### refrain from requiring business users or end users to subscribe to or register with any other core platform services identified pursuant to article 3 or which meets the thresholds in article 3(2)(b) as a condition to access , sign up or register to any of their core platform services identified pursuant to that article; ### refrain from requiring business users or end users to subscribe to , register or use any other digital service as a condition to access , sign up , register to , or use any of their core platform services identified pursuant to article 3 or meeting the thresholds of article 3 (2) (b) or as a condition for obtaining a better price for the use of such core platform services or any product or services offered through such core platform;


### refrain from requiring business users or end users to subscribe to or register with any other core platform services identified pursuant to article 3 or which meets the thresholds in article 3(2)(b) as a condition to access , sign up or register to any of their core platform services identified pursuant to that article; ### not require business users or end users to use , subscribe to or register with any other service of the gatekeeper as a condition to access , sign up or register to any of their core platform services nor achieve the same result through product design , nor automatically sign users of a core platform service into any such services owned or controlled by the gatekeeper;


### provide advertisers and publishers to which it supplies advertising services , upon their request , with information concerning the price paid by the advertiser and publisher , as well as the amount or remuneration paid to the publisher , for the publishing of a given ad and for each of the relevant advertising services provided by the gatekeeper. ### provide advertisers and publishers to which it supplies advertising services , upon their request , with a comprehensive set of information concerning:


### provide advertisers and publishers to which it supplies advertising services , upon their request , with information concerning the price paid by the advertiser and publisher , as well as the amount or remuneration paid to the publisher , for the publishing of a given ad and for each of the relevant advertising services provided by the gatekeeper. ### provide advertisers and publishers to which it supplies advertising services on a continuous and real-time basis , with complete information concerning the price-setting mechanisms and schemes for the calculation of the fees as well as the price and fees paid by the advertiser and publisher , including any deductions and surcharges as well as the amount or remuneration paid to the publisher , for the publishing of a given ad and for each of the relevant advertising services provided by the gatekeeper;


### allow end users to un-install any pre-installed software applications on its core platform service without prejudice to the possibility for a gatekeeper to restrict such un-installation in relation to software applications that are essential for the functioning of the operating system or of the device and which cannot technically be offered on a standalone basis by third-parties; ### deleted


### allow end users to un-install any pre-installed software applications on its core platform service without prejudice to the possibility for a gatekeeper to restrict such un-installation in relation to software applications that are essential for the functioning of the operating system or of the device and which cannot technically be offered on a standalone basis by third-parties; ### allow end users and business users to un-install any software applications on an operating system the gatekeeper provides or effectively controls as easily as any software application installed by the end user at any stage without prejudice to the possibility for a gatekeeper to restrict such un-installation in relation to software applications that the gatekeeper can prove are essential for the functioning of the operating system or of the device and which cannot technically be offered on a standalone basis by third-parties;


### allow the installation and effective use of third party software applications or software application stores using , or interoperating with , operating systems of that gatekeeper and allow these software applications or software application stores to be accessed by means other than the core platform services of that gatekeeper. the gatekeeper shall not be prevented from taking proportionate measures to ensure that third party software applications or software application stores do not endanger the integrity of the hardware or operating system provided by the gatekeeper; ### allow and technically enable business users and end users to install and effective use third party software applications or software application stores using , or interoperating with , operating systems of that gatekeeper and allow and enable these software applications and software application stores to be accessed by means other than the core platform services of that gatekeeper. the end user shall be required to decide which application or application store should become the default. the gatekeeper shall not be prevented from taking proportionate measures to ensure that third party software applications or software application stores do not endanger the integrity of the hardware or operating system provided by the gatekeeper provided that the gatekeeper can prove that such measures are necessary , proportionate and justified to safeguard the integrity of the hardware or operating system;


### provide advertisers and publishers , upon their request and free of charge , with access to the performance measuring tools of the gatekeeper and the information necessary for advertisers and publishers to carry out their own independent verification of the ad inventory; ### provide advertisers and publishers , upon their request a continuous , real-time and free of charge access to the performance measuring tools of the gatekeeper and provide for full disclosure and transparency of the parameters and data used for decision making , execution and measurement of the intermediation services.


### provide advertisers and publishers , upon their request and free of charge , with access to the performance measuring tools of the gatekeeper and the information necessary for advertisers and publishers to carry out their own independent verification of the ad inventory; ### provide advertisers and publishers , upon their request and free of charge , with access to the performance measuring tools of the gatekeeper and via a suitable interface high-quality , continuous and real-time access and use of all the information and data necessary for advertisers and publishers , independent third parties , to effectively carry out their own independent measurement of the performance of their services and the intermediation services provided by the gatekeeper , including the verification of the provision of the relevant advertising services , the ad inventory and the attribution;


### provide advertisers and publishers , upon their request and free of charge , with access to the performance measuring tools of the gatekeeper and the information necessary for advertisers and publishers to carry out their own independent verification of the ad inventory; ### provide advertisers and publishers , or third parties authorised by advertisers and publishers , upon their request and free of charge , with effective and real time access to the performance measuring tools of the gatekeeper and the information necessary for advertisers and publishers to carry out their own independent verification of the ad inventory; not retain payments for advertisements under the claims that traffic is irregular , without providing detailed evidence for that irregularity and giving the publisher the opportunity to raise objections;


### provide effective portability of data generated through the activity of a business user or end user and shall , in particular , provide tools for end users to facilitate the exercise of data portability , in line with regulation eu 2016/679 , including by the provision of continuous and real-time access ; ### provide effective portability of data generated through the activity of a business user or end user and shall , in particular , provide tools for end users to facilitate the exercise of such data portability , including by the provision of continuous and real-time access ;


### provide effective portability of data generated through the activity of a business user or end user and shall , in particular , provide tools for end users to facilitate the exercise of data portability , in line with regulation eu 2016/679 , including by the provision of continuous and real-time access ; ### provide effective portability of data , including by implementing appropriate technical and organisational measures , generated through or in the context of the activity of a business user or end user and shall , in particular , provide tools for end users to facilitate the exercise of data portability that is adequate , relevant and limited to what is necessary , in line with regulation eu 2016/679 , including by the provision of continuous and real-time access;


### provide effective portability of data generated through the activity of a business user or end user and shall , in particular , provide tools for end users to facilitate the exercise of data portability , in line with regulation eu 2016/679 , including by the provision of continuous and real-time access ; ### provide end users or third parties authorised by an end user , free of charge , with effective portability of data provided by the end user or generated through his or her activity in the context of their use on the relevant core platform service , including by providing tools for end users to facilitate the effective exercise of such data portability , in line with regulation (eu) 2016/679 , and including by the provision of continuous and real-time access;


### provide to any third party providers of online search engines , upon their request , with access on fair , reasonable and non-discriminatory terms to ranking , query , click and view data in relation to free and paid search generated by end users on online search engines of the gatekeeper , subject to anonymisation for the query , click and view data that constitutes personal data; ### provide to any third party providers of online search engines , upon their request , with access on fair , reasonable and non-discriminatory terms to fully anonymised ranking , query , click and view data in relation to free and paid search generated by end users on online search engines of the gatekeeper , as query , click and view data constitutes personal data;


### provide to any third party providers of online search engines , upon their request , with access on fair , reasonable and non-discriminatory terms to ranking , query , click and view data in relation to free and paid search generated by end users on online search engines of the gatekeeper , subject to anonymisation for the query , click and view data that constitutes personal data; ### provide to any third party providers of online search engines , upon their request , with access on fair , reasonable and non-discriminatory terms to ranking , query , click and view data in relation to free and paid search generated by end users on online search engines of the gatekeeper , subject to anonymisation for the ranking , query , click and view data that constitutes personal data;


### apply fair and non-discriminatory general conditions of access for business users to its software application store designated pursuant to article 3 of this regulation. ### apply transparent , fair and non-discriminatory general conditions of access for business users and end users to any of its core platform services by default through implementing appropriate technical and organisational measures to its software application store designated pursuant to article 3 of this regulation.


### apply fair and non-discriminatory general conditions of access for business users to its software application store designated pursuant to article 3 of this regulation. ### apply fair and non-discriminatory general conditions of access for business users to its platform services and its software application store designated pursuant to article 3 of this regulation , refraining from recurring to the placement of sponsored content or advertising in the content of third parties without their prior consent


### 2. for the purposes of point (a) of paragraph 1 data that is not publicly available shall include any aggregated and non-aggregated data generated by business users that can be inferred from , or collected through , the commercial activities of business users or their customers on the core platform service of the gatekeeper. ### 2. for the purposes of point (a) of paragraph 1 data that is not publicly available shall include any aggregated and non-aggregated data generated by business users that can be inferred from , or collected through , the commercial activities of business users or their customers on the core platform service of the gatekeeper. the commission shall publish the technical specifications for individual gatekeepers , without prejudice to business secrets.


### 2. gatekeepers , undertakings and associations of undertakings concerned may submit their observations to the commission’s preliminary findings within a time limit which shall be fixed by the commission in its preliminary findings and which may not be less than 14 days. ### 2. gatekeepers , undertakings , associations of undertakings concerned and third parties with a legitimate interest may submit their observations to the commission’s preliminary findings within a time limit which shall be fixed by the commission in its preliminary findings and which may not be less than 14 days.


### (29) designated gatekeepers should comply with the obligations laid down in this regulation in respect of each of the core platform services listed in the relevant designation decision. the mandatory rules should apply taking into account the conglomerate position of gatekeepers , where applicable. furthermore , implementing measures that the commission may by decision impose on the gatekeeper following a regulatory dialogue should be designed in an effective manner , having regard to the features of core platform services as well as possible circumvention risks and in compliance with the principle of proportionality and the fundamental rights of the undertakings concerned as well as those of third parties. ### (29) gatekeepers should comply with the obligations laid down in this regulation in respect of each of the core platform services. the mandatory rules should apply taking into account the conglomerate position of gatekeepers , where applicable. furthermore , implementing measures that the commission may by decision impose on the gatekeeper following a regulatory dialogue should be designed in an effective manner , having regard to the features of core platform services as well as possible circumvention risks and in compliance with the principle of proportionality and the fundamental rights of the undertakings concerned as well as those of third parties.


### (52) gatekeepers may also have a dual role as developers of operating systems and device manufacturers , including any technical functionality that such a device may have. for example , a gatekeeper that is a manufacturer of a device may restrict access to some of the functionalities in this device , such as near-field-communication technology and the software used to operate that technology , which may be required for the effective provision of an ancillary service by the gatekeeper as well as by any potential third party provider of such an ancillary service. such access may equally be required by software applications related to the relevant ancillary services in order to effectively provide similar functionalities as those offered by gatekeepers. if such a dual role is used in a manner that prevents alternative providers of ancillary services or of software applications to have access under equal conditions to the same operating system , hardware or software features that are available or used in the provision by the gatekeeper of any ancillary services , this could significantly undermine innovation by providers of such ancillary services as well as choice for end users of such ancillary services. the gatekeepers should therefore be obliged to ensure access under equal conditions to , and interoperability with , the same operating system , hardware or software features that are available or used in the provision of any ancillary services by the gatekeeper. ### (52) gatekeepers may also have a dual role as developers of operating systems and device manufacturers , including any technical functionality that such a device may have. for example , a gatekeeper that is a manufacturer of a device may restrict access to some of the functionalities in this device , such as near-field-communication technology and the software used to operate that technology , or biometric identity readers , which may be required for the effective provision of an ancillary service by the gatekeeper as well as by any potential third party provider of such an ancillary service. such access may equally be required by software applications related to the relevant ancillary services in order to effectively provide similar functionalities as those offered by gatekeepers. if such a dual role is used in a manner that prevents alternative providers of ancillary services or of software applications to have access under equal conditions to the same operating system , hardware or software features that are available or used in the provision by the gatekeeper of any ancillary services , this could significantly undermine innovation by providers of such ancillary services as well as choice for end users of such ancillary services. the gatekeepers should therefore be obliged to ensure access under equal conditions to , and interoperability with , the same operating system , hardware or software features that are available or used in the provision of any ancillary services by the gatekeeper. these equal conditions include conditions of economic , technical , or any other nature.


### advertising services , including any advertising networks , advertising exchanges and any other advertising intermediation services , provided by a provider of any of the core platform services listed in points (a) to (g); ### advertising services , including any advertising networks , advertising exchanges and any other advertising intermediation services , provided by any undertaking of the provider of any of the core platform services listed in points (a) to (g);


### 1. a provider of core platform services shall be designated as gatekeeper if: ### 1. a provider of core platform services is a gatekeeper if:


### 2. a provider of core platform services shall be presumed to satisfy: ### 2. a provider of core platform services shall be deemed to satisfy:


### the requirement in paragraph 1 point (c) where the thresholds in point (b) were met in each of the last three financial years. ### the requirement in paragraph 1 point (c) where the thresholds in point (b) were met in each of the last two financial years.


### the financial liability of each undertaking in respect of the payment of the fine shall not exceed 10 % of its total turnover in the preceding financial year. ### the financial liability of each undertaking in respect of the payment of the fine shall not exceed 30 % of its total turnover in the preceding financial year.


### (12) ‘software application stores’ means a type of online intermediation services , which is focused on software applications as the intermediated product or service; ### (12) ‘software application stores’ means a type of online intermediation services , which is focused on software applications as the intermediated product or service or is provided through cloud services as defined in the regulation;


### where the gatekeeper presents such sufficiently substantiated arguments to demonstrate that it does not satisfy the requirements of paragraph 1 , the commission shall apply paragraph 6 to assess whether the criteria in paragraph 1 are met. ### deleted


### business user or end user lock-in; ### entrenched lack of choice , business user or end user dependency or lock-in;


### 4. in view of adopting the decision under paragraph 2 , the commission shall communicate its preliminary findings within three months from the opening of the proceedings. in the preliminary findings , the commission shall explain the measures it considers to take or it considers that the provider of core platform services concerned should take in order to effectively address the preliminary findings. ### 4. in view of adopting the decision under paragraph 2 , the commission shall communicate its preliminary findings within six weeks from the opening of the proceedings. in the preliminary findings , the commission shall explain the measures it considers to take or it considers that the provider of core platform services concerned should take in order to effectively address the preliminary findings.


### 1. the commission may by simple request or by decision require information from undertakings and associations of undertakings to provide all necessary information , including for the purpose of monitoring , implementing and enforcing the rules laid down in this regulation. the commission may also request access to data bases and algorithms of undertakings and request explanations on those by a simple request or by a decision. ### 1. the commission may by simple request or by decision require information from undertakings and associations of undertakings to provide all necessary information , including for the purpose of monitoring , implementing and enforcing the rules laid down in this regulation. the commission may also request access to data bases , algorithms and a/b testing of undertakings and request explanations on those by a simple request or by a decision. where the simple request is not fulfilled within a period of 3 weeks , the commission may require this information by decision.


### (23) providers of core platform services which meet the quantitative thresholds but are able to present sufficiently substantiated arguments to demonstrate that , in the circumstances in which the relevant core platform service operates , they do not fulfil the objective requirements for a gatekeeper , should not be designated directly , but only subject to a further investigation. the burden of adducing evidence that the presumption deriving from the fulfilment of quantitative thresholds should not apply to a specific provider should be borne by that provider in its assessment , the commission should take into account only the elements which directly relate to the requirements for constituting a gatekeeper , namely whether it is an important gateway which is operated by a provider with a significant impact in the internal market with an entrenched and durable position , either actual or foreseeable. any justification on economic grounds seeking to demonstrate efficiencies deriving from a specific type of behaviour by the provider of core platform services should be discarded , as it is not relevant to the designation as a gatekeeper. the commission should be able to take a decision by relying on the quantitative thresholds where the provider significantly obstructs the investigation by failing to comply with the investigative measures taken by the commission. ### deleted


### (23) providers of core platform services which meet the quantitative thresholds but are able to present sufficiently substantiated arguments to demonstrate that , in the circumstances in which the relevant core platform service operates , they do not fulfil the objective requirements for a gatekeeper , should not be designated directly , but only subject to a further investigation. the burden of adducing evidence that the presumption deriving from the fulfilment of quantitative thresholds should not apply to a specific provider should be borne by that provider in its assessment , the commission should take into account only the elements which directly relate to the requirements for constituting a gatekeeper , namely whether it is an important gateway which is operated by a provider with a significant impact in the internal market with an entrenched and durable position , either actual or foreseeable. any justification on economic grounds seeking to demonstrate efficiencies deriving from a specific type of behaviour by the provider of core platform services should be discarded , as it is not relevant to the designation as a gatekeeper. the commission should be able to take a decision by relying on the quantitative thresholds where the provider significantly obstructs the investigation by failing to comply with the investigative measures taken by the commission. ### (23) providers of core platform services which meet the quantitative thresholds but are able to present sufficiently substantiated arguments to demonstrate that , in the circumstances in which the relevant core platform service operates , they do not fulfil the objective requirements for a gatekeeper , should not be designated directly , but only subject to a further investigation. the burden of adducing , in a conclusive manner consonant with europe-wide values and rules , evidence that the presumption deriving from the fulfilment of quantitative thresholds should not apply to a specific provider should be borne by that provider. in its assessment , the commission should take into account only the elements which directly relate to the requirements for constituting a gatekeeper , namely whether it is an important gateway which is operated by a provider with a significant impact in the internal market with an entrenched and durable position , either actual or foreseeable. any justification on economic grounds seeking to demonstrate efficiencies deriving from a specific type of behaviour by the provider of core platform services should be discarded , as it is not relevant to the designation as a gatekeeper. the commission should be able to take a decision by relying on the quantitative thresholds where the provider significantly obstructs the investigation by failing to comply with the investigative measures taken by the commission.


### (16) in order to ensure the effective application of this regulation to providers of core platform services which are most likely to satisfy these objective requirements , and where unfair conduct weakening contestability is most prevalent and impactful , the commission should be able to directly designate as gatekeepers those providers of core platform services which meet certain quantitative thresholds. such undertakings should in any event be subject to a fast designation process which should start upon the entry into force of this regulation. ### (16) in order to ensure the effective application of this regulation to providers of core platform services which are most likely to satisfy these objective requirements , and where unfair conduct weakening contestability is most prevalent and impactful , the providers of core platform services which meet certain quantitative thresholds should be automatically deemed to be gatekeepers. since the quantitative thresholds are objective requirements , no further designation by the commission is necessary.


### (16) in order to ensure the effective application of this regulation to providers of core platform services which are most likely to satisfy these objective requirements , and where unfair conduct weakening contestability is most prevalent and impactful , the commission should be able to directly designate as gatekeepers those providers of core platform services which meet certain quantitative thresholds. such undertakings should in any event be subject to a fast designation process which should start upon the entry into force of this regulation. ### (16) in order to ensure the effective application of this regulation to providers of core platform services which are most likely to satisfy these objective requirements , and where unfair conduct weakening contestability is most prevalent and impactful , the commission should be able to directly designate as gatekeepers those providers of core platform services which meet certain quantitative thresholds even if offering only one essential platform service. such undertakings should in any event be subject to a fast designation process which should start upon the entry into force of this regulation.


### (24) provision should also be made for the assessment of the gatekeeper role of providers of core platform services which do not satisfy all of the quantitative thresholds , in light of the overall objective requirements that they have a significant impact on the internal market , act as an important gateway for business users to reach end users and benefit from a durable and entrenched position in their operations or it is foreseeable that it will do so in the near future. ### (24) provision should also be made for the assessment of the gatekeeper role of providers of core platform services which do not satisfy all of the quantitative thresholds , in light of the overall objective requirements that they have a significant impact on the internal market , act as an important gateway for business users to reach end users and benefit from a durable and entrenched position in their operations or it is foreseeable that it will do so in the near future as well as in light of their actual or potential market share or market dominance in the relevant market.


### (68) in order to ensure effective implementation and compliance with this regulation , the commission should have strong investigative and enforcement powers , to allow it to investigate , enforce and monitor the rules laid down in this regulation , while at the same time ensuring the respect for the fundamental right to be heard and to have access to the file in the context of the enforcement proceedings. the commission should dispose of these investigative powers also for the purpose of carrying out market investigations for the purpose of updating and reviewing this regulation. ### (68) in order to ensure effective implementation and compliance with this regulation , the commission , supported by the member states authorities , should have strong investigative and enforcement powers , to allow it to investigate , enforce and monitor the rules laid down in this regulation , while at the same time ensuring the respect for the fundamental right to be heard and to have access to the file in the context of the enforcement proceedings. the commission should dispose of these investigative powers also for the purpose of carrying out market investigations for the purpose of updating and reviewing this regulation.


### 4. a gatekeeper shall be deemed to have further strengthened or extended its gatekeeper position in relation to the characteristics under article 3(1) , where its impact on the internal market has further increased , its importance as a gateway for business users to reach end users has further increased or the gatekeeper enjoys a further entrenched and durable position in its operations. ### deleted


### 3. should the commission consider that the commitments submitted by the gatekeeper concerned cannot ensure effective compliance with the obligations laid down in articles 5 and 6 , it shall explain the reasons for not making those commitments binding in the decision concluding the relevant proceedings. ### 3. should the commission consider that the commitments submitted by the gatekeeper concerned cannot ensure effective compliance with the obligations laid down in articles 5 and 6 , it shall explain the reasons for not making those commitments binding in the decision concluding the relevant proceedings and , following an investigation , require changes to the commitments in order to make them effective.


### 4. the gatekeeper shall provide the commission with the description of the measures it took to ensure compliance with the decision adopted pursuant to paragraph 1. ### 4. the gatekeeper shall provide the commission with the description of the measures it took to ensure compliance with the decision adopted pursuant to paragraph 1. if the commission , following an investigation , finds that the measures are not effective to ensure compliance by the gatekeeper with its obligations under articles 5 and 6 , the commission shall be entitled to require changes to these measures.


### 1. the power of the commission to enforce decisions taken pursuant to articles 26 and 27 shall be subject to a limitation period of five years. ### 1. the power of the commission to enforce decisions taken pursuant to articles 26 and 27 shall be subject to a limitation period of seven years.


### 1. the information collected pursuant to articles 3 , 12 , 13 , 19 , 20 and 21 shall be used only for the purposes of this regulation. ### 1. the information collected pursuant to articles 3 , 19 , 20 and 21 shall be used only for the purposes of this regulation.


### 2. without prejudice to the exchange and to the use of information provided for the purpose of use pursuant to articles 32 and 33 , the commission , the authorities of the member states , their officials , servants and other persons working under the supervision of these authorities and any natural or legal person , including auditors and experts appointed pursuant to article 24(2) , shall not disclose information acquired or exchanged by them pursuant to this regulation and of the kind covered by the obligation of professional secrecy. this obligation shall also apply to all representatives and experts of member states participating in any of the activities of the digital markets advisory committee pursuant to article 32. ### 2. without prejudice to the exchange and to the use of information provided for the purpose of use pursuant to articles 12 , 13 , 32 and 33 , the commission , the authorities of the member states , their officials , servants and other persons working under the supervision of these authorities and any natural or legal person , including auditors and experts appointed pursuant to article 24(2) , shall not disclose information acquired or exchanged by them pursuant to this regulation and of the kind covered by the obligation of professional secrecy. this obligation shall also apply to all representatives and experts of member states participating in any of the activities of the digital markets advisory committee pursuant to article 32.


### 33 request for a market investigation ### 33 request for a market investigation and non-compliance proceedings


### cloud computing services; ### software as a service including cloud computing services;


### 3 designation of gatekeepers ### 3 qualification as gatekeepers


### 4. the commission shall , without undue delay and at the latest 60 days after receiving the complete information referred to in paragraph 3 , designate the provider of core platform services that meets all the thresholds of paragraph 2 as a gatekeeper , unless that provider , with its notification , presents sufficiently substantiated arguments to demonstrate that , in the circumstances in which the relevant core platform service operates , and taking into account the elements listed in paragraph 6 , the provider does not satisfy the requirements of paragraph 1. ### deleted


### the size , including turnover and market capitalisation , operations and position of the provider of core platform services; ### the size , including turnover and market capitalisation , operations and position of the provider of core platform services , actual or potential market share and market dominance in the relevant markets;


### obligations for gatekeepers susceptible of being further specified ### obligations for gatekeepers susceptible of being further technically specified


### (5) all those divergences entail a fragmentation of the internal market and are liable to have a prejudicial effect on its functioning , affecting in particular the cross-border provision of services and level of cybersecurity resilience due to the application of different standards. this directive aims to remove such wide divergences among member states , in particular by setting out minimum rules regarding the functioning of a coordinated regulatory framework , by laying down mechanisms for the effective cooperation among the responsible authorities in each member state , by updating the list of sectors and activities subject to cybersecurity obligations and by providing effective remedies and sanctions which are instrumental to the effective enforcement of those obligations. therefore , directive (eu) 2016/1148 should be repealed and replaced by this directive. ### (5) all those divergences entail a fragmentation of the internal market and are liable to have a prejudicial effect on its functioning , affecting in particular the cross-border provision of services and level of cybersecurity resilience due to the application of different standards. this directive aims to remove such wide divergences among member states and strengthen the internal market , in particular by setting out minimum rules regarding the functioning of a coordinated regulatory framework , by laying down mechanisms for the effective cooperation among the responsible authorities in each member state , by updating the list of sectors and activities subject to cybersecurity obligations and by providing effective remedies and sanctions which are instrumental to the effective enforcement of those obligations. therefore , directive (eu) 2016/1148 should be repealed and replaced by this directive.


### (5) all those divergences entail a fragmentation of the internal market and are liable to have a prejudicial effect on its functioning , affecting in particular the cross-border provision of services and level of cybersecurity resilience due to the application of different standards. this directive aims to remove such wide divergences among member states , in particular by setting out minimum rules regarding the functioning of a coordinated regulatory framework , by laying down mechanisms for the effective cooperation among the responsible authorities in each member state , by updating the list of sectors and activities subject to cybersecurity obligations and by providing effective remedies and sanctions which are instrumental to the effective enforcement of those obligations. therefore , directive (eu) 2016/1148 should be repealed and replaced by this directive. ### (5) all those divergences entail a fragmentation of the internal market and are liable to have a prejudicial effect on its functioning , affecting in particular the cross-border provision of services and level of cybersecurity resilience due to the application of different standards. cybersecurity must form the basis for the digital transformation of daily activities within the entire european union and must consolidate cooperation between the eu bodies and the authorities of the member states that are responsible for preventing and discouraging cyber attacks. this directive aims to remove such wide divergences among member states , in particular by setting out minimum rules regarding the functioning of a coordinated regulatory framework , by laying down mechanisms for the effective cooperation among the responsible authorities in each member state , by updating the list of sectors and activities subject to cybersecurity obligations and by providing effective remedies and sanctions which are instrumental to the effective enforcement of those obligations. therefore , directive (eu) 2016/1148 should be repealed and replaced by this directive.


### (10) the commission , in cooperation with the cooperation group , may issue guidelines on the implementation of the criteria applicable to micro and small enterprises. ### (10) the commission , in cooperation with the cooperation group , should issue guidelines on the implementation of the criteria applicable to micro and small enterprises.


### (10) the commission , in cooperation with the cooperation group , may issue guidelines on the implementation of the criteria applicable to micro and small enterprises. ### (10) the commission , in cooperation with the cooperation group and industry stakeholders , may issue guidelines on the implementation of the criteria applicable to micro and small enterprises.


### (11) depending on the sector in which they operate or the type of service they provide , the entities falling within the scope of this directive should be classified into two categories: essential and important. that categorisation should take into account the level of criticality of the sector or of the type of service , as well as the level of dependency of other sectors or types of services. both essential and important entities should be subject to the same risk management requirements and reporting obligations. the supervisory and penalty regimes between these two categories of entities should be differentiated to ensure a fair balance between requirements and obligations on one hand , and the administrative burden stemming from the supervision of compliance on the other hand. ### (11) depending on the sector in which they operate or the type of service they provide , the entities falling within the scope of this directive should be classified into two categories: essential and important. that categorisation should take into account the level of criticality of the sector or of the type of service , as well as the level of dependency of other sectors or types of services. both essential and important entities should be subject to the same risk management requirements and reporting obligations. the supervisory and penalty regimes between these two categories of entities should be differentiated to ensure a fair balance between requirements and obligations on one hand , and the administrative burden stemming from the supervision of compliance on the other hand. this balance also helps national competent authorities to focus on those operators whose cybersecurity represents the highest societal risk.


### (11) depending on the sector in which they operate or the type of service they provide , the entities falling within the scope of this directive should be classified into two categories: essential and important. that categorisation should take into account the level of criticality of the sector or of the type of service , as well as the level of dependency of other sectors or types of services. both essential and important entities should be subject to the same risk management requirements and reporting obligations. the supervisory and penalty regimes between these two categories of entities should be differentiated to ensure a fair balance between requirements and obligations on one hand , and the administrative burden stemming from the supervision of compliance on the other hand. ### (11) depending on the sector in which they operate or the type of service they provide , the entities falling within the scope of this directive should be classified into two categories: essential and important. that categorisation should take into account the level of criticality of the sector or of the type of service , as well as the level of dependency of other sectors or types of services. both essential and important entities should be subject to the same risk management requirements and reporting obligations. the supervisory and penalty regimes between these two categories of entities should be differentiated to ensure a fair balance between requirements and obligations on one hand , and the administrative burden stemming from the supervision of compliance on the other hand. the provisions of this directive apply to entities with complex business models or operating environments , whereby an entity may simultaneously fulfil the criteria assigned to both essential and important entities. in order to enable the effective supervision and enforcement of risk management measures and reporting obligations for entities falling within the scope of this directive , competent authorities or csirts shall enforce the provisions of this directive to a function or unit level within an entity , in order to appropriately and sufficiently address the level of criticality.


### (12) sector-specific legislation and instruments can contribute to ensuring high levels of cybersecurity , while taking full account of the specificities and complexities of those sectors. where a sector–specific union legal act requires essential or important entities to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats of at least an equivalent effect to the obligations laid down in this directive , those sector-specific provisions , including on supervision and enforcement , should apply. the commission may issue guidelines in relation to the implementation of the lex specialis. this directive does not preclude the adoption of additional sector-specific union acts addressing cybersecurity risk management measures and incident notifications. this directive is without prejudice to the existing implementing powers that have been conferred to the commission in a number of sectors , including transport and energy. ### (12) sector-specific legislation and instruments can contribute to ensuring high levels of cybersecurity , while taking full account of the specificities and complexities of those sectors. where a sector–specific union legal act requires essential or important entities to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats of at least an equivalent effect to the obligations laid down in this directive , those sector-specific provisions , including on supervision and enforcement , should apply. in order to reduce unnecessary administrative burden , sector-specific legislation and instruments should , whenever possible , align their notification procedures with those present in this directive , according to the once-only principle. the commission may issue guidelines in relation to the implementation of the lex specialis. this directive does not preclude the adoption of additional sector-specific union acts addressing cybersecurity risk management measures and incident notifications. this directive is without prejudice to the existing implementing powers that have been conferred to the commission in a number of sectors , including transport and energy.


### (12) sector-specific legislation and instruments can contribute to ensuring high levels of cybersecurity , while taking full account of the specificities and complexities of those sectors. where a sector–specific union legal act requires essential or important entities to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats of at least an equivalent effect to the obligations laid down in this directive , those sector-specific provisions , including on supervision and enforcement , should apply. the commission may issue guidelines in relation to the implementation of the lex specialis. this directive does not preclude the adoption of additional sector-specific union acts addressing cybersecurity risk management measures and incident notifications. this directive is without prejudice to the existing implementing powers that have been conferred to the commission in a number of sectors , including transport and energy. ### (12) sector-specific legislation and instruments can contribute to ensuring high levels of cybersecurity , while taking full account of the specificities and complexities of those sectors. sector-specific legislation and instruments that require essential or important entities to adopt cybersecurity risk management measures , or impose reporting obligations for significant incidents , shall , where possible , be consistent with the terminology , and refer to the definitions in article 4 of this directive. where a sector–specific union legal act requires essential or important entities to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats of at least an equivalent effect to the obligations laid down in this directive , and apply to the entirety of the security aspects of the operations and services provided by essential and important entities , those sector-specific provisions , including on supervision and enforcement , should apply. the commission may issue guidelines in relation to the implementation of the lex specialis. this directive does not preclude the adoption of additional sector-specific union acts addressing cybersecurity risk management measures and incident notifications. this directive is without prejudice to the existing implementing powers that have been conferred to the commission in a number of sectors , including transport and energy.


### (12) sector-specific legislation and instruments can contribute to ensuring high levels of cybersecurity , while taking full account of the specificities and complexities of those sectors. where a sector–specific union legal act requires essential or important entities to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats of at least an equivalent effect to the obligations laid down in this directive , those sector-specific provisions , including on supervision and enforcement , should apply. the commission may issue guidelines in relation to the implementation of the lex specialis. this directive does not preclude the adoption of additional sector-specific union acts addressing cybersecurity risk management measures and incident notifications. this directive is without prejudice to the existing implementing powers that have been conferred to the commission in a number of sectors , including transport and energy. ### (12) sector-specific legislation and instruments can contribute to ensuring high levels of cybersecurity , while taking full account of the specificities and complexities of those sectors. where a sector–specific union legal act requires essential or important entities to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats of at least an equivalent effect to the obligations laid down in this directive , and where the requirements are neither conflicting nor overlapping , those sector-specific provisions , including on supervision and enforcement , should apply. the commission shall issue comprehensive guidelines in relation to the implementation of each sector specific legislation , including on how it impacts the application of the directive. this directive is without prejudice to the existing implementing powers that have been conferred to the commission in a number of sectors , including transport and energy.


### (14) in view of the interlinkages between cybersecurity and the physical security of entities , a coherent approach should be ensured between directive (eu) xxx/xxx of the european parliament and of the council17 and this directive. to achieve this , member states should ensure that critical entities , and equivalent entities , pursuant to directive (eu) xxx/xxx are considered to be essential entities under this directive. member states should also ensure that their cybersecurity strategies provide for a policy framework for enhanced coordination between the competent authority under this directive and the one under directive (eu) xxx/xxx in the context of information sharing on incidents and cyber threats and the exercise of supervisory tasks. authorities under both directives should cooperate and exchange information , particularly in relation to the identification of critical entities , cyber threats , cybersecurity risks , incidents affecting critical entities as well as on the cybersecurity measures taken by critical entities. upon request of competent authorities under directive (eu) xxx/xxx , competent authorities under this directive should be allowed to exercise their supervisory and enforcement powers on an essential entity identified as critical. both authorities should cooperate and exchange information for this purpose. ### (14) in view of the interlinkages between cybersecurity and the physical security of entities , a coherent approach should be ensured between directive (eu) xxx/xxx of the european parliament and of the council17 and this directive. to achieve this , member states should ensure that critical entities , and equivalent entities , pursuant to directive (eu) xxx/xxx are considered to be essential entities under this directive. member states should also ensure that their national cybersecurity strategies provide for a policy framework for enhanced coordination between the competent authority under this directive and the one under directive (eu) xxx/xxx in the context of incident reporting , information sharing on incidents and cyber threats and the exercise of supervisory tasks. authorities under both directives should cooperate and exchange information , particularly in relation to the identification of critical entities , cyber threats , cybersecurity risks , incidents affecting critical entities as well as on the cybersecurity measures taken by critical entities. upon request of competent authorities under directive (eu) xxx/xxx , competent authorities under this directive should be allowed to exercise their supervisory and enforcement powers on an essential entity identified as critical. both authorities should cooperate and exchange information for this purpose.


### (15) upholding and preserving a reliable , resilient and secure domain name system (dns) is a key factor in maintaining the integrity of the internet and is essential for its continuous and stable operation , on which the digital economy and society depend. therefore , this directive should apply to all providers of dns services along the dns resolution chain , including operators of root name servers , top-level-domain (tld) name servers , authoritative name servers for domain names and recursive resolvers. ### (15) upholding and preserving a reliable , resilient and secure domain name system (dns) is a key factor in maintaining the integrity of the internet and is essential for its continuous and stable operation , on which the digital economy , the internal market and society depend. therefore , this directive should apply to all providers of dns services along the dns resolution chain , including operators of root name servers , top-level-domain (tld) name servers , authoritative name servers for domain names and recursive resolvers.


### (15) upholding and preserving a reliable , resilient and secure domain name system (dns) is a key factor in maintaining the integrity of the internet and is essential for its continuous and stable operation , on which the digital economy and society depend. therefore , this directive should apply to all providers of dns services along the dns resolution chain , including operators of root name servers , top-level-domain (tld) name servers , authoritative name servers for domain names and recursive resolvers. ### (15) upholding and preserving a reliable , resilient and secure domain name system (dns) is a key factor in maintaining the integrity of the internet and is essential for its continuous and stable operation , on which the digital economy and society depend. therefore , this directive should apply to top-level-domain (tld) name servers , public and open recursive domain name resolution services , and authoritative domain name resolution services. this directive should not apply to decentralised services for which centralised administration does not exist , such as the root name servers.


### (20) those growing interdependencies are the result of an increasingly cross-border and interdependent network of service provision using key infrastructures across the union in the sectors of energy , transport , digital infrastructure , drinking and waste water , health , certain aspects of public administration , as well as space in as far as the provision of certain services depending on ground-based infrastructures that are owned , managed and operated either by member states or by private parties is concerned , therefore not covering infrastructures owned , managed or operated by or on behalf of the union as part of its space programmes. those interdependencies mean that any disruption , even one initially confined to one entity or one sector , can have cascading effects more broadly , potentially resulting in far-reaching and long-lasting negative impacts in the delivery of services across the internal market. the covid-19 pandemic has shown the vulnerability of our increasingly interdependent societies in the face of low-probability risks. ### (20) those growing interdependencies are the result of an increasingly cross-border and interdependent network of service provision using key infrastructures across the union in the sectors of energy , transport , digital infrastructure , drinking and waste water , health , certain aspects of public administration , as well as space in as far as the provision of certain services depending on ground-based infrastructures that are owned , managed and operated either by member states or by private parties is concerned , therefore not covering infrastructures owned , managed or operated by or on behalf of the union as part of its space programmes. those interdependencies mean that any disruption , even one initially confined to one entity or one sector , can have cascading effects more broadly , potentially resulting in far-reaching and long-lasting negative impacts in the delivery of services across the internal market. the covid-19 pandemic has shown the vulnerability of our increasingly interdependent societies in the face of low-probability risks and the need to protect the internal market through joint strategies and actions at union level.


### (20) those growing interdependencies are the result of an increasingly cross-border and interdependent network of service provision using key infrastructures across the union in the sectors of energy , transport , digital infrastructure , drinking and waste water , health , certain aspects of public administration , as well as space in as far as the provision of certain services depending on ground-based infrastructures that are owned , managed and operated either by member states or by private parties is concerned , therefore not covering infrastructures owned , managed or operated by or on behalf of the union as part of its space programmes. those interdependencies mean that any disruption , even one initially confined to one entity or one sector , can have cascading effects more broadly , potentially resulting in far-reaching and long-lasting negative impacts in the delivery of services across the internal market. the covid-19 pandemic has shown the vulnerability of our increasingly interdependent societies in the face of low-probability risks. ### (20) those growing interdependencies are the result of an increasingly cross-border and interdependent network of service provision using key infrastructures across the union in the sectors of energy , transport , digital infrastructure , drinking and waste water , health , certain aspects of public administration , as well as space in as far as the provision of certain services depending on ground-based infrastructures that are owned , managed and operated either by member states or by private parties is concerned , therefore not covering infrastructures owned , managed or operated by or on behalf of the union as part of its space programmes. those interdependencies mean that any disruption , even one initially confined to one entity or one sector , can have cascading effects more broadly , potentially resulting in far-reaching and long-lasting negative impacts in the delivery of services across the internal market. the covid-19 pandemic has shown the vulnerability of our increasingly interdependent societies in the face of low-probability risks. cybersecurity must be one of the eu priorities in responding to the covid-19 pandemic , during which cyber attacks have intensified , which will have to lead to further investment in this field.


### (23) competent authorities or the csirts should receive notifications of incidents from entities in an effective and efficient way. the single points of contact should be tasked with forwarding incident notifications to the single points of contact of other affected member states. at the level of member states’ authorities , to ensure one single entry point in every member states , the single points of contacts should also be the addressees of relevant information on incidents concerning financial sector entities from the competent authorities under regulation xxxx/xxxx which they should be able to forward , as appropriate , to the relevant national competent authorities or csirts under this directive. ### (23) competent authorities or the csirts should receive notifications of incidents from entities in a standardised , effective and efficient way. the single points of contact should be tasked with forwarding incident notifications to the single points of contact of other affected member states. at the level of member states’ authorities , to ensure one single entry point in every member states , the single points of contacts should also be the addressees of relevant information on incidents concerning financial sector entities from the competent authorities under regulation xxxx/xxxx which they should be able to forward , as appropriate , to the relevant national competent authorities or csirts under this directive.


### (25) as regards personal data , csirts should be able to provide , in accordance with regulation (eu) 2016/679 of the european parliament and of the council19 as regards personal data , on behalf of and upon request by an entity under this directive , a proactive scanning of the network and information systems used for the provision of their services. member states should aim at ensuring an equal level of technical capabilities for all sectorial csirts. member states may request the assistance of the european union agency for cybersecurity (enisa) in developing national csirts. ### (25) as regards personal data , csirts should be able to provide , in accordance with regulation (eu) 2016/679 of the european parliament and of the council19 as regards personal data , on behalf of and upon request by an entity under this directive , a proactive scanning of the network and information systems used for the provision of their services. member states should aim at ensuring an equal level of technical capabilities for all sectorial csirts. member states may request the assistance of the european union agency for cybersecurity (enisa) in developing national csirts. also , cybersecurity risks should never be used as a pretext for breaching human rights.


### (27) in accordance with the annex to commission recommendation (eu) 2017/1548 on coordinated response to large scale cybersecurity incidents and crises (‘blueprint’)20 , a large-scale incident should mean an incident with a significant impact on at least two member states or whose disruption exceeds a member state’s capacity to respond to it. depending on their cause and impact , large-scale incidents may escalate and turn into fully-fledged crises not allowing the proper functioning of the internal market. given the wide-ranging scope and , in most cases , the cross-border nature of such incidents , member states and relevant union institutions , bodies and agencies should cooperate at technical , operational and political level to properly coordinate the response across the union. ### (27) in accordance with the annex to commission recommendation (eu) 2017/1548 on coordinated response to large scale cybersecurity incidents and crises (‘blueprint’)20 , a large-scale incident should mean an incident with a significant impact on at least two member states or whose disruption exceeds a member state’s capacity to respond to it , thus endangering the internal market. depending on their cause and impact , large-scale incidents may escalate and turn into fully-fledged crises not allowing the proper functioning of the internal market. given the wide-ranging scope and , in most cases , the cross-border nature of such incidents , member states and relevant union institutions , bodies and agencies should cooperate at technical , operational and political level to properly coordinate the response across the union.


### (27) in accordance with the annex to commission recommendation (eu) 2017/1548 on coordinated response to large scale cybersecurity incidents and crises (‘blueprint’)20 , a large-scale incident should mean an incident with a significant impact on at least two member states or whose disruption exceeds a member state’s capacity to respond to it. depending on their cause and impact , large-scale incidents may escalate and turn into fully-fledged crises not allowing the proper functioning of the internal market. given the wide-ranging scope and , in most cases , the cross-border nature of such incidents , member states and relevant union institutions , bodies and agencies should cooperate at technical , operational and political level to properly coordinate the response across the union. ### (27) in accordance with the annex to commission recommendation (eu) 2017/1548 on coordinated response to large scale cybersecurity incidents and crises (‘blueprint’)20 , a large-scale incident should mean an incident with a significant impact on at least two member states or whose disruption exceeds a member state’s capacity to respond to it. depending on their cause and impact , large-scale incidents may escalate and turn into fully-fledged crises not allowing the proper functioning of the internal market. given the wide-ranging scope and , in most cases , the cross-border nature of such incidents , member states and relevant union institutions , bodies and agencies should cooperate at technical , operational and political level to properly coordinate the response across the union. cybersecurity is indispensable for network and global internet connectivity , therefore improving cybersecurity is essential for eu citizens to be able to trust innovation and connectivity , given the expansion of online activities in the context of the covid-19 pandemic.


### (28) since the exploitation of vulnerabilities in network and information systems may cause significant disruption and harm , swiftly identifying and remedying those vulnerabilities is an important factor in reducing cybersecurity risk. entities that develop such systems should therefore establish appropriate procedures to handle vulnerabilities when they are discovered. since vulnerabilities are often discovered and reported (disclosed) by third parties (reporting entities) , the manufacturer or provider of ict products or services should also put in place the necessary procedures to receive vulnerability information from third parties. in this regard , international standards iso/iec 30111 and iso/iec 29417 provide guidance on vulnerability handling and vulnerability disclosure respectively. as regards vulnerability disclosure , coordination between reporting entities and manufacturers or providers of ict products or services is particularly important. coordinated vulnerability disclosure specifies a structured process through which vulnerabilities are reported to organisations in a manner allowing the organisation to diagnose and remedy the vulnerability before detailed vulnerability information is disclosed to third parties or to the public. coordinated vulnerability disclosure should also comprise coordination between the reporting entity and the organisation as regards the timing of remediation and publication of vulnerabilities. ### (28) since the exploitation of vulnerabilities in network and information systems may cause significant disruption and harm to businesses and consumers , swiftly identifying and remedying those vulnerabilities is an important factor in reducing cybersecurity risk. entities that develop such systems should therefore establish appropriate procedures to handle vulnerabilities when they are discovered. since vulnerabilities are often discovered and reported (disclosed) by third parties (reporting entities) , the manufacturer or provider of ict products or services should also put in place the necessary procedures to receive vulnerability information from third parties. in this regard , international standards iso/iec 30111 and iso/iec 29417 provide guidance on vulnerability handling and vulnerability disclosure respectively. as regards vulnerability disclosure , coordination between reporting entities and manufacturers or providers of ict products or services is particularly important. coordinated vulnerability disclosure specifies a structured process through which vulnerabilities are reported to organisations in a manner allowing the organisation to diagnose and remedy the vulnerability before detailed vulnerability information is disclosed to third parties or to the public. coordinated vulnerability disclosure should also comprise coordination between the reporting entity and the organisation as regards the timing of remediation and publication of vulnerabilities.


### (28) since the exploitation of vulnerabilities in network and information systems may cause significant disruption and harm , swiftly identifying and remedying those vulnerabilities is an important factor in reducing cybersecurity risk. entities that develop such systems should therefore establish appropriate procedures to handle vulnerabilities when they are discovered. since vulnerabilities are often discovered and reported (disclosed) by third parties (reporting entities) , the manufacturer or provider of ict products or services should also put in place the necessary procedures to receive vulnerability information from third parties. in this regard , international standards iso/iec 30111 and iso/iec 29417 provide guidance on vulnerability handling and vulnerability disclosure respectively. as regards vulnerability disclosure , coordination between reporting entities and manufacturers or providers of ict products or services is particularly important. coordinated vulnerability disclosure specifies a structured process through which vulnerabilities are reported to organisations in a manner allowing the organisation to diagnose and remedy the vulnerability before detailed vulnerability information is disclosed to third parties or to the public. coordinated vulnerability disclosure should also comprise coordination between the reporting entity and the organisation as regards the timing of remediation and publication of vulnerabilities. ### (28) since the exploitation of vulnerabilities in network and information systems may cause significant disruption and harm , swiftly identifying and remedying those vulnerabilities is an important factor in reducing cybersecurity risk. entities that develop such systems should therefore establish appropriate procedures to handle vulnerabilities when they are discovered. since vulnerabilities are often discovered and reported (disclosed) by third parties (reporting entities) , the manufacturer or provider of ict products or services should also put in place the necessary procedures to receive vulnerability information from third parties. in this regard , international standards iso/iec 30111 and iso/iec 29417 provide guidance on vulnerability handling and vulnerability disclosure respectively. as regards vulnerability disclosure , coordination between reporting entities and manufacturers or providers of ict products or services is particularly important. voluntary coordinated vulnerability disclosure specifies a structured process through which vulnerabilities are reported to organisations in a manner allowing the organisation to diagnose and remedy the vulnerability before detailed vulnerability information is disclosed to third parties or to the public. coordinated vulnerability disclosure should also comprise coordination between the reporting entity and the organisation as regards the timing of remediation and publication of vulnerabilities. strengthening the coordination and timely exchange of relevant information between the manufacturer or provider of ict products or services and the reporting entities is essential to facilitate the voluntary framework of vulnerability disclosure.


### (30) access to correct and timely information on vulnerabilities affecting ict products and services contributes to an enhanced cybersecurity risk management. in that regard , sources of publicly available information on vulnerabilities are an important tool for entities and their users , but also national competent authorities and csirts. for this reason , enisa should establish a vulnerability registry where , essential and important entities and their suppliers , as well as entities which do not fall in the scope of application of this directive may , on a voluntary basis , disclose vulnerabilities and provide the vulnerability information that allows users to take appropriate mitigating measures. ### (30) access to correct and timely information on vulnerabilities affecting ict products and services contributes to an enhanced cybersecurity risk management. in that regard , sources of publicly available information on vulnerabilities are an important tool for entities and their users , but also national competent authorities and csirts. for this reason , enisa should establish a vulnerability registry where , essential and important entities and their suppliers , as well as entities which do not fall in the scope of application of this directive may , on a voluntary basis , disclose vulnerabilities and provide the vulnerability information that allows users to take appropriate mitigating measures. member states should support each other in the event of any cross-border problems , establish a more structured dialogue with the private sector and cooperate on security risks and the threats associated with new technologies , as was the case with 5g technology.


### (31) although similar vulnerability registries or databases do exist , these are hosted and maintained by entities which are not established in the union. a european vulnerability registry maintained by enisa would provide improved transparency regarding the publication process before the vulnerability is officially disclosed , and resilience in cases of disruptions or interruptions on the provision of similar services. to avoid duplication of efforts and seek complementarity to the extent possible , enisa should explore the possibility of entering into structured cooperation agreements with similar registries in third country jurisdictions. ### (31) although similar vulnerability registries or databases do exist , these are hosted and maintained by entities which are not established in the union. a european vulnerability registry maintained by enisa would provide improved transparency regarding the publication process before the vulnerability is officially disclosed , and resilience in cases of disruptions or interruptions on the provision of similar services. to avoid duplication of efforts and seek complementarity to the extent possible , enisa should explore the possibility of entering into structured cooperation agreements with similar registries in third country jurisdictions. enisa could play a more central management role either by exploring the option of becoming a “root cve numbering authority” in the global common vulnerabilities and exposures (cve) registry , or setting up a database to leverage the existing cve programme for vulnerability identification and registration to enable interoperability and reference between the european and third country jurisdiction registries.


### (34) the cooperation group should remain a flexible forum and be able to react to changing and new policy priorities and challenges while taking into account the availability of resources. it should organize regular joint meetings with relevant private stakeholders from across the union to discuss activities carried out by the group and gather input on emerging policy challenges. in order to enhance cooperation at union level , the group should consider inviting union bodies and agencies involved in cybersecurity policy , such as the european cybercrime centre (ec3) , the european union aviation safety agency (easa) and the european union agency for space programme (euspa) to participate in its work. ### (34) the cooperation group should remain a flexible forum and be able to react to changing and new policy priorities and challenges while taking into account the availability of resources. it should organize regular joint meetings with relevant private stakeholders from across the union to discuss activities carried out by the group and gather input on emerging policy challenges. in order to enhance cooperation at union level , the group should consider inviting union bodies and agencies involved in cybersecurity policy , such as the european cybercrime centre (ec3) , the european union aviation safety agency (easa) and the european union agency for space programme (euspa) to participate in its work , as well as other union bodies and agencies and supervisory authorities related to the digital single market.


### (34) the cooperation group should remain a flexible forum and be able to react to changing and new policy priorities and challenges while taking into account the availability of resources. it should organize regular joint meetings with relevant private stakeholders from across the union to discuss activities carried out by the group and gather input on emerging policy challenges. in order to enhance cooperation at union level , the group should consider inviting union bodies and agencies involved in cybersecurity policy , such as the european cybercrime centre (ec3) , the european union aviation safety agency (easa) and the european union agency for space programme (euspa) to participate in its work. ### (34) the cooperation group should remain a flexible forum and be able to react to changing and new policy priorities and challenges while taking into account the availability of resources. it should organize regular joint meetings with relevant private stakeholders to discuss activities carried out by the group and gather input on emerging policy challenges. in order to enhance cooperation at union level , the group should consider inviting , where relevant , union bodies and agencies involved in cybersecurity policy , such as the european cybercrime centre (ec3) , the european union aviation safety agency (easa) , the european union agency for space programme (euspa) , the european defence agency (eda) , the european data protection supervisor (edps) ,the european union agency for law enforcement training (cepol) , the european institute of innovation and technology (eit) , the european union agency for the operational management of large-scale it systems in the area of freedom , security and justice (eu-lisa) , the european securities and markets authority(esma) , the european banking authority (eba) , the european foundation for the improvement of living and working conditions (eurofound) and the european insurance and occupational pensions authority (eiopa) to participate in its work.


### (35) the competent authorities and csirts should be empowered to participate in exchange schemes for officials from other member states in order to improve cooperation. the competent authorities should take the necessary measures to enable officials from other member states to play an effective role in the activities of the host competent authority. ### (35) the competent authorities and csirts should be empowered to participate in exchange schemes for officials from other member states in order to improve cooperation and strengthen confidence inside the networks. the competent authorities should take the necessary measures to enable officials from other member states to play an effective role in the activities of the host competent authority or csirt.


### (35) the competent authorities and csirts should be empowered to participate in exchange schemes for officials from other member states in order to improve cooperation. the competent authorities should take the necessary measures to enable officials from other member states to play an effective role in the activities of the host competent authority. ### (35) the competent authorities and csirts should be empowered to participate in exchange schemes for officials from other member states , within structured rules and mechanisms underpinning the scope and , where applicable , the required security clearance of officials participating in such exchange schemes , in order to improve cooperation. the competent authorities should take the necessary measures to enable officials from other member states to play an effective role in the activities of the host competent authority or csirt.


### (44) among service providers , managed security services providers (mssps) in areas such as incident response , penetration testing , security audits and consultancy play a particularly important role in assisting entities in their efforts to detect and respond to incidents. those mssps have however also been the targets of cyberattacks themselves and through their close integration in the operations of operators pose a particular cybersecurity risk. entities should therefore exercise increased diligence in selecting an mssp. ### (44) among service providers , managed security services providers (mssps) in areas such as incident response , penetration testing , security audits and consultancy play a particularly important role in assisting entities in their efforts to prevent , detect and respond to incidents. those mssps have however also been the targets of cyberattacks themselves and through their close integration in the operations of operators pose a particular cybersecurity risk. entities should therefore exercise increased diligence in selecting an mssp , not only in terms of the close operational integration but also as regards the need for such outsourced activities involving personal data by a controller to be in full compliance with regulation (eu) 2016/679 , in particular the processing by a processor on behalf of a controller.


### (46) to further address key supply chain risks and assist entities operating in sectors covered by this directive to appropriately manage supply chain and supplier related cybersecurity risks , the cooperation group involving relevant national authorities , in cooperation with the commission and enisa , should carry out coordinated sectoral supply chain risk assessments , as was already done for 5g networks following recommendation (eu) 2019/534 on cybersecurity of 5g networks21 , with the aim of identifying per sector which are the critical ict services , systems or products , relevant threats and vulnerabilities. ### (46) to further address key supply chain risks and assist entities operating in sectors covered by this directive to appropriately manage supply chain and supplier related cybersecurity risks , the cooperation group involving relevant national authorities , in cooperation with the commission and enisa , and in consultation with the european data protection board (edpb) , should carry out coordinated sectoral supply chain risk assessments , as was already done for 5g networks following recommendation (eu) 2019/534 on cybersecurity of 5g networks21 , with the aim of identifying per sector which are the critical ict services , systems or products , relevant threats and vulnerabilities. particular emphasis should be placed on ict services , systems or products subject to specific requirements , in particular in third country jurisdictions serving as the country of origin.


### (47) the supply chain risk assessments , in light of the features of the sector concerned , should take into account both technical and , where relevant , non-technical factors including those defined in recommendation (eu) 2019/534 , in the eu wide coordinated risk assessment of 5g networks security and in the eu toolbox on 5g cybersecurity agreed by the cooperation group. to identify the supply chains that should be subject to a coordinated risk assessment , the following criteria should be taken into account: (i) the extent to which essential and important entities use and rely on specific critical ict services , systems or products; (ii) the relevance of specific critical ict services , systems or products for performing critical or sensitive functions , including the processing of personal data; (iii) the availability of alternative ict services , systems or products; (iv) the resilience of the overall supply chain of ict services , systems or products against disruptive events and (v) for emerging ict services , systems or products , their potential future significance for the entities’ activities. ### (47) the supply chain risk assessments , in light of the features of the sector concerned , should take into account both technical and , where relevant , non-technical factors including those defined in recommendation (eu) 2019/534 , in the eu wide coordinated risk assessment of 5g networks security and in the eu toolbox on 5g cybersecurity agreed by the cooperation group. to identify the supply chains that should be subject to a coordinated risk assessment , the following criteria should be taken into account: (i) the extent to which essential and important entities use and rely on specific critical ict services , systems or products; (ii) the relevance of specific critical ict services , systems or products for performing critical or sensitive functions , including the processing of personal data; (iii) the availability of alternative ict services , systems or products; (iv) the resilience of the overall supply chain of ict services , systems or products against disruptive events across the entire lifecycle of the service , system or product and (v) for emerging ict services , systems or products , their potential future significance for the entities’ activities. such risk assessments should identify best practices for managing risks associated with risks in the ict supply chain and explore ways to further incentivise their wider adoption by entities within each sector under examination.


### (51) the internal market is more reliant on the functioning of the internet than ever before. the services of virtually all essential and important entities are dependent on services provided over the internet. in order to ensure the smooth provision of services provided by essential and important entities , it is important that public electronic communications networks , such as , for example , internet backbones or submarine communications cables , have appropriate cybersecurity measures in place and report incidents in relation thereto. ### (51) the internal market is more reliant on the functioning of the internet than ever before. the services of virtually all essential and important entities are dependent on services provided over the internet , and consumers rely on it for essential parts of their daily lives. in order to ensure the smooth provision of services provided by essential and important entities , it is important that public electronic communications networks , such as , for example , internet backbones or submarine communications cables , have appropriate cybersecurity measures in place and report incidents in relation thereto.


### (52) where appropriate , entities should inform their service recipients of particular and significant threats and of measures they can take to mitigate the resulting risk to themselves. the requirement to inform those recipients of such threats should not discharge entities from the obligation to take , at their own expense , appropriate and immediate measures to prevent or remedy any cyber threats and restore the normal security level of the service. the provision of such information about security threats to the recipients should be free of charge. ### (52) entities should inform their service recipients of particular and significant threats and of measures they can take to mitigate the resulting risk to themselves , in particular when such measures may increase consumer protection. the requirement to inform those recipients of such threats should not discharge entities from the obligation to take , at their own expense , appropriate and immediate measures to prevent or remedy any cyber threats and restore the normal security level of the service. the provision of such information about security threats to the recipients should be free of charge and in language easy to understand and to follow.


### (54) in order to safeguard the security of electronic communications networks and services , the use of encryption , and in particular end-to-end encryption , should be promoted and , where necessary , should be mandatory for providers of such services and networks in accordance with the principles of security and privacy by default and by design for the purposes of article 18. the use of end-to-end encryption should be reconciled with the member state’ powers to ensure the protection of their essential security interests and public security , and to permit the investigation , detection and prosecution of criminal offences in compliance with union law. solutions for lawful access to information in end-to-end encrypted communications should maintain the effectiveness of encryption in protecting privacy and security of communications , while providing an effective response to crime. ### (54) in order to safeguard the security of electronic communications networks and services , the use of encryption , and in particular end-to-end encryption , should be promoted and , where necessary , should be mandatory for providers of such services and networks in accordance with the principles of security and privacy by default and by design for the purposes of article 18. the use of end-to-end encryption should be reconciled with the member state’ powers to ensure the protection of their essential security interests and public security , and to permit the investigation , detection and prosecution of criminal offences in compliance with union law. the effectiveness of encryption in protecting privacy and security of communications must not be undermined in any circumstance , as any loophole in encryption is open to be explored by all actors , regardless of their legitimacy or intent.


### (54) in order to safeguard the security of electronic communications networks and services , the use of encryption , and in particular end-to-end encryption , should be promoted and , where necessary , should be mandatory for providers of such services and networks in accordance with the principles of security and privacy by default and by design for the purposes of article 18. the use of end-to-end encryption should be reconciled with the member state’ powers to ensure the protection of their essential security interests and public security , and to permit the investigation , detection and prosecution of criminal offences in compliance with union law. solutions for lawful access to information in end-to-end encrypted communications should maintain the effectiveness of encryption in protecting privacy and security of communications , while providing an effective response to crime. ### (54) in order to safeguard the security of electronic communications networks and services , the use of encryption , and in particular end-to-end encryption , should be promoted and , where necessary , should be mandatory for providers of such services and networks in accordance with the principles of security and privacy by default and by design for the purposes of article 18. the use of end-to-end encryption should be reconciled with the member state’ powers to ensure the protection of their essential security interests and public security , and to permit the investigation , detection and prosecution of criminal offences in compliance with union law. the effectiveness of encryption in protecting the privacy and security of communications must not be undermined in any circumstance , as any loophole in encryption is open to be explored or exploited by actors , regardless of their legitimacy or intent.


### (55) this directive lays down a two-stage approach to incident reporting in order to strike the right balance between , on the one hand , swift reporting that helps mitigate the potential spread of incidents and allows entities to seek support , and , on the other hand , in-depth reporting that draws valuable lessons from individual incidents and improves over time the resilience to cyber threats of individual companies and entire sectors. where entities become aware of an incident , they should be required to submit an initial notification within 24 hours , followed by a final report not later than one month after. the initial notification should only include the information strictly necessary to make the competent authorities aware of the incident and allow the entity to seek assistance , if required. such notification , where applicable , should indicate whether the incident is presumably caused by unlawful or malicious action. member states should ensure that the requirement to submit this initial notification does not divert the reporting entity’s resources from activities related to incident handling that should be prioritised. to further prevent that incident reporting obligations either divert resources from incident response handling or may otherwise compromise the entities efforts in that respect , member states should also provide that , in duly justified cases and in agreement with the competent authorities or the csirt , the entity concerned can deviate from the deadlines of 24 hours for the initial notification and one month for the final report. ### (55) this directive lays down a three-stage approach to incident reporting in order to strike the right balance between , on the one hand , swift reporting that helps mitigate the potential spread of incidents and allows entities to seek support , and , on the other hand , in-depth reporting that draws valuable lessons from individual incidents and improves over time the resilience to cyber threats of individual companies and entire sectors. in this regard , this directive should also include reporting of incidents that , based on an initial assessment performed by the entity , could be assumed to lead to substantial operational disruption or financial losses or affect other natural or legal persons by causing considerable material or non-material losses. the initial assessment should take into account , amongst other , the affected network and information systems and in particular their importance in the provision of the entity’s services , the severity and technical characteristics of the cyber threat , and any underlying vulnerabilities that are being exploited as well as the entity’s experience with similar incidents.