of a certification or authorisation concerning part or all the services provided by an essential entity and the imposition of a temporary ban from the exercise of managerial functions by a natural person. given their severity and impact on the entities’ activities and ultimately on their consumers , such sanctions should only be applied proportionally to the severity of the infringement and taking account of the specific circumstances of each case , including the intentional or negligent character of the infringement , actions taken to prevent or mitigate the damage and/or losses suffered. such sanctions should only be applied as ultima ratio , meaning only after the other relevant enforcement actions laid down by this directive have been exhausted , and only for the time until the entities to which they apply take the necessary action to remedy the deficiencies or comply with the requirements of the competent authority for which such sanctions were applied. the imposition of such sanctions shall be subject to appropriate procedural safeguards in accordance with the general principles of union law and the charter of fundamental rights of the european union , including effective judicial protection , due process , presumption of innocence and right of defence. ### (76) in order to further strengthen the effectiveness and dissuasiveness of the penalties applicable to infringements of obligations laid down pursuant to this directive , the competent authorities should be empowered to apply sanctions consisting of , where applicable , the temporary suspension of a certification or authorisation concerning part or all the services provided by an essential entity , and the imposition of a temporary against any person discharging managerial responsibilities at chief executive officer or legal representative level in that essential entity from exercising managerial functions in that entity. this provision shall not apply to public administration entities as referred to in this directive. given their severity and impact on the entities’ activities and ultimately on their consumers , such sanctions should only be applied proportionally to the severity of the infringement and taking account of the specific circumstances of each case , including the intentional or negligent character of the infringement , actions taken to prevent or mitigate the damage and/or losses suffered. such sanctions should only be applied as ultima ratio , meaning only after the other relevant enforcement actions laid down by this directive have been exhausted , and only for the time until the entities to which they apply take the necessary action to remedy the deficiencies or comply with the requirements of the competent authority for which such sanctions were applied. the imposition of such sanctions shall be subject to appropriate procedural safeguards in accordance with the general principles of union law and the charter of fundamental rights of the european union , including effective judicial protection , due process , presumption of innocence and right of defence.


### (79) a peer-review mechanism should be introduced , allowing the assessment by experts designated by the member states of the implementation of cybersecurity policies , including the level of member states’ capabilities and available resources. ### (79) a peer-review mechanism should be introduced , allowing the assessment by experts designated by the member states and enisa of the implementation of cybersecurity policies , including the level of member states’ capabilities and available resources , and provide an effective path for the transfer of cybersecurity-enhancing technologies , mechanisms and processes between and among competent authorities or csirts.


### a governance framework to achieve those objectives and priorities , including the policies referred to in paragraph 2 and the roles and responsibilities of public bodies and entities as well as other relevant actors; ### a governance framework to achieve those objectives and priorities , including the policies referred to in paragraph 2 , and an appropriate framework defining the roles and responsibilities of public bodies and entities as well as other relevant actors , underpinning the cooperation and coordination , at the national level , between the competent authorities designated under articles 7(1) and 8(1) , the single point of contact designated under article 8(3) , and the csirts designated under article 9;


### a policy on promoting and developing cybersecurity skills , awareness raising and research and development initiatives; ### a policy on promoting and developing cybersecurity skills , awareness raising and research and development initiatives , including targeted policies addressing issues relating to gender representation and balance in the aforementioned areas;


### 2. enisa shall develop and maintain a european vulnerability registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures with a view in particular to enabling important and essential entities and their suppliers of network and information systems to disclose and register vulnerabilities present in ict products or ict services , as well as to provide access to the information on vulnerabilities contained in the registry to all interested parties. the registry shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , the availability of related patches and , in the absence of available patches , guidance addressed to users of vulnerable products and services as to how the risks resulting from disclosed vulnerabilities may be mitigated. ### 2. enisa shall develop and maintain a european vulnerability registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures , and the necessary technical and organisational measures to ensure the security and integrity of the registry , with a view in particular to enabling important and essential entities and their suppliers of network and information systems , as well as entities excluded from the scope of this directive , and their suppliers , to disclose and register vulnerabilities present in ict products or ict services , as well as to provide access to the information on vulnerabilities contained in the registry to all interested parties , enabling all parties and in particular , the users of the ict products or ict services concerned to adopt appropriate mitigating measures. the registry shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , and the availability of related patches.


### 1. the commission shall establish , after consulting the cooperation group and enisa , and at the latest by 18 months following the entry into force of this directive , the methodology and content of a peer-review system for assessing the effectiveness of the member states’ cybersecurity policies. the reviews shall be conducted by cybersecurity technical experts drawn from member states different than the one reviewed and shall cover at least the following: ### 1. the commission shall establish , after consulting the cooperation group and enisa , and at the latest by 18 months following the entry into force of this directive , the methodology and content of a peer-review system for assessing the effectiveness of the member states’ cybersecurity policies. enisa shall develop templates for the self-assessment of the reviewed aspects , which member states being reviewed shall complete and provide to designated experts prior to the commencement of the peer-review process. the reviews shall be conducted by cybersecurity technical experts drawn from enisa and at least two member states different than the one reviewed and shall cover at least the following:


### 2. the methodology shall include objective , non-discriminatory , fair and transparent criteria on the basis of which the member states shall designate experts eligible to carry out the peer reviews. enisa and the commission shall designate experts to participate as observers in the peer-reviews. the commission , supported by enisa , shall establish within the methodology as referred to in paragraph 1 an objective , non-discriminatory , fair and transparent system for the selection and the random allocation of experts for each peer review. ### 2. the methodology shall include objective , non-discriminatory , fair and transparent criteria on the basis of which the member states shall designate experts eligible to carry out the peer reviews. the commission , supported by enisa , shall develop appropriate codes of conduct underpinning the work methods of designated experts participating in peer-reviews to safeguard the confidentiality of information obtained through the peer-review process , and the non-disclosure of such information to any third parties. enisa and the commission shall designate experts to participate as observers in the peer-reviews. the commission , supported by enisa , shall establish within the methodology as referred to in paragraph 1 an objective , non-discriminatory , fair and transparent system for the selection and the random allocation of experts for each peer review.


### 7. experts participating in peer reviews shall draft reports on the findings and conclusions of the reviews. the reports shall be submitted to the commission , the cooperation group , the csirts network and enisa. the reports shall be discussed in the cooperation group and the csirts network. the reports may be published on the dedicated website of the cooperation group. ### 7. experts participating in peer reviews shall draft reports on the findings and conclusions of the reviews. the reports shall include recommendations to enable improvement on the aspects covered by the peer-review process , including recommendations on the transfer of technologies , tools , measures , and processes from member states carrying out the peer-review to the member state being reviewed. the reports shall be submitted to the commission , the cooperation group , the csirts network and enisa. the reports shall be discussed in the cooperation group and the csirts network. the reports may be published on the dedicated website of the cooperation group.


### 1. member states shall ensure that essential and important entities shall take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which those entities use in the provision of their services. having regard to the state of the art , those measures shall ensure a level of security of network and information systems appropriate to the risk presented. ### 1. member states shall ensure that essential and important entities take appropriate and proportionate technical , operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services. having regard to the state of the art , those measures shall ensure a level of security of network and information systems appropriate to the risk presented.


### 1. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt in accordance with paragraphs 3 and 4 of any incident having a significant impact on the provision of their services. where appropriate , those entities shall notify , without undue delay , the recipients of their services of incidents that are likely to adversely affect the provision of that service. member states shall ensure that those entities report , among others , any information enabling the competent authorities or the csirt to determine any cross-border impact of the incident. ### 1. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt in accordance with paragraphs 2 and 3 of any incident having a significant impact. where the incident concerns the provisions of entities’ services , those entities shall notify affected users about the unavailability or underlying risks of use of the service in order to mitigate the adverse effects of the incident. essential and important entities may deviate from notifying affected users in case of overriding reasons inducing , but not limited to , that notification worsening the impact of an ongoing incident. member states shall ensure that those entities report , among others , any information enabling the competent authorities or the csirt to determine any cross-border impact of the incident. the notification shall not make the notifying entity subject to increased liability.


### 2. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt of any significant cyber threat that those entities identify that could have potentially resulted in a significant incident. ### deleted


### without undue delay and in any event within 24 hours after having become aware of the incident , an initial notification , which , where applicable , shall indicate whether the incident is presumably caused by unlawful or malicious action; ### without undue delay and in any event within 72 hours after having become aware of the incident , an initial notification , which , where applicable , shall indicate whether the incident is presumably caused by unlawful or malicious action;


### a final report not later than one month after the submission of the report under point (a) , including at least the following: ### a comprehensive report not later than one month after the submission of the report under point(a) , including at least the following:


### 5. the competent national authorities or the csirt shall provide , within 24 hours after receiving the initial notification referred to in point (a) of paragraph 4 , a response to the notifying entity , including initial feedback on the incident and , upon request of the entity , guidance on the implementation of possible mitigation measures. where the csirt did not receive the notification referred to in paragraph 1 , the guidance shall be provided by the competent authority in collaboration with the csirt. the csirt shall provide additional technical support if the concerned entity so requests. where the incident is suspected to be of criminal nature , the competent national authorities or the csirt shall also provide guidance on reporting the incident to law enforcement authorities. ### 5. the competent national authorities or the csirt shall provide , within 24 hours after receiving the initial notification referred to in point (b) of paragraph 3 , a response to the notifying entity , including initial feedback on the incident and , upon request of the entity , guidance on the implementation of possible mitigation measures. where the csirt did not receive the notification referred to in paragraph 1 , the guidance shall be provided by the competent authority in collaboration with the csirt. the csirt shall provide additional technical support if the concerned entity so requests. where the incident is suspected to be of criminal nature , the competent national authorities or the csirt shall also provide guidance on reporting the incident to law enforcement authorities.


### 1. in order to demonstrate compliance with certain requirements of article 18 , member states may require essential and important entities to certify certain ict products , ict services and ict processes under specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881. the products , services and processes subject to certification may be developed by an essential or important entity or procured from third parties. ### 1. in order to demonstrate compliance with certain requirements of article 18 , and following guidance from enisa , the commission , and the cooperation group , member states shall encourage essential and important entities to certify certain ict products , ict services and ict processes , developed either by the essential and important entities or procured from third parties , under specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881 , or under equivalent and internationally accepted certification schemes.


### 1. for the purpose of contributing to the security , stability and resilience of the dns , member states shall ensure that tld registries and the entities providing domain name registration services for the tld shall collect and maintain accurate and complete domain name registration data in a dedicated database facility with due diligence subject to union data protection law as regards data which are personal data. ### 1. for the purpose of contributing to the security , stability and resilience of the dns , member states shall ensure that tld registries and entities providing domain name registration services shall collect and maintain accurate and complete domain name registration data in a dedicated database.


### 4. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld publish , without undue delay after the registration of a domain name , domain registration data which are not personal data. ### 4. member states shall ensure that tld registries and entities providing domain name registration services make publicly available , within 72 hours after the registration of a domain name , domain registration data of legal persons as registrants.


### 5. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld provide access to specific domain name registration data upon lawful and duly justified requests of legitimate access seekers , in compliance with union data protection law. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld reply without undue delay to all requests for access. member states shall ensure that policies and procedures to disclose such data are made publicly available. ### 5. member states shall ensure that tld registries and entities providing domain name registration services provide access to specific domain name registration data , including personal data , upon duly justified requests of legitimate access seekers , in compliance with union data protection law. member states shall ensure that the tld registries and entities providing domain name registration services reply within 72 hours to all requests for access. member states shall ensure that policies and procedures to disclose such data are made publicly available. the commission may adopt implementing acts laying out the requirements to be demonstrated by legitimate access seekers to tld registries and entities providing domain name registration services before access to specific domain name registration data is granted. those implementing acts shall be adopted in accordance with the examination procedure referred to in article 37(2).


### 1. enisa shall create and maintain a registry for essential and important entities referred to in article 24(1). the entities shall submit the following information to enisa by [12 months after entering into force of the directive at the latest]: ### 1. enisa shall create and maintain a registry for essential and important entities referred to in article 24(1). enisa shall establish appropriate information classification and management protocols to ensure the security and confidentiality of disclosed information , and restrict the access , storage , and transmission of such information to intended users. the entities shall submit the following information to enisa by [12 months after entering into force of the directive at the latest]:


### 2. member states shall ensure that the exchange of information takes place within trusted communities of essential and important entities. such exchange shall be implemented through information sharing arrangements in respect of the potentially sensitive nature of the information shared and in compliance with the rules of union law referred to in paragraph 1. ### 2. member states shall facilitate the exchange of information by enabling the establishment of trusted communities of essential and important entities. such exchange shall be implemented through information sharing arrangements in respect of the potentially sensitive nature of the information shared.


### 3. member states shall set out rules specifying the procedure , operational elements (including the use of dedicated ict platforms) , content and conditions of the information sharing arrangements referred to in paragraph 2. such rules shall also lay down the details of the involvement of public authorities in such arrangements , as well as operational elements , including the use of dedicated it platforms. member states shall offer support to the application of such arrangements in accordance with their policies referred to in article 5(2) (g). ### 3. member states shall facilitate information sharing by making operational elements (including the use of dedicated ict platforms) , and content available of the information sharing arrangements referred to in paragraph 2 , and may impose certain conditions on the information made available by competent authorities or csirts. member states shall also lay down the details of the involvement of public authorities in such arrangements , as well as operational elements , including the use of dedicated it platforms. member states shall offer support to the application of such arrangements in accordance with their policies referred to in article 5(2)(l).


### targeted security audits based on risk assessments or risk-related available information; ### targeted security audits based on risk assessments performed by the competent authorities , risk assessments performed by the audited entity , or in the absence thereof , risk-related available information;


### impose or request the imposition by the relevant bodies or courts according to national laws of a temporary ban against any person discharging managerial responsibilities at chief executive officer or legal representative level in that essential entity , and of any other natural person held responsible for the breach , from exercising managerial functions in that entity. ### impose or request the imposition by the relevant bodies or courts according to national laws of a temporary ban against any person discharging managerial responsibilities at chief executive officer or legal representative level in that essential entity from exercising managerial functions in that entity. this provision shall not apply to public administration entities as referred to in point (23) of article 4.


### targeted security audits based on risk assessments or risk-related available information; ### targeted security audits based on risk assessments performed by the competent authority , risk assessments performed by the audited entity , or in the absence thereof , risk-related available information;


### 1. where the competent authorities have indications that the infringement by an essential or important entity of the obligations laid down in articles 18 and 20 entails a personal data breach , as defined by article 4(12) of regulation (eu) 2016/679 which shall be notified pursuant to article 33 of that regulation , they shall inform the supervisory authorities competent pursuant to articles 55 and 56 of that regulation within a reasonable period of time. ### 1. where the competent authorities have indications that the infringement by an essential or important entity of the obligations laid down in articles 18 and 20 entails a personal data breach , as defined by article 4(12) of regulation(eu) 2016/679 which shall be notified pursuant to article 33 of that regulation , they shall inform the supervisory authorities competent pursuant to articles 55 and 56 of that regulation without undue delay.


### 6. where provisions of sector–specific acts of union law require essential or important entities either to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats , and where those requirements are at least equivalent in effect to the obligations laid down in this directive , the relevant provisions of this directive , including the provision on supervision and enforcement laid down in chapter vi , shall not apply. ### 6. sector-specific acts that require essential or important entities either to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats , shall , where possible , refer to the definitions in article 4 of this directive. where provisions of sector–specific acts of union law require essential or important entities either to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats , and where those requirements are at least equivalent in effect to the obligations laid down in this directive , the relevant provisions of this directive , including the provision on supervision and enforcement laid down in chapter vi , shall not apply.


### 3. member states shall notify their national cybersecurity strategies to the commission within three months from their adoption. member states may exclude specific information from the notification where and to the extent that it is strictly necessary to preserve national security. ### 3. member states shall notify their national cybersecurity strategies to the commission within three months from their adoption. member states may exclude specific information from the notification where and to the extent that it is necessary to preserve national security.


### 11. the commission , may adopt implementing acts further specifying the type of information , the format and the procedure of a notification submitted pursuant to paragraphs 1 and 2. the commission may also adopt implementing acts to further specify the cases in which an incident shall be considered significant as referred to in paragraph 3. those implementing acts shall be adopted in accordance with the examination procedure referred to in article 37(2). ### 11. the commission shall be empowered to adopt delegated acts further specifying the cases in which an incident shall be considered significant as referred to in paragraph 2 , and in accordance with the exercise of delegation power referred to in article 36.


### (2) since the entry into force of directive (eu) 2016/1148 significant progress has been made in increasing the union’s level of cybersecurity resilience. the review of that directive has shown that it has served as a catalyst for the institutional and regulatory approach to cybersecurity in the union , paving the way for a significant change in mind-set. that directive has ensured the completion of national frameworks by defining national cybersecurity strategies , establishing national capabilities , and implementing regulatory measures covering essential infrastructures and actors identified by each member state. it has also contributed to cooperation at union level through the establishment of the cooperation group12 and a network of national computer security incident response teams (‘csirts network’)13 . notwithstanding those achievements , the review of directive (eu) 2016/1148 has revealed inherent shortcomings that prevent it from addressing effectively contemporaneous and emerging cybersecurity challenges. ### (2) since the entry into force of directive (eu) 2016/1148 significant progress has been made in increasing the union’s level of cybersecurity resilience. the review of that directive has shown that it has served as a catalyst for the institutional and regulatory approach to cybersecurity in the union , paving the way for a significant change in mind-set. that directive has ensured the completion of national frameworks by defining national cybersecurity strategies , establishing national capabilities , and implementing regulatory measures covering essential infrastructures and actors identified by each member state. it has also contributed to cooperation at union level through the establishment of the cooperation group12 and a network of national computer security incident response teams (‘csirts network’)13 . directive (eu) 2016/1148 was the first union-wide legislative act on cybersecurity , providing legal measures to boost the overall level of cyber resilience also in the security and defence domain in the union by ensuring member states' cooperation and a culture of security across sectors. notwithstanding those achievements , the review of directive (eu) 2016/1148 has revealed inherent shortcomings that prevent it from addressing effectively contemporaneous and emerging cybersecurity challenges , which very often originate from outside the union , posing a serious threat to internal and external security at union level.


### (6) this directive leaves unaffected the ability of member states to take the necessary measures to ensure the protection of the essential interests of their security , to safeguard public policy and public security , and to allow for the investigation , detection and prosecution of criminal offences , in compliance with union law. in accordance with article 346 tfeu , no member state is to be obliged to supply information the disclosure of which would be contrary to the essential interests of its public security. in this context , national and union rules for protecting classified information , non-disclosure agreements , and informal non-disclosure agreements such as the traffic light protocol14 , are of relevance. ### (6) this directive leaves unaffected the ability of member states to take the necessary measures to ensure the protection of the essential interests of their security , to safeguard public policy and public security , and to allow for the investigation , detection and prosecution of criminal offences , in compliance with union law. independently of the technological environment of the day , it is essential to always fully respect due process and other safeguards , as well as fundamental rights , in particular the right to the respect for private life and communications and the right to the protection of personal data. similarly , in order to ensure an all-encompassing resilience , it is necessary not only to strengthen technological infrastructures and to possess response capabilities , but also to spread a cybersecurity culture among the population according to article 7 and 8 of the cybersecurity act. in accordance with article 346 tfeu , no member state is to be obliged to supply information the disclosure of which would be contrary to the essential interests of its public security. in this context , national and union rules for protecting classified information , non-disclosure agreements , and informal non-disclosure agreements such as the traffic light protocol14 , are of relevance.


### (29) member states should therefore take measures to facilitate coordinated vulnerability disclosure by establishing a relevant national policy. in this regard , member states should designate a csirt to take the role of ‘coordinator’ , acting as an intermediary between the reporting entities and the manufacturers or providers of ict products or services where necessary. the tasks of the csirt coordinator should in particular include identifying and contacting concerned entities , supporting reporting entities , negotiating disclosure timelines , and managing vulnerabilities that affect multiple organisations (multi-party vulnerability disclosure). where vulnerabilities affect multiple manufacturers or providers of ict products or services established in more than one member state , the designated csirts from each of the affected member states should cooperate within the csirts network. ### (29) member states should therefore take measures to facilitate coordinated vulnerability disclosure by establishing a relevant national policy. in this regard , member states should designate a csirt to take the role of ‘coordinator’ , acting as an intermediary between the reporting entities and the manufacturers or providers of ict products or services , where the reporting entity , or the manufacturer or the provider of ict products or services , engages a third-party coordinator to assist with the disclosure process. the tasks of the csirt coordinator should , in particular , include identifying and contacting concerned entities , supporting reporting entities , negotiating disclosure timelines , and managing vulnerabilities that affect multiple organisations (multi-party vulnerability disclosure). where vulnerabilities affect multiple manufacturers or providers of ict products or services established in more than one member state , the designated csirts from each of the affected member states should cooperate within the csirts network.


### (26) given the importance of international cooperation on cybersecurity , csirts should be able to participate in international cooperation networks in addition to the csirts network established by this directive. ### (26) given the importance of international cooperation on cybersecurity , csirts should be able to participate in international cooperation networks in addition to the csirts network established by this directive , in order to contribute to the development of union standards that can shape the cybersecurity landscape at international level. on this point , an essential role can be played by the important means of "cyberdiplomacy" in the eu toolbox. striving to secure multilateral agreements on cyber norms , responsible state and non-state behaviour in cyberspace and effective global digital governance as well as creating an open , free , stable and secure cyberspace anchored in international law through alliances between like-minded countries , organisations , the private sector , civil society and experts , it's an integral part of a more comprehensive cybersecurity strategy.


### (36) the union should , where appropriate , conclude international agreements , in accordance with article 218 tfeu , with third countries or international organisations , allowing and organising their participation in some activities of the cooperation group and the csirts network. such agreements should ensure adequate protection of data. ### (36) the union should , where appropriate , conclude international agreements , in accordance with article 218 tfeu , with third countries or international organisations , allowing and organising their participation in some activities of the cooperation group and the csirts network. such agreements are to ensure adequate protection of data and should promote market access as well as address security risks while increasing global resilience and raise awareness about cyber threats and malicious cyber activities. particular emphasis should be placed on building a strong partnership in the cyber domain with like-minded countries and organisations such as the uk , usa and nato which are leading actors in the cybersecurity domain. therefore , the union should investigate the possibility to re-launch processes aiming at concluding formal and structured frameworks for cooperation in this field in the future.


### (43) addressing cybersecurity risks stemming from an entity’s supply chain and its relationship with its suppliers is particularly important given the prevalence of incidents where entities have fallen victim to cyber-attacks and where malicious actors were able to compromise the security of an entity’s network and information systems by exploiting vulnerabilities affecting third party products and services. entities should therefore assess and take into account the overall quality of products and cybersecurity practices of their suppliers and service providers , including their secure development procedures. ### (43) addressing cybersecurity risks stemming from an entity’s supply chain and its relationship with its suppliers is particularly important given the prevalence of incidents where entities have fallen victim to cyber-attacks and where malicious actors were able to compromise the security of an entity’s network and information systems by exploiting vulnerabilities affecting third party products and services. entities should evaluate their own cybersecurity capabilities and pursue the integration of cybersecurity enhancing technologies driven by ai or machine learning systems to automate their capabilities and the protection of network architectures. entities should also assess and take into account the overall quality of products and cybersecurity practices of their suppliers and service providers , including their secure development procedures.


### 2. member states shall ensure that members of the management body follow specific trainings , on a regular basis , to gain sufficient knowledge and skills in order to apprehend and assess cybersecurity risks and management practices and their impact on the operations of the entity. ### 2. member states shall ensure that members of the management body of essential and important entities follow specific trainings , and shall encourage essential and important entities to offer similar trainings to all employees , on a regular basis , to gain sufficient knowledge and skills in order to apprehend and assess cybersecurity risks and management practices and their impact on the operations of the entity.