### (37) the establishment of a solid governance structure within the authority is essential for ensuring effective exercise of the tasks granted to the authority , and for an efficient and objective decision-making process. due to the complexity and variety of the tasks conferred on the authority in both the supervision and fiu areas , the decisions cannot be taken by a single governing body , as is often the case in decentralised agencies. whereas certain types of decisions , such as decisions on adoption of common instruments , need to be taken by representatives of appropriate authorities or fius , and respect voting rules of the tfeu , certain other decisions , such as the decisions towards individual selected obliged entities , or individual authorities , require a smaller decision-making body , whose members should be subject to appropriate accountability arrangements. therefore , the authority should comprise a general board , and an executive board composed of five full-time independent members and of the chair of the authority. ### (37) the establishment of a solid governance structure within the authority is essential for ensuring effective exercise of the tasks granted to the authority , and for an efficient and objective decision-making process. due to the complexity and variety of the tasks conferred on the authority in both the supervision and fiu areas , the decisions cannot be taken by a single governing body , as is often the case in decentralised agencies. whereas certain types of decisions , such as decisions on adoption of common instruments , need to be taken by representatives of appropriate authorities or fius , and respect voting rules of the tfeu , certain other decisions , such as the decisions towards individual selected obliged entities , or individual authorities , require a smaller decision-making body , whose members should be subject to appropriate accountability arrangements. therefore , the authority should comprise a general board , and an executive board composed of seven full-time independent members and of the chair of the authority.


### 2. the persons referred to in paragraph 1 or their representatives and , in the case of legal persons or associations having no legal personality , the persons authorised to represent them by law or by their constitution , shall supply the information requested. lawyers duly authorised to act may supply the information on behalf of their clients. the latter shall remain fully responsible if the information supplied is incomplete , incorrect or misleading. ### 2. the persons referred to in paragraph 1 or their representatives and , in the case of legal persons or associations having no legal personality , the persons authorised to represent them by law or by their constitution , shall supply the information requested in a timely manner. lawyers duly authorised to act may supply the information on behalf of their clients. the latter shall remain fully responsible if the information supplied is incomplete , incorrect or misleading.


### 4. the general board may decide to admit observers. in particular , the general board in fiu composition shall admit as an observer a representative of olaf , europol , eurojust and the eppo to meetings when matters fall under their respective mandates. the general board in supervisory composition shall admit a representative nominated by the supervisory board of the european central bank and a representative of each of the european supervisory authorities , where matters within the scope of their respective mandates are discussed. ### 4. the general board may decide to admit observers. in particular , the general board in fiu composition shall admit as an observer a representative of olaf , europol , eurojust and the eppo to meetings when matters fall under their respective mandates. the general board in supervisory composition shall admit a representative of the european central bank and a representative of each of the european supervisory authorities , where matters within the scope of their respective mandates are discussed.


### 7. without prejudice to articles 52 (3) and (4) and article 56 (1) and (2) , the appointing authority powers over the chair and the five permanent members of the executive board throughout their mandate shall be exercised by the general board. ### 7. without prejudice to articles 52 (3) and (4) and article 56 (1) and (2) , the appointing authority powers over the chair and the seven permanent members of the executive board throughout their mandate shall be exercised by the general board.


### 6. the chair of the authority and the permanent five members of the executive board shall not attend those meetings of the general board where matters concerning the performance of their mandate are discussed or decided upon. ### 6. the chair of the authority and the permanent seven members of the executive board shall not attend those meetings of the general board where matters concerning the performance of their mandate are discussed or decided upon.


### five full-time members; ### seven full-time members;


### 3. the five members of the executive board referred to in paragraph 1 , point (b) , shall be selected following an open selection procedure which shall be published in the official journal of the european union. they shall be appointed by the general board based on the shortlist drawn by the commission. the selection shall respect the principles of experience , qualification , and , to the extent possible , gender and geographical balance. ### 3. the seven members of the executive board referred to in paragraph 1 , point (b) , shall be selected following an open selection procedure which shall be published in the official journal of the european union. they shall be appointed by the general board based on the shortlist drawn by the commission. the selection shall respect the principles of experience , qualification , and , to the extent possible , gender and geographical balance.


### 4. the term of office of the five members of the executive board shall be four years. in the course of the 12 months preceding the end of the four-year term of office of the chair of the authority and five members of the executive board , the general board in both compositions or a smaller committee selected among general board members including a commission representative shall carry out an assessment of performance of the executive board. the assessment shall take into account an evaluation of the executive board members’ performance and the authority’s future tasks and challenges. based on the assessment , the general board in both compositions may extend their term of office once. ### 4. the term of office of the seven members of the executive board shall be four years. in the course of the 12 months preceding the end of the four-year term of office of the chair of the authority and five members of the executive board , the general board in both compositions or a smaller committee selected among general board members including a commission representative shall carry out an assessment of performance of the executive board. the assessment shall take into account an evaluation of the executive board members’ performance and the authority’s future tasks and challenges. based on the assessment , the general board in both compositions may extend their term of office once.


### 2. the chair shall assign to the five members of the executive board specific areas of responsibility within the scope of tasks of the authority for the duration of their mandate. ### 2. the chair shall assign to the seven members of the executive board specific areas of responsibility within the scope of tasks of the authority for the duration of their mandate.


### 2. by way of derogation from paragraph 1 , the chair of the authority , and the five members of the executive board referred to in article 53 shall , respectively , be on a par with a member and the registrar of the general court regarding emoluments and pensionable age , as defined in council regulation (eu) 2016/30053 . for aspects not covered by this regulation or by regulation (eu) 2016/300 , the staff regulations and the conditions of employment shall apply by analogy. ### 2. by way of derogation from paragraph 1 , the chair of the authority , and the seven members of the executive board referred to in article 53 shall , respectively , be on a par with a member and the registrar of the general court regarding emoluments and pensionable age , as defined in council regulation (eu) 2016/30053 . for aspects not covered by this regulation or by regulation (eu) 2016/300 , the staff regulations and the conditions of employment shall apply by analogy.


### 1. in order to carry out the tasks conferred on it by this regulation , the authority may , subject to prior notification to the financial supervisor concerned , conduct all necessary on-site inspections at the business premises of the legal persons referred to in article 16. where the proper conduct and efficiency of the inspection so require , the authority may carry out the on-site inspection without prior announcement to those legal persons. ### 1. in order to carry out the tasks conferred on it by this regulation , the authority may , subject to prior notification to the financial supervisor concerned , conduct all necessary on-site inspections at the business premises of the legal persons referred to in article 16. where the proper conduct and efficiency of the inspection so require , including where the inspection is related to an ongoing investigation carried out under article 17 , the authority may carry out the on-site inspection without prior announcement to those legal persons.


### (11) in may 2011 , the secretaries-general of the union institutions and bodies decided to establish a pre-configuration team for a computer emergency response team for the union’s institutions , bodies and agencies (cert-eu) supervised by an inter-institutional steering board. in july 2012 , the secretaries-general confirmed the practical arrangements and agreed to maintain cert-eu as a permanent entity to continue to help improve the overall level of information technology security of the union’s institutions , bodies and agencies as an example of visible inter-institutional cooperation in cybersecurity. in september 2012 , cert-eu was established as a taskforce of the european commission with an interinstitutional mandate. in december 2017 , the union institutions and bodies concluded an interinstitutional arrangement on the organisation and operation of cert-eu3 . this arrangement should continue to evolve to support the implementation of this regulation. ### (11) in may 2011 , the secretaries-general of the union institutions and bodies decided to establish a pre-configuration team for a computer emergency response team for the union’s institutions , bodies and agencies (cert-eu) supervised by an inter-institutional steering board. in july 2012 , the secretaries-general confirmed the practical arrangements and agreed to maintain cert-eu as a permanent entity to continue to help improve the overall level of information technology security of the union’s institutions , bodies and agencies as an example of visible inter-institutional cooperation in cybersecurity. in september 2012 , cert-eu was established as a taskforce of the european commission with an interinstitutional mandate. in december 2017 , the union institutions and bodies concluded an interinstitutional arrangement on the organisation and operation of cert-eu3 . this arrangement should continue to evolve to support the implementation of this regulation and be evaluated on a regular basis in light of future negotiations of long-term budget frameworks allowing for further decisions to be made with respect to the functioning and institutional role of cert-eu , including the possible establishment of cert-eu as a union office.


### 4. each union institution , body and agency shall have effective mechanisms in place to ensure that an adequate percentage of the it budget is spent on cybersecurity. ### 4. each union institution , body and agency shall have effective mechanisms in place to ensure that an adequate percentage of the ict budget is spent on cybersecurity.


### 2. for the application of administrative and financial procedures , the head of cert-eu shall act under the authority of the commission. ### deleted


### 3. cert-eu tasks and activities , including services provided by cert-eu pursuant to article 12(2) , (3) , (4) , (6) , and article 13(1) to union institutions , bodies and agencies financed from the heading of the multiannual financial framework dedicated to european public administration , shall be funded through a distinct budget line of the commission budget. cert-eu earmarked posts shall be detailed in a footnote to the commission establishment plan. ### 3. cert-eu tasks and activities , including services provided by cert-eu pursuant to article 12(2) , (3) , (4) , (6) , and article 13(1) to union institutions , bodies and agencies financed from the heading of the multiannual financial framework dedicated to european public administration , shall be funded through a distinct budget line of the commission budget. cert-eu earmarked posts shall be detailed in a footnote to the commission establishment plan. the posts that are temporarily assigned shall be kept in the establishment plan of the donor institution during the temporary assignment , signalled with a footnote.


### (2) the cyber threat landscape faced by union institutions , bodies and agencies is in constant evolution. the tactics , techniques and procedures employed by threat actors are constantly evolving , while the prominent motives for such attacks change little , from stealing valuable undisclosed information to making money , manipulating public opinion or undermining digital infrastructure. the pace at which they conduct their cyberattacks keeps increasing , while their campaigns are increasingly sophisticated and automated , targeting exposed attack surfaces that keep expanding and quickly exploiting vulnerabilities. ### (2) the cyber threat landscape faced by union institutions , bodies and agencies is in constant evolution. the tactics , techniques and procedures employed by threat actors are constantly evolving , while the prominent motives for such attacks change little , from stealing valuable undisclosed information to making money , manipulating public opinion or undermining digital infrastructure. the pace at which they conduct their cyberattacks keeps increasing , while their campaigns and methods are increasingly sophisticated and automated , targeting exposed attack surfaces that keep expanding and quickly exploiting vulnerabilities.


### (4) the union institutions , bodies and agencies are attractive targets who face highly skilled and well-resourced threat actors as well as other threats. at the same time , the level and maturity of cyber resilience and the ability to detect and respond to malicious cyber activities varies significantly across those entities. it is thus necessary for the functioning of the european administration that the institutions , bodies and agencies of the union achieve a high common level of cybersecurity through a cybersecurity baseline (a set of minimum cybersecurity rules with which network and information systems and their operators and users have to be compliant to minimise cybersecurity risks) , information exchange and collaboration. ### (4) the union institutions , bodies and agencies are attractive targets who face highly skilled and well-resourced threat actors as well as other threats. at the same time , the level and maturity of cyber resilience and the ability to detect and respond to malicious cyber activities varies significantly across those entities. it is thus necessary for the functioning of the european administration that the institutions , bodies and agencies of the union achieve a high common level of cybersecurity through a cybersecurity baseline (a set of minimum cybersecurity rules with which network and information systems and their operators and users have to be compliant to minimise cybersecurity risks) , information exchange , collaboration , and cybersecurity education.


### (4) the union institutions , bodies and agencies are attractive targets who face highly skilled and well-resourced threat actors as well as other threats. at the same time , the level and maturity of cyber resilience and the ability to detect and respond to malicious cyber activities varies significantly across those entities. it is thus necessary for the functioning of the european administration that the institutions , bodies and agencies of the union achieve a high common level of cybersecurity through a cybersecurity baseline (a set of minimum cybersecurity rules with which network and information systems and their operators and users have to be compliant to minimise cybersecurity risks) , information exchange and collaboration. ### (4) the union institutions , bodies and agencies are attractive targets who face highly skilled and well-resourced threat actors as well as other threats. at the same time , the level and maturity of cyber resilience and the ability to detect and respond to malicious cyber activities varies significantly across those entities. it is thus necessary for the functioning of the european administration that the institutions , bodies and agencies of the union achieve a high common level of cybersecurity through the implementation of cybersecurity risk management measures commensurate to the respective risks posed , information exchange and collaboration.


### this regulation applies to the management , governance and control of cybersecurity risks by all union institutions , bodies and agencies and to the organisation and operation of cert-eu and the interinstitutional cybersecurity board. ### this regulation applies to all union institutions , bodies , offices and agencies and to the functioning , organisation and operation of cert-eu and the iicb.


### 3. the processing of personal data carried out under this regulation shall be subject to regulation (eu) 2018/1725 of the european parliament and of the council. ### 3. the processing of personal data carried out under this regulation shall be subject to regulation (eu) 2018/1725 of the european parliament and of the council and guarantee a high level of public safety and ensure the exchange , collection and retention of personal data is limited to what is strictly necessary for a legitimate purpose and hereby secures the protection of privacy rights.


### 3. the processing of personal data carried out under this regulation shall be subject to regulation (eu) 2018/1725 of the european parliament and of the council. ### deleted


### 1. to enable cert-eu to coordinate vulnerability management and incident response , it may request union institutions , bodies and agencies to provide it with information from their respective it system inventories that is relevant for the cert-eu support. the requested institution , body or agency shall transmit the requested information , and any subsequent updates thereto , without undue delay. ### 1. to enable cert-eu to coordinate vulnerability management and incident response , it may request union institutions , bodies and agencies to provide it with information from their respective it system inventories that is relevant for the cert-eu support. the requested institution , body or agency shall transmit the requested information , and any subsequent updates thereto , without undue delay. any sharing of data between cert-eu and union institutions , bodies and agencies shall follow the principles of clear safeguards for specific use-cases , use mutual legal assistance treaties and other agreements to ensure a higher level of protection for rights when processing requests for cross-border access to data.


### 1. to enable cert-eu to coordinate vulnerability management and incident response , it may request union institutions , bodies and agencies to provide it with information from their respective it system inventories that is relevant for the cert-eu support. the requested institution , body or agency shall transmit the requested information , and any subsequent updates thereto , without undue delay. ### 1. to enable cert-eu effectively perform its mission tasks in accordance with article 12 of this regulation , it may request union institutions , bodies and agencies to provide it with information from their respective ict system inventories that is relevant for the cert-eu support. the requested institution , body or agency shall transmit the requested information , and any subsequent updates thereto , without undue delay.


### 4. the sharing obligations shall not extend to eu classified information (euci) and to information that a union institution , body or agency has received from a member state security or intelligence service or law enforcement agency under the explicit condition that it will not be shared with cert-eu. ### 4. the cybersecurity information sharing arrangements and obligations obligations shall not extend to eu classified information (euci) and to information that a union institution , body or agency has received from a member state security or intelligence service or law enforcement agency under the explicit condition that it will not be shared with cert-eu.


### 5. the notification obligations shall not extend to euci and to information that a union institution , body or agency has received from a member state security or intelligence service or law enforcement agency under the explicit condition that it will not be shared with cert-eu. ### 5. the reporting obligations shall not extend to euci and to information that a union institution , body or agency has received from a member state security or intelligence service or law enforcement agency under the explicit condition that it will not be shared with cert-eu.


### (6) to reach a high common level of cybersecurity , it is necessary that each union institution , body and agency establishes an internal cybersecurity risk management , governance and control framework that ensures an effective and prudent management of all cybersecurity risks , and takes account of business continuity and crisis management. ### (6) to reach a high common level of cybersecurity , it is necessary that each union institution , body and agency establishes an internal cybersecurity risk management , governance and control framework that ensures an effective and prudent management of all cybersecurity risks , and takes account of business continuity and crisis management. the framework should lay down cybersecurity policies and priorities for the security of network and information systems encompassing the entirety of the ict environment. the framework should be reviewed on a regular basis and at least every three years on the basis of key performance indicators to ensure that strategic objectives are met.


### (7) the differences between union institutions , bodies and agencies require flexibility in the implementation since one size will not fit all. the measures for a high common level of cybersecurity should not include any obligations directly interfering with the exercise of the missions of union institutions , bodies and agencies or encroaching on their institutional autonomy. thus , those institutions , bodies and agencies should establish their own frameworks for cybersecurity risk management , governance and control , and adopt their own baselines and cybersecurity plans. ### (7) the differences between union institutions , bodies and agencies require flexibility in the implementation since one size will not fit all. the measures for a high common level of cybersecurity should not include any obligations directly interfering with the exercise of the missions of union institutions , bodies and agencies or encroaching on their institutional autonomy. thus , those institutions , bodies and agencies should establish their own frameworks for cybersecurity risk management , governance and control , and adopt their own cybersecurity risk management measures and cybersecurity plans. union institutions , bodies , offices and agencies should continuously evaluate the effectiveness of the adopted risk management measures and their proportionality relative to the identified risks , and where necessary , adjust and revise accordingly their frameworks and plans on the basis of the results of the cybersecurity maturity assessments.


### (9) a high common level of cybersecurity requires cybersecurity to come under the oversight of the highest level of management of each union institution , body and agency , who should approve a cybersecurity baseline that should address the risks identified under the framework to be established by each institution , body and agency. addressing the cybersecurity culture , i.e. the daily practice of cybersecurity , is an integral part of a cybersecurity baseline in all union institutions , bodies and agencies. ### (9) a high common level of cybersecurity requires cybersecurity to come under the oversight of the highest level of management of each union institution , body and agency , who should oversee the implementation of the provisions of this regulation and approve the establishment , and any subsequent revisions thereof , of the risk management and control framework , the corresponding cybersecurity risk management measures addressing the risks identified in the framework and the cybersecurity plans of each union institution , body , office and agency. addressing the cybersecurity culture , i.e. the daily practice of cybersecurity , is an integral part of a cybersecurity risk management , governance and control framework and the corresponding cybersecurity risk management measures in all union institutions , bodies , offices and agencies.


### (13) many cyberattacks are part of wider campaigns that target groups of union institutions , bodies and agencies or communities of interest that include union institutions , bodies and agencies. to enable proactive detection , incident response or mitigating measures , union institutions , bodies and agencies should notify cert-eu of significant cyber threats , significant vulnerabilities and significant incidents and share appropriate technical details that enable detection or mitigation of , as well as response to , similar cyber threats , vulnerabilities and incidents in other union institutions , bodies and agencies. following the same approach as the one envisaged in directive [proposal nis 2] , where entities become aware of a significant incident they should be required to submit an initial notification to cert-eu within 24 hours. such information exchange should enable cert-eu to disseminate the information to other union institutions , bodies and agencies , as well as to appropriate counterparts , to help protect the union it environments and the union’s counterparts’ it environments against similar incidents , threats and vulnerabilities. ### (13) many cyberattacks are part of wider campaigns that target groups of union institutions , bodies and agencies or communities of interest that include union institutions , bodies and agencies. to enable proactive detection , incident response or mitigating measures , and recovery from significant incidents , union institutions , bodies and agencies should notify cert-eu of significant incidents and share appropriate technical details that enable detection or mitigation of , as well as response to and recovery from similar incidents in other union institutions , bodies and agencies. following the same approach as the one envisaged in directive [proposal nis 2] , where union institutions , bodies , offices and agencies become aware of a significant incident they should be required to submit an early warning to cert-eu within 24 hours. such information exchange should enable cert-eu to disseminate the information to other union institutions , bodies and agencies , as well as to appropriate counterparts , to help protect the union it environments and the union’s counterparts’ it environments against similar incidents , threats and vulnerabilities.


### (20) in supporting operational cybersecurity , cert-eu should make use of the available expertise of the european union agency for cybersecurity through structured cooperation as provided for in regulation (eu) 2019/881 of the european parliament and of the council5 . where appropriate , dedicated arrangements between the two entities should be established to define the practical implementation of such cooperation and to avoid the duplication of activities. cert-eu should cooperate with the european union agency for cybersecurity on threat analysis and share its threat landscape report with the agency on a regular basis. ### (20) in supporting operational cybersecurity , cert-eu should make use of the available expertise of the european union agency for cybersecurity (enisa) through structured cooperation as provided for in regulation (eu) 2019/881 of the european parliament and of the council5 . where appropriate , dedicated arrangements between the two entities should be established to define the practical implementation of such cooperation and to avoid the duplication of activities. cert-eu should cooperate with enisa on threat analysis and share its threat landscape report with the agency on a regular basis.


### this regulation lays down: ### 2. to that end , this regulation lays down:


### obligations on union institutions , bodies and agencies to establish an internal cybersecurity risk management , governance and control framework; ### obligations on union institutions , bodies , offices and agencies to establish a cybersecurity risk management , governance and control framework;


### rules on the organisation and operation of the cybersecurity centre for the union institutions , bodies and agencies (cert-eu) and on the organisation and operation of the interinstitutional cybersecurity board. ### rules on the organisation , tasks and operation of the cybersecurity centre for the union institutions , bodies , offices and agencies (cert-eu) and on the functioning , organisation and operation of the interinstitutional cybersecurity board (iicb).


### (2) ‘network and information system’ means network and information system within the meaning of article 4(1) of directive [proposal nis 2]; ### (2) ‘network and information system’ means network and information system as defined in article 4(1) of directive [proposal nis 2];


### (4) ‘cybersecurity’ means cybersecurity within the meaning of article 4(3) of directive [proposal nis 2]; ### (4) ‘cybersecurity’ means cybersecurity as defined in article 2(1) of regulation (eu) 2019/881 of the european parliament and of the council7a;


### (5) ‘highest level of management’ means a manager , management or coordination and oversight body at the most senior administrative level , taking account of the high-level governance arrangements in each union institution , body or agency; ### (5) ‘highest level of management’ means a manager , management or coordination and oversight body at the most senior administrative level with a mandate to make or authorise decisions , taking account of the high-level governance arrangements in each union institution , body or agency;


### (7) ‘significant incident’ means any incident unless it has limited impact and is likely to be already well understood in terms of method or technology; ### deleted


### (8) ‘major attack’ means any incident requiring more resources than are available at the affected union institution , body or agency and at cert-eu; ### (8) ‘major incident' means any incident whose disruption exceeds cert-eu’s or any individual union institution , body ,office or agency’s capacity to respond to it or with a significant impact on at least two union institutions , bodies , offices and agencies;


### (11) ‘significant cyber threat’ means a cyber threat with the intention , opportunity and capability to cause a significant incident; ### (11) ‘significant cyber threat’ means a cyber threat as defined in article 4(7a) of directive [proposal nis 2];


### (14) ‘cybersecurity risk’ means any reasonably identifiable circumstance or event having a potential adverse effect on the security of network and information systems; ### (14) ‘risk’ means any risk as defined in article 4(7b) of directive [proposal nis 2];


### (16) ‘cybersecurity baseline’ means a set of minimum cybersecurity rules with which network and information systems and their operators and users must be compliant , to minimise cybersecurity risks. ### deleted


### risk management , governance and control ### risk management , governance and control framework


### 1. each union institution , body and agency shall establish its own internal cybersecurity risk management , governance and control framework (‘the framework’) in support of the entity’s mission and exercising its institutional autonomy. this work shall be overseen by the entity’s highest level of management to ensure an effective and prudent management of all cybersecurity risks. the framework shall be in place by …. at the latest [15 months after the entry into force of this regulation]. ### 1. each union institution , body and agency shall establish its own cybersecurity risk management , governance and control framework (‘the framework’) in support of the entity’s mission and exercising its institutional autonomy. this work shall be overseen by the entity’s highest level of management to ensure an effective and prudent management of all cybersecurity risks. the framework shall be in place by …. at the latest [15 months after the entry into force of this regulation].


### 2. the framework shall cover the entirety of the it environment of the concerned institution , body or agency , including any on-premise it environment , outsourced assets and services in cloud computing environments or hosted by third parties , mobile devices , corporate networks , business networks not connected to the internet and any devices connected to the it environment. the framework shall take account of business continuity and crisis management and it shall consider supply chain security as well as the management of human risks that could impact the cybersecurity of the concerned union institution , body or agency. ### 2. the framework shall cover the entirety of the ict environment of the concerned union institution , body , office or agency. the framework shall take account of business continuity and crisis management and it shall consider supply chain security as well as the management of human risks and all other relevant technical , operational and organisational risks that could impact the cybersecurity of the concerned union institution , body or agency.


### 3. the highest level of management of each union institution , body and agency shall provide oversight over the compliance of their organisation with the obligations related to cybersecurity risk management , governance , and control , without prejudice to the formal responsibilities of other levels of management for compliance and risk management in their respective areas of responsibility. ### 3. the highest level of management of each union institution , body , office and agency shall oversee the compliance of its organisation with the obligations related to cybersecurity risk management , governance , and control , without prejudice to the formal responsibilities of other levels of management for compliance and risk management in their respective areas of responsibility.


### cybersecurity baseline ### cybersecurity risk management measures


### 1. the highest level of management of each union institution , body and agency shall approve the entity’s own cybersecurity baseline to address the risks identified under the framework referred to in article 4(1). it shall do so in support of its mission and exercising its institutional autonomy. the cybersecurity baseline shall be in place by …. at the latest [18 months after the entry into force of this regulation] and shall address the domains listed in annex i and the measures listed in annex ii. ### 1. the highest level of management of each union institution , body and agency shall approve the entity’s own cybersecurity risk management measures to address the risks identified under the framework referred to in article 4(1). having regard to the state of the art and , where applicable , relevant european and international standards , or available european cybersecurity certificates as defined in article 2 of regulation (eu) 2019/881 , those risk management measures shall ensure a level of security of network and information systems across the entirety of the ict environment commensurate to the risks identified under the framework referred to in article 4(1). when assessing the proportionality of those measures , due account shall be taken of the degree of the union institution , body , office or agency’s exposure to risks , its size , the likelihood of occurrence of incidents and their severity , including their societal , economic and interinstitutional impact.


### 2. the senior management of each union institution , body and agency shall follow specific trainings on a regular basis to gain sufficient knowledge and skills in order to apprehend and assess cybersecurity risk and management practices and their impact on the operations of the organisation. ### 2. the senior management of each union institution , body , office and agency as well as all relevant staff tasked with implementing the cybersecurity risks management measures and obligations of this regulation shall follow specific trainings on a regular basis to gain sufficient knowledge and skills in order to apprehend and assess cybersecurity risk and management practices and their impact on the operations of the organisation.


### 6 maturity assessments ### 6 cybersecurity maturity assessments


### 1. following the conclusions derived from the maturity assessment and considering the assets and risks identified pursuant to article 4 , the highest level of management of each union institution , body and agency shall approve a cybersecurity plan without undue delay after the establishment of the risk management , governance and control framework and the cybersecurity baseline. the plan shall aim at increasing the overall cybersecurity of the concerned entity and shall thereby contribute to the achievement or enhancement of a high common level of cybersecurity among all union institutions , bodies and agencies. to support the entity’s mission on the basis of its institutional autonomy , the plan shall at least include the domains listed in annex i , the measures listed in annex ii , as well as measures related to incident preparedness , response and recovery , such as security monitoring and logging. the plan shall be revised at least every three years , following the maturity assessments carried out pursuant to article 6. ### 1. following the conclusions derived from the maturity cybersecurity assessment and considering risks identified pursuant to article 4 , the highest level of management of each union institution , body , office and agency shall approve a cybersecurity plan without undue delay after the establishment of the risk management , governance and control framework , and the cybersecurity risk management measures. the cybersecurity plan shall aim at increasing the overall cybersecurity of the concerned entity union institution , body , office or agency and shall thereby contribute to the achievement or enhancement of a high common level of cybersecurity among all union institutions , bodies , offices and agencies. to support the union institution , body , office or agency's mission on the basis of its institutional autonomy , the plan shall at least include the cybersecurity risk management measures referred to in article 5 (1a) and 5(2a). the cybersecurity plan shall be revised at least every three years , or where necessary , with any substantial revision of the framework referred to in article 4 , following the cybersecurity maturity assessments carried out pursuant to article 6.


### 2. the cybersecurity plan shall include staff members’ roles and responsibilities for its implementation. ### 2. the cybersecurity plan shall include relevant staff members’ roles and responsibilities for its implementation , including detailed job descriptions for technical and operational staff as well as all relevant processes underpinning performance evaluation.


### 3. the cybersecurity plan shall consider any applicable guidance documents and recommendations issued by cert-eu. ### 3. the cybersecurity plan shall consider any applicable guidance documents and recommendations issued by cert-eu in accordance with article 13 and another applicable or targeted recommendations issued by the iicb and cert-eu.


### 1. upon completion of maturity assessments , the union institutions , bodies and agencies shall submit these to the interinstitutional cybersecurity board. upon completion of security plans , the union institutions , bodies and agencies shall notify the interinstitutional cybersecurity board of the completion. upon request of the board , they shall report on specific aspects of this chapter. ### 1. upon completion of their respective cybersecurity maturity assessments referred to in article 6 and cybersecurity plans referred to in article 7 , the union institutions , bodies , offices and agencies shall submit these to the iicb.


### the european union agency for cybersecurity. ### the european union agency for cybersecurity (enisa).


### 6. the iicb shall meet at the initiative of its chair , at the request of cert-eu or at the request of any of its members. ### 6. the iicb shall meet at the initiative of its chair , and at least two times a year , at the request of cert-eu or at the request of any of its members.


### review any reports requested from cert-eu on the state of implementation of this regulation by the union institutions , bodies and agencies; ### request reports from cert-eu on the state of implementation of this regulation by the union institutions , bodies and agencies;


### the iicb shall monitor the implementation of this regulation and of adopted guidance documents , recommendations and calls for action by the union institutions , bodies and agencies. where the iicb finds that union institutions , bodies or agencies have not effectively applied or implemented this regulation or guidance documents , recommendations and calls for action issued under this regulation , it may , without prejudice to the internal procedures of the relevant union institution , body or agency: ### where the iicb finds that union institutions , bodies or agencies have not effectively applied or implemented this regulation or guidance documents , recommendations and calls for action issued under this regulation , it may , without prejudice to the internal procedures of the relevant union institution , body or agency:


### 1. the mission of cert-eu , the autonomous interinstitutional cybersecurity centre for all union institutions , bodies and agencies , shall be to contribute to the security of the unclassified it environment of all union institutions , bodies and agencies by advising them on cybersecurity , by helping them to prevent , detect , mitigate and respond to incidents and by acting as their cybersecurity information exchange and incident response coordination hub. ### 1. the mission of cert-eu , the autonomous interinstitutional cybersecurity centre for all union institutions , bodies and agencies , shall be to contribute to the security of the unclassified ict environment of all union institutions , bodies and agencies by advising them on cybersecurity , by helping them to prevent , detect , mitigate and respond to and recover from incidents and by acting as their cybersecurity information exchange and incident response coordination hub.


### 6. cert-eu may organise cybersecurity exercises or recommend participation in existing exercises , in close cooperation with the european union agency for cybersecurity whenever applicable , to test the level of cybersecurity of the union institutions , bodies and agencies. ### 6. cert-eu may organise cybersecurity exercises or recommend participation in existing exercises , in close cooperation with enisa whenever applicable , to test the level of cybersecurity of the union institutions , bodies and agencies.


### 7. cert-eu may provide assistance to union institutions , bodies and agencies regarding incidents in classified it environments if it is explicitly requested to do so by the constituent concerned. ### 7. cert-eu may provide assistance to union institutions , bodies and agencies regarding incidents in classified ict environments if it is explicitly requested to do so by the constituent concerned. the provisions and obligations on all union institutions , bodies , offices and agencies set out in chapter v of this regulation shall not apply to incidents in classified ict environments unless an individual union institution , body office or agency explicitly and voluntarily apply them in order to seek actionable assistance from cert-eu or otherwise contribute to situational awareness at the union level.


### modalities for or improvements to cybersecurity risk management and the cybersecurity baseline; ### modalities for or improvements to cybersecurity risk management and cybersecurity risk management measures;


### modalities for maturity assessments and cybersecurity plans; and ### modalities for cybersecurity maturity assessments and cybersecurity plans; and


### the head of cert-eu shall regularly submit reports to the iicb and the iicb chair on the performance of cert-eu , financial planning , revenue , implementation of the budget , service level agreements and written agreements entered into , cooperation with counterparts and partners , and missions undertaken by staff , including the reports referred to in article 10(1). ### the head of cert-eu shall regularly submit reports to the iicb and the iicb chair , and submit ad-hoc reports to the iicb upon its request , on the performance of cert-eu , financial planning , revenue , implementation of the budget , service level agreements and written agreements entered into , cooperation with counterparts and partners , and missions undertaken by staff , including the reports referred to in article 10.


### 1. the commission , after having obtained the unanimous approval of the iicb , shall appoint the head of cert-eu. the iicb shall be consulted at all stages of the procedure prior to the appointment of the head of cert-eu , in particular in drafting vacancy notices , examining applications and appointing selection boards in relation to this post. ### deleted


### 19 sharing obligations ### 19 cybersecurity information sharing arrangements and obligations


### 20 notification obligations ### 20 reporting obligations


### all union institutions , bodies and agencies shall make an initial notification to cert-eu of significant cyber threats , significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. ### deleted


### all union institutions , bodies and agencies shall make an initial notification to cert-eu of significant cyber threats , significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. ### all union institutions , bodies , offices and agencies shall report , without undue delay to cert-eu in accordance with paragraph 2(b) of any incident having a significant impact.


### in duly justified cases and in agreement with cert-eu , the union institution , body or agency concerned can deviate from the deadline laid down in the previous paragraph. ### deleted


### 2. the union institutions , bodies and agencies shall further notify to cert-eu without undue delay appropriate technical details of cyber threats , vulnerabilities and incidents that enable detection , incident response or mitigating measures. the notification shall include if available: ### deleted


### 3. cert-eu shall submit to enisa on a monthly basis a summary report including anonymised and aggregated data on significant cyber threats , significant vulnerabilities and significant incidents notified in accordance with paragraph 1. ### 3. cert-eu shall submit to enisa on a monthly basis a summary report including anonymised and aggregated data on significant incidents notified in accordance with paragraph 2(b) and cyber threats , incidents , near misses and vulnerabilities notified in accordance with article 19(1).


### 4. the iicb may issue guidance documents or recommendations concerning the modalities and content of the notification. cert-eu shall disseminate the appropriate technical details to enable proactive detection , incident response or mitigating measures by union institutions , bodies and agencies. ### 4. the iicb may issue guidance documents or recommendations concerning the modalities and content of the notification. when preparing such guidance documents or recommendations , the iicb shall take into account the specifications made by any implementing acts adopted by the commission specifying the type of information , the format and the procedure of a notification submitted pursuant to article 20 (11) of directive [proposal nis2]. cert-eu shall disseminate the appropriate technical details to enable proactive detection , incident response or mitigating measures by union institutions , bodies , offices and agencies.


### 3. cert-eu shall support union institutions , bodies and agencies regarding situational awareness of cyber threats , vulnerabilities and incidents. ### 3. cert-eu , in cooperation with enisa , shall support union institutions , bodies and agencies regarding situational awareness of cyber threats , vulnerabilities and incidents.


### major attacks ### major incidents


### 1. cert-eu shall coordinate among union institutions , bodies and agencies responses to major attacks. it shall maintain an inventory of technical expertise that would be needed for incident response in the event of such attacks. ### 1. cert-eu shall coordinate among union institutions , bodies and agencies responses to major incidents. it shall maintain an inventory of technical expertise that would be needed for incident response in the event of such major incidents and assist the iicb in coordinating union institutions , bodies , offices and agencies’ cyber crisis management plans for major incidents referred to in article 10(if).


### 3. with the approval of the concerned union institutions , bodies and agencies , cert-eu may also call on experts from the list referred to in paragraph 2 for contributing to the response to a major attack in a member state , in line with the joint cyber unit’s operating procedures. ### 3. with the approval of the concerned union institutions , bodies and agencies , cert-eu may also call on experts from the list referred to in paragraph 2 for contributing to the response to a major incident in a member state , in line with the joint cyber unit’s operating procedures.


### 3. the commission shall evaluate the functioning of this regulation and report to the european parliament , the council , the european economic and social committee and the committee of the regions no sooner than five years after the date of entry into force. ### 3. the commission shall evaluate the functioning of this regulation and report to the european parliament , the council , the european economic and social committee and the committee of the regions no later than five years after the date of entry into force.


### the following domains shall be addressed in the cybersecurity baseline: ### deleted


### union institutions , bodies and agencies shall address at least the following specific cybersecurity measures in the implementation of the cybersecurity baseline and in their cybersecurity plans , in line with the guidance documents and recommendations from the iicb: ### deleted


### (7) in october 2021 , the organisation for economic co-operation and development and the g20 inclusive framework on base erosion and profit shifting reached an agreement on the allocation to participating market jurisdictions of 25% of residual profits of large multinational enterprises above the profitability threshold of 10% (‘oecd/g20 if pillar 1 agreement’). the own resource should consist in applying a uniform call rate to the share of residual profits of the multinational enterprises , re-allocated to member states [pursuant to the directive on implementation of the global agreement on re-allocation of taxing rights.] ### (7) in october 2021 , the organisation for economic co-operation and development and the g20 inclusive framework on base erosion and profit shifting reached an agreement on the allocation to participating market jurisdictions of 25% of residual profits of large multinational enterprises above the profitability threshold of 10% (‘oecd/g20 if pillar 1 agreement’). the own resource should consist in applying a uniform call rate to the share of residual profits of the multinational enterprises , re-allocated to member states [pursuant to the directive on implementation of the global agreement on re-allocation of taxing rights , as soon as adopted]. in the absence of progress on the implementation of the oecd/g20 (if) pillar 1 agreement by the end of 2023 , the commission shall submit a new proposal introducing a new own resource in connection with the single market , such as a single market levy or a digital levy , in order to generate revenues by 2026.


### article 1(1) , point (c) , shall apply from ### article 1(1) , points (c) and (ca) , shall apply from


### the first day of the date of application of the [directive on implementation of the global agreement on re-allocation of taxing rights] or ### the first day of the date of application of the [directive on implementation of the global agreement on re-allocation of taxing rights] or the first day of the date of application of the [directive (eu)xxx introducing a own resource connected to the single market in the union] or


### 3. notes that the application relates in total to 206 displaced workers whose activity has ceased; welcomes the fact that greece expects that all of the eligible beneficiaries will participate in the measures (targeted beneficiaries); ### 3. notes that the application relates in total to 206 displaced workers whose activity has ceased , of which 12 ,6 % are women and 87 ,4 % are men; welcomes the fact that greece expects that all of the eligible beneficiaries will participate in the measures (targeted beneficiaries);


### h. whereas the french government’s several legislations and programmes to support the sector enabled the number of dismissals to be reduced significantly (by 2 002 posts) , 2 246 jobs were eventually lost in france; ### h. whereas public support to long-term part time activity , duly negotiated with the concerned workers and the boosting of a programme by the conseil pour la recherche aéronautique civile , enabled the number of dismissals to be reduced significantly (by 2 002 posts); regarding the other 2 246 jobs at stake , the near totality of workers agreed to internal mobility measures or voluntary termination packages , which are the core of this egf application;


### 3. welcomes the measures undertaken by the french authorities , such as the provisions of the new emergency legislation1 , the support plan for the aeronautics industry and the long-term part-time activity programme2 which significantly reduced the number of redundancies; ### 3. welcomes the measures undertaken by national and local public authorities such as the provisions of the new emergency legislation1 , the support plan for the aeronautics industry , the long-term part-time activity programme2 , and the top-up of the ader 4 plan) which significantly reduced the number of redundancies;


### 7. notes that france started providing personalised services to the targeted beneficiaries on 1 november 2020 and that the period of eligibility for a financial contribution from the egf will therefore be from 1 november 2020 until 24 months after the date of the entry into force of the financing decision; ### 7. notes that airbus started providing personalised services to the targeted beneficiaries on 1 november 2020 and that the period of eligibility for a financial contribution from the egf will therefore be from 1 november 2020 until 24 months after the date of the entry into force of the financing decision;


### 9. welcomes that the co-ordinated package of personalised services was drawn up by france in consultation with staff and union representatives1 ### 9. welcomes that the co-ordinated package of personalised services was the result of a good collective bargaining agreement between airbus and workers' representatives1;


### 12. reiterates that assistance from the egf must not replace actions which are the responsibility of companies , by virtue of national law or collective agreements; ### 12. reiterates that assistance from the egf must not replace actions which are the responsibility of companies , by virtue of national law or collective agreements; requests that beneficiaries of the personalised services which are to be covered by the egf be publicly and personally informed of the union co-financing;


### d. whereas the purpose of draft amending budget no 1/2022 is to reflect the specific impact of the transfer of 25 % of the allocations not used in 2021 to the year 2022; ### d. whereas the purpose of draft amending budget no 1/2022 is to reflect the specific impact of the transfer of 25 % of the allocations not used in 2021 to the year 2022 for seven funds under shared management (erdf , cf , esf+ , emfaf , jtf , amif and ibmf);


### 2. is concerned about the severe delays in the implementation of union programmes and funds under shared management; reiterates the need for swift implementation to support the union’s recovery; urges , therefore , the member states to accelerate the implementation of those programmes to ensure they are fully operational in 2022; ### 2. is concerned about the severe delays in the implementation of union programmes and funds under shared management; reiterates the need for swift implementation to support the union’s recovery; urges , therefore , all member states and the commission to accelerate the implementation of those programmes to ensure they are fully operational in 2022 and to catch up the backlog to ensure the full implementation of the programmes by 2027;


### 1. stresses the key role of cohesion policy in fostering economic , social and territorial convergence across the eu; expresses concern , however , about persistent inequalities , socio-economic disparities and uneven demographic decline , with many less developed regions falling behind and getting caught in a ‘development trap’ in the wake of the covid-19 pandemic; ### 1. stresses the key role of cohesion policy in fostering economic , social and territorial convergence across the eu; expresses concern , however , about persistent inequalities , socio-economic disparities and uneven demographic decline , with many less developed regions falling behind and getting caught in a ‘development trap’ in the wake of the covid-19 pandemic; is concerned by the impact of the war in ukraine on the implementation of cohesion policy , the social and economic situation of member states and the development perspectives of local and regional actors;


### 2. recalls that cohesion policy , with a budget of eur 392 billion between 2021 and 2027 , remains the eu’s primary investment tool and notes that its share of public investment in member states increased considerably over the 2014-2020 period; ### 2. recalls that cohesion policy , with a budget of eur 392 billion between 2021 and 2027 , remains the eu’s primary investment tool and notes that its share of public investment in member states increased considerably over the 2014-2020 period; underlines the negative impact of the pandemic and of the war in ukraine on the implementation of the 2014-2020 projects and calls for the extension of the period of the use of european funds from that mff by 1 year;


### 3. is concerned by the significant delay in cohesion policy implementation for the 2021-2027 period; urges the commission and the member states to speed up the adoption of partnership agreements and operational programmes; stresses that the prolonged under-implementation of cohesion funds could lead to an abnormal backlog in payments in the second part of the current multiannual financial framework (mff) , putting additional pressure on payments during the negotiations on the post-2027 mff; ### 3. is concerned by the significant delay in cohesion policy implementation for the 2021-2027 period; urges the commission and the member states to speed up the adoption of partnership agreements and operational programmes; stresses that the prolonged under-implementation of cohesion funds could lead to an abnormal backlog in payments in the second part of the current multiannual financial framework (mff) , putting additional pressure on payments during the negotiations on the post-2027 mff; calls upon the commission to support and assist member states in the neighbouring regions of ukraine in order to adopt the partnership agreements and operational programmes as fast as possible;


### 3. is concerned by the significant delay in cohesion policy implementation for the 2021-2027 period; urges the commission and the member states to speed up the adoption of partnership agreements and operational programmes; stresses that the prolonged under-implementation of cohesion funds could lead to an abnormal backlog in payments in the second part of the current multiannual financial framework (mff) , putting additional pressure on payments during the negotiations on the post-2027 mff; ### 3. is concerned by the significant delay in cohesion policy implementation for the 2021-2027 period; urges the commission and the member states to speed up the adoption of partnership agreements and operational programmes and that it should be followed by an accelerated implementation to catch-up the delays; stresses that the prolonged under-implementation of cohesion funds could lead to an abnormal backlog in payments in the second part of the current multiannual financial framework (mff) , putting additional pressure on payments during the negotiations on the post-2027 mff;


### 4. regrets that the time-limited nature of the recovery and resilience facility (rrf) has prompted member states to prioritise the implementation of the national recovery and resilience plans; highlights the need to ensure complementarities and synergies between cohesion policy , the rrf and other policy instruments , to ensure maximum impact; ### 4. takes note that the time-limited nature of the recovery and resilience facility (rrf) has prompted member states to prioritise the implementation of the national recovery and resilience plans and is concerned that it could affect the speed of implementation cohesion policy; highlights the need to ensure complementarities and synergies between cohesion policy , the rrf and other policy instruments , to ensure maximum impact;


### 5. welcomes the flexibility introduced through the cohesion’s action for refugees in europe (care) proposals to help member states deal with the impact of the war in ukraine , following the model of the coronavirus response investment initiatives , crii and crii+; underlines , however , that cohesion policy funding must primarily serve its long-term policy objectives and not become a source of financing to make up for shortcomings in budgetary flexibility or crisis response mechanisms within the mff. ### 5. welcomes the flexibility introduced through the cohesion’s action for refugees in europe (care) proposals to help member states deal with the impact of the war in ukraine , and especially the countries on the border with ukraine , following the model of the coronavirus response investment initiatives , crii and crii+; calls for further simplification and flexibility on the use of eu funds for the period 2014-2020 and underlines the need for an extension of the period for the implementation of the projects impacted by the war and the pandemic and the need to facilitate the transfer of projects from that mff to the new financial programming; underlines , however , that cohesion policy funding must primarily serve its long-term policy objectives and not become a source of financing to make up for shortcomings in budgetary flexibility or crisis response mechanisms within the mff.


### a. whereas the union has set up legislative and budgetary instruments to provide additional support to workers who are suffering from the consequences of globalisation and of technological and environmental changes , such as changes in world trade patterns , trade disputes , significant changes in the trade relations of the union or the composition of the internal market and financial or economic crises , as well as the transition to a low-carbon economy , or as a consequence of digitisation or automation; ### a. whereas the union has set up legislative and budgetary instruments to provide additional support to workers who are suffering from the consequences of globalisation and of technological and environmental changes , such as changes in world trade patterns , trade disputes , significant changes in the trade relations of the union or the composition of the internal market and financial or economic crises , as well as the transition to a low-carbon economy , or as a consequence of digitisation or automation; whereas it is necessary to facilitate mobility at a low cost;


### 4. recalls that the social impacts of the redundancies are expected to be important for france , in particular in the region île-de-france , where 57 % of the displacements took place; notes that the french labour administration specified that air france’s restructuring affected the employment balance in the territories concerned; ### 4. recalls that the social impacts of the redundancies are expected to be important for france , in particular in the region île-de-france , where 57 % of the displacements took place; notes that the french labour administration specified that air france’s restructuring affected the employment balance in the territories concerned; emphasizes that volatile economic areas require an integrated response;


### 7. recalls that personalised services to be provided to the workers consist of the following actions: advisory services and vocational guidance , training , contribution to business creation , hiring benefits , quick reemployment allowance and salary top-ups; ### 7. recalls that personalised services to be provided to the workers consist of the following actions: advisory services and vocational guidance , training , contribution to business creation , hiring benefits , quick reemployment allowance and salary top-ups; stresses the necessity of reintegration of qualified workers within the union;


### 1. welcomes the council’s conclusions on enhancing the european financial architecture for development and underlines the key role of the ‘neighbourhood , development and international cooperation instrument – global europe‘ , the european fund for sustainable development plus (efsd+) and the external action guarantee in providing a strategic framework for blended finance and guarantees and in mobilising resources from the private sector with the support of the eu budget; ### 1. welcomes the council’s conclusions on enhancing the european financial architecture for development and underlines the key role of the ‘neighbourhood , development and international cooperation instrument – global europe‘ , the european fund for sustainable development plus (efsd+) and the external action guarantee in providing a strategic framework for blended finance and guarantees and in mobilising resources from the private sector with the support of the eu budget , especially in light of increasing geopolitical and economic competition; highlights that the new financial architecture should support the eu’s strategic interests on the global stage , with values , such as democracy , rule of law , gender equality and human rights as underlying principles; calls on all actors to ensure operations outside the union are aligned with eu external policy objectives and contribute to achieving the eu’s policy priorities;


### 1. stresses that the policy-first-driven european financial architecture for development (efad) should be guided by the principles and objectives set out in the un 2030 agenda for sustainable development , the paris agreement and the addis ababa action agenda; ### 1. stresses that the policy-first-driven european financial architecture for development (efad) should be guided by the principles and objectives set out in the un 2030 agenda for sustainable development , the paris agreement and the addis ababa action agenda and that it contributes to achieving the sdgs;


### 2. stresses that despite some recent improvements , the current status quo is characterised by a lack of coordination , fragmentation , duplication and continued competition between the european investment bank (eib) , the european bank for reconstruction and development (ebrd) and european development and finance institutions; underlines the need to make the current system more efficient and focused to ensure an optimal use of resources , a better return on eu taxpayers’ money and a stronger development impact; ### 2. recognises that some progress and recent improvements have been made , but notes that the current status quo is still characterised by a lack of coordination , fragmentation , duplication and continued competition between the european investment bank (eib) , the european bank for reconstruction and development (ebrd) and european development and finance institutions; calls for further efforts to make the current system more efficient , collaborative and visible , and focused on ensuring an optimal use of resources , a better return on eu taxpayers’ money and a stronger development impact; calls , in this regard , for the strengthening of cooperation among key partners , notably the european commission , the eib , the ebrd , european development finance institutions , national development agencies and member states , leveraging their respective geographical , sectoral and financial expertise , resources and value-added , to achieve greater efficiency and transformational development impact; considers cooperation with non-eu development banks and stakeholders also important and calls for increased engagement with other international financial institutions;


### 2. calls on the commission to move forward from the current status quo and provide a strong and clear policy steer to ensure consistency of eu action as team europe by applying the enhanced efad in the successful implementation of european initiatives , such as the global gateway strategy , the green deal or the strategic compass after its adoption , in order to strengthen the eu’s strategic autonomy and promote the eu’s values through its partnerships; ### 2. calls on the commission to move forward from the current status quo and provide a strong and clear policy steer , under the appropriate political guidance , to ensure consistency of eu action as team europe by proposing concrete actions for applying the enhanced efad in the successful implementation of european initiatives , such as the global gateway strategy , the green deal or the strategic compass after its adoption , in order to strengthen the eu’s strategic autonomy and promote the eu’s values through its partnerships;


### 2. strongly insists that efad must strengthen the strategic partnerships between the european union and its global development partners; reiterates that such partnerships should always be based on mutual respect and dignity , shared interests and values; ### 2. strongly insists that efad must strengthen the strategic partnerships between the european union and its global development partners; reiterates that such partnerships should always be based on mutual respect and dignity , shared interests , values and development objectives , namely reducing inequalities and poverty reduction;


### 3. recognises that the european financial architecture for development is mainly focused on least developed and fragile countries , particularly in sub-saharan africa; recalls , however , that a considerable share of investments is channelled to the western balkans and the eastern and southern neighbourhood , and underlines the need to provide funding to deal with new challenges and support new priorities in these regions; calls on the commission , the eib , the ebrd and european development and finance institutions to work on action plans for the reconstruction of ukraine as soon as it is re-established as a sovereign and independent country after the war; ### 3. stresses the importance of targeting investments to the most vulnerable regions where the needs are greatest , in particular least developed countries (ldcs) and fragile or conflict-affected countries; welcomes that the european financial architecture for development is mainly focused on least developed and fragile countries , particularly in sub-saharan africa; underlines that development finance must be accompanied by coherent measures in other policy domains , which are crucial for ldcs , notably trade , climate , and agriculture; recalls , however , that a considerable share of investments is channelled also to the western balkans and the eastern and southern neighbourhood; underlines the need to provide funding to deal with new challenges and support new priorities in these regions; notes , in this context , that the russian federation’s illegal , unprovoked and unjustified military aggression against ukraine has considerably impacted the development landscape and the economic and security situation in the eu and its neighbourhood; expects a share of the global europe cushion to be used to address these unforeseen circumstances; calls on the commission , the eib , the ebrd and european development and finance institutions to work on action plans for the reconstruction of ukraine as soon as it is re-established as a sovereign and independent country after the war; recognises furthermore that russia’s war against ukraine has increased energy and food prices , exacerbating humanitarian needs especially in low-income countries in sub-saharan africa; underlines the urgency of responding to those needs with further funding;


### 3. reaffirms the specific role and responsibility of the european investment bank (eib) as the eu’s financial arm with a global reach; calls for the eib to be further capitalised on as an exclusively eu-owned tool for reinforcing the eu’s external policy priorities; welcomes , in this regard , the establishment of eib global; ### 3. reaffirms the specific role and responsibility of the european investment bank (eib) as the eu’s financial arm with a global reach; calls for the eib to be further capitalised on as an exclusively eu-owned tool for reinforcing its operations in support of the eu’s external policy priorities and ensure inclusive association with european development banks and financial institutions under a team europe approach; welcomes , in this regard , the establishment of eib global;


### 3. underlines the interconnection between development and security; highlights the role that development plays in preventing conflicts , ensuring durable exits from conflicts and bolstering crisis management; insists on the importance of further developing a well-tailored development-security nexus; ### 3. underlines the interconnection between humanitarian aid , development and peace; highlights the role that development plays in preventing conflicts , ensuring durable exits from conflicts and bolstering crisis management; insists on the importance of further developing a well-tailored nexus to address protracted and predictable crises , leading to a people-centred , structural , and sustainable long-term recovery;


### 4. calls on the eib , the ebrd and european development and finance institutions to strengthen their cooperation within the efsd+ open architecture by taking a team europe approach; stresses the need for greater specialisation and a better division of labour to ensure synergies and complementarities; underlines the need to move away from the current project-based approach towards sector-based programming involving all stakeholders from the start , including private investors , to increase leverage and impact; ### 4. calls on the eib , the ebrd and european development and finance institutions to strengthen their cooperation within the efsd+ open architecture by taking a team europe approach defined as a single framework of action , combining their resources with those of all eu institutions and member states , to provide short and long-term support; underlines that the financial architecture should be open , collaborative and inclusive , and enable the participation of all interested development finance actors , including smaller and medium-sized actors; calls , in this regard , on the commission to simplify access to financing and provide capacity-building and support in pillar assessment applications for smaller development banks and financial institutions; stresses the need for greater specialisation and a better division of labour to ensure synergies and complementarities; encourages european development actors and financing institutions to draw more extensively on eu delegations when building pipelines of investment projects; underlines the need to move away from the current project-based approach towards sector-based programming involving all relevant stakeholders from the start , including the private sector and civil society , to increase transparency , leverage and impact;


### 4. welcomes the significantly enhanced open architecture under the european fund for sustainable development plus (efsd+) and calls on the commission and member states to provide the eib , the european bank for reconstruction and development (ebrd) , european bilateral financing institutions and european development finance institutions with a reliable and enhanced operational environment , where they can effectively undertake their strengthened roles in external lending operations and mobilise resources from the private sector; ### 4. welcomes the significantly enhanced open architecture under the european fund for sustainable development plus (efsd+) and calls on the commission and member states to provide the eib , the european bank for reconstruction and development (ebrd) , european bilateral financing institutions and european development finance institutions with a reliable and enhanced operational environment , where they can effectively undertake their strengthened roles in external lending operations and mobilise resources from the private sector; is cognizant of the fact that resources of the magnitude required for the relevant initiatives such as the global gateway will not be attained in the absence of public and private actors joining forces; calls on the eib , the ebrd and other european development finance institutions to strengthen cooperation and coordination and to concentrate on their specific added value operations as well as on delivery and development impact on the ground;


### 5. reaffirms the privileged role of the eib as the eu’s investment arm and welcomes the recent creation of its development branch , eib global; calls on the eib to strengthen its presence in the field while exploiting possible synergies with other european development and finance institutions; ### 5. reaffirms the privileged role of the eib as the eu’s investment arm and welcomes the recent creation of its development branch , eib global; underlines that local presence is key for successful financing operations and calls on the eib to strengthen its presence in the field while exploiting possible synergies with eu delegations , the ebrd and other european development and finance institutions;


### 5. notes that the team europe approach provides a unique opportunity to leverage eu impact and visibility in the world far more than is currently the case; expresses the need for an inclusive team europe spirit to also be put into action in the efad; notes that the key to the success of the team europe approach is eu policy-guided cooperation and coordination in a transparent and inclusive environment; emphasises that parliament’s close involvement in the strategic orientation of team europe initiatives is key to preserving their democratic legitimacy; ### 5. notes that the team europe approach provides a unique opportunity to leverage eu impact and visibility in the world far more than is currently the case to further promote our values and interests , while leaving no one behind; expresses the need for an inclusive team europe spirit to also be put into action in the efad; notes that the key to the success of the team europe approach is eu policy-guided cooperation and coordination in a transparent and inclusive environment; emphasises that parliament’s close involvement in the strategic orientation of team europe initiatives is key to preserving their democratic legitimacy;


### 5. notes that the team europe approach provides a unique opportunity to leverage eu impact and visibility in the world far more than is currently the case; expresses the need for an inclusive team europe spirit to also be put into action in the efad; notes that the key to the success of the team europe approach is eu policy-guided cooperation and coordination in a transparent and inclusive environment; emphasises that parliament’s close involvement in the strategic orientation of team europe initiatives is key to preserving their democratic legitimacy; ### 5. notes that the team europe approach provides a unique opportunity to leverage eu impact and visibility in the world far more than is currently the case; expresses the need for an inclusive team europe spirit to also be put into action in the efad; notes that the key to the success of the team europe approach is eu policy-guided cooperation and coordination in a transparent and inclusive environment; emphasises that parliament’s close involvement and scrutiny in the strategic orientation of team europe initiatives is key to preserving their democratic legitimacy;


### 5. underlines that consistency across all eu financing instruments , initiatives and strategies is crucial in order to maximise the eu’s global response to sustainable growth , development and peace; ### 5. underlines that consistency and policy coherence across all eu financing instruments , initiatives and strategies is crucial in order to maximise the eu’s global response to sustainable growth , development and peace;


### 6. highlights the need for a stronger policy steer from the commission , with the western balkans’ investment framework serving as a possible model in this regard; calls on the commission to use its existing resources in terms of banking expertise and its financial and technical capacities more effectively; ### 6. highlights the need for a stronger policy steer from the commission , with the western balkans’ investment framework serving as a possible model in this regard; stresses the importance of an adequate risk management framework , effective management and oversight of the implementation of development finance instruments; calls on the commission to use its existing resources in terms of banking expertise and its financial and technical capacities more effectively; invites the commission to assess whether further specialised financial expertise is required for the policy steering function , effective engagement with dfis and oversight of guarantees and complex blended finance instruments;


### 6. recognises that the efad is focused on least developed and fragile countries , especially in sub-saharan africa , but urges that it be borne in mind that around two thirds of the eib and ebrd’s combined external operations are concentrated in accession and neighbourhood countries where the eu needs to deliver on the recently launched economic and investment plans for the western balkans as well as in the eastern and southern neighbourhoods; calls in this regard for the eib and ebrd’s operations and role to be strengthened. ### 6. recognises that the efad is focused on most vulnerable regions and where the needs are greatest , notably least developed and fragile countries , especially in sub-saharan africa , but urges that it be borne in mind that around two thirds of the eib and ebrd’s combined external operations are concentrated in accession and neighbourhood countries where the eu needs to deliver on the recently launched economic and investment plans for the western balkans as well as in the eastern and southern neighbourhoods; calls in this regard for the eib and ebrd’s operations and role to be strengthened with enhanced cooperation through concrete actions.


### 7. recognises the importance of encouraging riskier investments in more challenging development settings , such as fragile or conflict-affected countries , and underserved sectors such as the climate , biodiversity and health sectors; underlines , at the same time , the need to fully protect the eu budget from any associated risks , such as increased demand on the eu budgetary guarantees; ### 7. recognises the importance of encouraging riskier investments in more challenging development settings , such as fragile or conflict-affected countries , and underserved sectors such as the climate , biodiversity and health sectors; underlines , at the same time , the need to preserve the high credit rating of the eib and to fully protect the eu budget from any associated risks , such as increased demand on the eu budgetary guarantees as well as increased risk of misuse of funds through fraud or corruption; invites the commission and the eib to engage in a more granular country-by-country risk assessment for adjusting gradually the eu budgetary guarantees to the adequate levels to cope with current challenges; calls , furthermore , for increased transparency of development operations carried out by financial intermediaries with a view to ensuring control over funds and mitigating the risk of corruption , notably by disclosing final beneficiaries and making the granting of direct and indirect loans subject both to publication by the beneficiaries of tax and accounting data country by country and to the sharing of beneficial ownership data on the beneficiaries and financial intermediaries involved in financing operations;


### 8. highlights the need to increase the transparency of the current framework , including the programming process , and for parliament to be more heavily involved; underlines the importance of carrying out an independent evaluation of the efsd+ and the team europe approach in due time to assess their effectiveness and performance. ### 8. highlights the need to increase the transparency of the current framework , including the programming and reporting processes , and for parliament to be more heavily involved to enhance democratic accountability and scrutiny; underlines the importance of carrying out an independent evaluation of the efsd+ and the team europe approach in due time to assess their effectiveness , performance and development impact; underlines the need to ensure the efsd+ facilitates learning about best practices concerning sector- and region-specific projects;


### a. whereas the pre-pandemic sdg annual funding gap in developing countries of usd 2.5 trillion is expected to increase by 70 % post-covid-19 , to usd 4.2 trillion (eur 3.7 trillion)6 ; ### a. whereas the covid-19 pandemic has deepened the already significant sdg financing gap and caused an overall decline in resources of usd 700 billion , and , at the same time , an increase in needs of usd 1 trillion , causing a scissor effect , so that the pre-pandemic sdg annual funding gap in developing countries of usd 2.5 trillion is expected to increase by 70 % post-covid-19 , to usd 4.2 trillion (eur 3.7 trillion)6 ;


### b. whereas achieving the sdgs and the goals of the paris agreement and addressing other acute global challenges requires joint engagement at international level; ### b. whereas leadership and efforts from the eu alone to achieve achieving the sdgs and the goals of the paris agreement and addressing other acute global challenges are not sufficient , and hence joint engagement at international level is required;


### c. whereas policy coherence and close cooperation between all official development finance institutions , their government shareholders and all existing partners is urgently needed; whereas the successful mobilisation of further capital , both private and public , in addition to official development assistance (oda) and other existing forms of development finance , is critical; ### c. whereas policy coherence and close cooperation between all official development finance institutions , their government shareholders and all existing partners is urgently needed; whereas the successful mobilisation of further capital , both private and public , in addition to official development assistance (oda) and other existing forms of development finance , is critical , but needs to be aligned with development policy objectives especially in view of reducing inequalities and poverty reduction as the first goal of the agenda 2030;


### c. whereas policy coherence and close cooperation between all official development finance institutions , their government shareholders and all existing partners is urgently needed; whereas the successful mobilisation of further capital , both private and public , in addition to official development assistance (oda) and other existing forms of development finance , is critical; ### c. whereas , for the actual achievement of the sdgs and overcoming the covid-19 pandemic , policy coherence and close cooperation between all official development finance institutions , their government shareholders and all existing partners is urgently needed to ensure that scarce public money is used in the most effective and efficient way; whereas the successful mobilisation of further capital , both private and public , in addition to official development assistance (oda) and other existing forms of development finance , is critical;


### 9. insists that mechanisms for ensuring policy coherence for sustainable development must be enshrined in efad and used more systematically and efficiently by all relevant eu institutions and all member states , including at the highest political level; ### 9. is concerned that key features of the policy coherence for sustainable development (pcsd) principle are systematically missing in regulatory initiatives of the eu; insists that mechanisms for ensuring policy coherence for sustainable development must be enshrined in efad and used more systematically and efficiently by all relevant eu institutions and all member states , including at the highest political level;


### 9. insists that mechanisms for ensuring policy coherence for sustainable development must be enshrined in efad and used more systematically and efficiently by all relevant eu institutions and all member states , including at the highest political level; ### 9. insists that mechanisms for ensuring policy coherence for sustainable development must be enshrined in efad by ensuring more ex-ante impact assessments and the establishment of an early warning system of policy incoherencies at the eu delegations and used more systematically and efficiently by all relevant eu institutions and all member states , including at the highest political level;


### 11. believes that the team europe approach should play a key role in further improving strategic cooperation and global coordination and the coherence and effectiveness of development efforts , especially at partner-country level , and believes that it has the potential to further identify key issues that need to be solved; ### 11. believes that the team europe approach should play a key role in further improving strategic cooperation and global coordination and the coherence and effectiveness of development efforts , especially at partner-country level , and believes that it has the potential to further identify key issues that need to be solved under efsd+/global europe; further insists on the appropriate implementation of the scrutiny mechanism for the european parliament to allow for the democratic legitimacy of team europe activities;


### 12. calls on the commission to put forward a powerful eu policy direction and to further align the eu development financial institutions’ activities within the new open architecture; is of the opinion that the programming process must fully cover the use of eu budgetary guarantees; ### 12. calls on the commission to put forward powerful eu development policies and to further align the eu development financial institutions’ activities within the new open architecture under nidici-global europe objectives;


### 13. calls on the commission to ensure that efad pursues the goal of restoring the multilateral development finance system in order to help put an end to the unsustainable lending practices of some countries operating outside that system; ### 13. calls on the commission to ensure that efad pursues the goal of restoring the multilateral development finance system in order to help put an end to the unsustainable lending practices of some countries operating outside that system; highlights that ldcs are unable to implement the sdgs without financial support and therefore strongly calls for debt relief measures in line with sustainability commitments;


### 14. considers eu taxonomy to be an important tool for achieving the sdgs and the objectives of the paris agreement; ### 14. considers the european green deal and its taxonomy for sustainable activities regarding renewable energy sources to be an important tool for achieving the sdgs related to climate change and the environment (e.g. 13 , 6 and 14 , 12) and the objectives of the paris agreement , since it should contribute to the reorientation of capital flows towards sustainable investments and introduce sustainability among the criteria to be taken into account for risk management;


### 15. reaffirms the european investment bank’s specific role – which is set out in article 209 of the treaty on the functioning of the european union and in article 36 of the ‘neighbourhood , development and international cooperation instrument – global europe’ – as the eu’s financial arm with a global reach; ### 15. reaffirms the european investment bank’s specific role within the eu and globally , which is set out in article 209 of the treaty on the functioning of the european union and in article 36 of the ‘neighbourhood , development and international cooperation instrument – global europe’;


### 16. recognises the eib’s flagship role in the european green deal and its substantial contribution to the eu’s economic response to the covid-19 pandemic; calls for the eu to further maximise the potential of the eib as a tool to leverage the eu’s strategic autonomy and promote its external policy interests and priorities in its relations with non-eu countries; ### 16. recognises the eib’s important role in the implementation of the european green deal and the eu’s economic response to the covid-19 pandemic; calls for the eu to exploit the potential of the eib as a tool to leverage the eu’s strategic autonomy and promote its external and development policy interests and priorities in its relations with non-eu countries


### 17. welcomes the setting-up of eib global , a dedicated development branch within the eib group , which has been operational since 1 january 2022; ### 17. welcomes the setting-up of eib global , a dedicated development branch within the eib group , which has been operational since 1 january 2022; calls for more clarity on budget provisions , organisational functioning and specific goals of the branch as well as its coordination mechanisms with other financial development institutions;


### 18. encourages the eib to continue to actively engage in developing planning , monitoring and evaluation at country level , hand in hand with the eu delegations and through co-financing with development finance institutions; ### 18. encourages the eib to continue to play its role in developing planning , monitoring and evaluation at country level , closely cooperating with the eu institutions and delegations and through co-financing with development finance institutions;


### 20. encourages the eib , the european bank for reconstruction and development and the european development banks and financial institutions to strengthen their cooperation; ### 20. encourages the eib , the european bank for reconstruction and development and the european development banks and financial institutions to strengthen their cooperation in the framework of ndici-global europe and its objectives , as well as in globally achieving the goals of the agenda 2030;


### 21. calls on the eib to work more closely with the african development bank to finance long-term investments that foster sustainable development; ### 21. calls on the eib to work more closely with the african development bank and establish a joint subsidiary to finance long-term investments that foster sustainable development and develop further sustainable growth opportunities for the african continent;


### 23. encourages sustained engagement by all development banks and institutions , and a more flexible approach to risk and return on investment; ### 23. encourages all development banks and institutions to make sustainable commitments and bold investments in line with development policy objectives , in particular the reduction of inequalities and the eradication of poverty , rather than in terms of return on investment;


### 24. recognises the importance and potential of member state development banks within the efad structure; stresses the pressing need to boost private sector development in sub-saharan africa; ### 24. recognises the importance and potential of member state development banks within the efad structure; stresses the important role that private sector development in sub-saharan africa can play for empowering partner countries to set themselves on a path to sustainable development;