### (55) this directive lays down a two-stage approach to incident reporting in order to strike the right balance between , on the one hand , swift reporting that helps mitigate the potential spread of incidents and allows entities to seek support , and , on the other hand , in-depth reporting that draws valuable lessons from individual incidents and improves over time the resilience to cyber threats of individual companies and entire sectors. where entities become aware of an incident , they should be required to submit an initial notification within 24 hours , followed by a final report not later than one month after. the initial notification should only include the information strictly necessary to make the competent authorities aware of the incident and allow the entity to seek assistance , if required. such notification , where applicable , should indicate whether the incident is presumably caused by unlawful or malicious action. member states should ensure that the requirement to submit this initial notification does not divert the reporting entity’s resources from activities related to incident handling that should be prioritised. to further prevent that incident reporting obligations either divert resources from incident response handling or may otherwise compromise the entities efforts in that respect , member states should also provide that , in duly justified cases and in agreement with the competent authorities or the csirt , the entity concerned can deviate from the deadlines of 24 hours for the initial notification and one month for the final report. ### (55) this directive lays down a three-stage approach to incident reporting in order to strike the right balance between , on the one hand , swift reporting that helps mitigate the potential spread of incidents and allows entities to seek support , and , on the other hand , in-depth reporting that draws valuable lessons from individual incidents and improves over time the resilience to cyber threats of individual companies and entire sectors. in this regard , the directive should also include reporting of incidents that , based on an initial assessment performed by the entity , may be assumed to lead to substantial operational disruption or financial losses or affect other natural or legal persons by causing considerable material or non-material losses. the initial assessment should take into account amongst others , the affected network and information systems and , in particular , their importance in the provision of the entity’s services , the severity and technical characteristics of the cyber threat , and any underlying vulnerabilities that are being exploited , as well as the entity’s experience with similar incidents. where entities become aware of an incident , they should provide an early warning within 24 hours , without any obligation to disclose additional information. entities should be required to submit an initial notification within 72 hours , followed by a comprehensive report not later than one month after the incident has been handled. the initial incident notification timeline of 72 hours should not preclude entities from reporting incidents earlier , therefore allowing entities to seek support from competent authorities or csirts swiftly , and enabling competent authorities or csirts to mitigate the potential spread of the reported incident. where an incident requires a longer period to be handled , an entity should be required to submit regular reports on the mitigation measures in place to contain , respond to , attribute and recover from the incident , and a comprehensive report not later than one month after the incident has been handled. the initial notification should allow the entity to seek assistance , if required. such notification , where applicable , should indicate whether the incident is presumably caused by unlawful or malicious action. member states should ensure that the requirement to submit this initial notification does not divert the reporting entity’s resources from activities related to incident handling that should be prioritised. to further prevent that incident reporting obligations either divert resources from incident response handling or may otherwise compromise the entities efforts in that respect , member states should also provide that , in duly justified cases and in agreement with the competent authorities or the csirt , the entity concerned can deviate from the deadlines of 72 hours for the initial notification and one month for the comprehensive report.


### (56) essential and important entities are often in a situation where a particular incident , because of its features , needs to be reported to various authorities as a result of notification obligations included in various legal instruments. such cases create additional burdens and may also lead to uncertainties with regard to the format and procedures of such notifications. in view of this and , for the purposes of simplifying the reporting of security incidents , member states should establish a single entry point for all notifications required under this directive and also under other union law such as regulation (eu) 2016/679 and directive 2002/58/ec. enisa , in cooperation with the cooperation group should develop common notification templates by means of guidelines that would simplify and streamline the reporting information requested by union law and decrease the burdens for companies. ### (56) essential and important entities are often in a situation where a particular incident , because of its features , needs to be reported to various authorities as a result of notification obligations included in various legal instruments. such cases create additional burdens and may also lead to uncertainties with regard to the format and procedures of such notifications. in view of this and , for the purposes of simplifying the reporting of security incidents and upholding the once-only principle , member states should establish a single entry point for all notifications required under this directive and also under other union law such as regulation (eu) 2016/679 and directive 2002/58/ec. enisa , in cooperation with the cooperation group should develop common notification templates by means of guidelines that would simplify and streamline the reporting information requested by union law and decrease the burdens for companies.


### (60) the availability and timely accessibility of these data to public authorities , including competent authorities under union or national law for the prevention , investigation or prosecution of criminal offences , certs , (csirts , and as regards the data of their clients to providers of electronic communications networks and services and providers of cybersecurity technologies and services acting on behalf of those clients , is essential to prevent and combat domain name system abuse , in particular to prevent , detect and respond to cybersecurity incidents. such access should comply with union data protection law insofar as it is related to personal data. ### (60) the availability and timely accessibility of the domain name registration data to legitimate access seekers is essential to protect the online ecosystem , prevent dns abuse , detect and prevent crime and fraud , protect minors , protect intellectual property , and protect against hate speech. for the purposes of this directive , legitimate access seekers are natural or legal persons making a justified request on the basis of a legitimate interest under union or national law to access dns data , and they may include competent authorities under union or national law for the prevention , investigation or prosecution of criminal offences , certs , csirts , and as regards the data of their clients , providers of electronic communications networks and services and providers of cybersecurity technologies. such access should comply with union data protection law insofar as it is related to personal data.


### (61) in order to ensure the availability of accurate and complete domain name registration data , tld registries and the entities providing domain name registration services for the tld (so-called registrars) should collect and guarantee the integrity and availability of domain names registration data. in particular , tld registries and the entities providing domain name registration services for the tld should establish policies and procedures to collect and maintain accurate and complete registration data , as well as to prevent and correct inaccurate registration data in accordance with union data protection rules. ### (61) in order to ensure the availability of accurate and complete domain name registration data , tld registries and the entities providing domain name registration services for the tld (so-called registrars) should collect and guarantee the integrity and availability of domain names registration data. in particular , tld registries and entities providing domain name registration services should establish policies and procedures to collect and maintain accurate and complete registration data , as well as to prevent and correct inaccurate registration data in accordance with union data protection rules.


### (62) tld registries and the entities providing domain name registration services for them should make publically available domain name registration data that fall outside the scope of union data protection rules , such as data that concern legal persons25 . tld registries and the entities providing domain name registration services for the tld should also enable lawful access to specific domain name registration data concerning natural persons to legitimate access seekers , in accordance with union data protection law. member states should ensure that tld registries and the entities providing domain name registration services for them should respond without undue delay to requests from legitimate access seekers for the disclosure of domain name registration data. tld registries and the entities providing domain name registration services for them should establish policies and procedures for the publication and disclosure of registration data , including service level agreements to deal with requests for access from legitimate access seekers. the access procedure may also include the use of an interface , portal or other technical tool to provide an efficient system for requesting and accessing registration data. with a view to promoting harmonised practices across the internal market , the commission may adopt guidelines on such procedures without prejudice to the competences of the european data protection board. ### (62) tld registries and entities providing domain name registration services should be required to make publically available domain name registration data of legal persons25. tld registries and entities providing domain name registration services should also enable lawful access to specific domain name registration data concerning natural persons to legitimate access seekers , in accordance with union data protection law. member states should ensure that tld registries and entities providing domain name registration services should respond within 72 hours to requests from legitimate access seekers for the disclosure of domain name registration data. tld registries and entities providing domain name registration services should establish policies and procedures for the publication and disclosure of registration data , including service level agreements to deal with requests for access from legitimate access seekers. the access procedure may also include the use of an interface , portal or other technical tool to provide an efficient system for requesting and accessing registration data. with a view to promoting harmonised practices across the internal market , the commission may adopt guidelines on such procedures without prejudice to the competences of the european data protection board.


### (69) the processing of personal data , to the extent strictly necessary and proportionate for the purposes of ensuring network and information security by entities , public authorities , certs , csirts , and providers of security technologies and services should constitute a legitimate interest of the data controller concerned , as referred to in regulation (eu) 2016/679. that should include measures related to the prevention , detection , analysis and response to incidents , measures to raise awareness in relation to specific cyber threats , exchange of information in the context of vulnerability remediation and coordinated disclosure , as well as the voluntary exchange of information on those incidents , as well as cyber threats and vulnerabilities , indicators of compromise , tactics , techniques and procedures , cybersecurity alerts and configuration tools. such measures may require the processing of the following types of personal data: ip addresses , uniform resources locators (urls) , domain names , and email addresses. ### (69) the processing of personal data , to the extent strictly necessary and proportionate for the purposes of ensuring network and information security by essential and important entities , public authorities , certs , csirts , and providers of security technologies and services is necessary to comply with a legal obligation under this directive and constitutes a legitimate interest of the data controller concerned , as referred to in point (c) paragraph 1 , and point (f) paragraph 1 respectively of article 6 of regulation (eu) 2016/679. that should include measures related to the prevention , detection , analysis and response to incidents , measures to raise awareness in relation to specific cyber threats , exchange of information in the context of vulnerability remediation and coordinated disclosure , as well as the voluntary exchange of information on those incidents , as well as cyber threats and vulnerabilities , indicators of compromise , tactics , techniques and procedures , cybersecurity alerts and configuration tools. such measures may require the processing of the following types of personal data: ip addresses , uniform resources locators (urls) , domain names , and email addresses.


### (76) in order to further strengthen the effectiveness and dissuasiveness of the penalties applicable to infringements of obligations laid down pursuant to this directive , the competent authorities should be empowered to apply sanctions consisting of the suspension of a certification or authorisation concerning part or all the services provided by an essential entity and the imposition of a temporary ban from the exercise of managerial functions by a natural person. given their severity and impact on the entities’ activities and ultimately on their consumers , such sanctions should only be applied proportionally to the severity of the infringement and taking account of the specific circumstances of each case , including the intentional or negligent character of the infringement , actions taken to prevent or mitigate the damage and/or losses suffered. such sanctions should only be applied as ultima ratio , meaning only after the other relevant enforcement actions laid down by this directive have been exhausted , and only for the time until the entities to which they apply take the necessary action to remedy the deficiencies or comply with the requirements of the competent authority for which such sanctions were applied. the imposition of such sanctions shall be subject to appropriate procedural safeguards in accordance with the general principles of union law and the charter of fundamental rights of the european union , including effective judicial protection , due process , presumption of innocence and right of defence. ### (76) in order to further strengthen the effectiveness and dissuasiveness of the penalties applicable to infringements of obligations laid down pursuant to this directive , the competent authorities should be empowered to apply sanctions consisting of , where applicable , the temporary suspension of a certification or authorisation concerning part or all the services provided by an essential entity , and the imposition of a temporary against any person discharging managerial responsibilities at chief executive officer or legal representative level in that essential entity from exercising managerial functions in that entity. this provision shall not apply to public administration entities as referred to in this directive. given their severity and impact on the entities’ activities and ultimately on their consumers , such sanctions should only be applied proportionally to the severity of the infringement and taking account of the specific circumstances of each case , including the intentional or negligent character of the infringement , actions taken to prevent or mitigate the damage and/or losses suffered. such sanctions should only be applied as ultima ratio , meaning only after the other relevant enforcement actions laid down by this directive have been exhausted , and only for the time until the entities to which they apply take the necessary action to remedy the deficiencies or comply with the requirements of the competent authority for which such sanctions were applied. the imposition of such sanctions shall be subject to appropriate procedural safeguards in accordance with the general principles of union law and the charter of fundamental rights of the european union , including effective judicial protection , due process , presumption of innocence and right of defence.


### (79) a peer-review mechanism should be introduced , allowing the assessment by experts designated by the member states of the implementation of cybersecurity policies , including the level of member states’ capabilities and available resources. ### (79) a peer-review mechanism should be introduced , allowing the assessment by experts designated by the member states and enisa of the implementation of cybersecurity policies , including the level of member states’ capabilities and available resources , and the exchange of experiences and best practices related to procedures and instruments.


### (79) a peer-review mechanism should be introduced , allowing the assessment by experts designated by the member states of the implementation of cybersecurity policies , including the level of member states’ capabilities and available resources. ### (79) a peer-review mechanism should be introduced , allowing the assessment by experts designated by the member states and enisa of the implementation of cybersecurity policies , including the level of member states’ capabilities and available resources , and provide an effective path for the transfer of cybersecurity-enhancing technologies , mechanisms and processes between and among competent authorities or csirts.


### 1. this directive lays down measures with a view to ensuring a high common level of cybersecurity within the union. ### 1. this directive lays down measures with a view to ensuring a high common level of cybersecurity within the union and strengthening the digital single market.


### (4) ‘national strategy on cybersecurity’ means a coherent framework of a member state providing strategic objectives and priorities on the security of network and information systems in that member state; ### (4) ‘national strategy on cybersecurity’ means a coherent framework of a member state providing strategic objectives and priorities on the security of network and information systems in that member state , as well as policies needed to achieve them;


### a governance framework to achieve those objectives and priorities , including the policies referred to in paragraph 2 and the roles and responsibilities of public bodies and entities as well as other relevant actors; ### a governance framework to achieve those objectives and priorities , including the policies referred to in paragraph 2 and the roles and responsibilities of public bodies and entities as well as other relevant actors , including those responsible for cyber intelligence and cyber defence;


### a governance framework to achieve those objectives and priorities , including the policies referred to in paragraph 2 and the roles and responsibilities of public bodies and entities as well as other relevant actors; ### a governance framework to achieve those objectives and priorities , including the policies referred to in paragraph 2 , and an appropriate framework defining the roles and responsibilities of public bodies and entities as well as other relevant actors , underpinning the cooperation and coordination , at the national level , between the competent authorities designated under articles 7(1) and 8(1) , the single point of contact designated under article 8(3) , and the csirts designated under article 9;


### an assessment to identify relevant assets and cybersecurity risks in that member state; ### an assessment to identify relevant assets and cybersecurity risks in that member state , including potential shortages that may negatively impact the single market.


### a policy on promoting and developing cybersecurity skills , awareness raising and research and development initiatives; ### a policy on promoting and enhancing cybersecurity skills and competence across all levels , from the non-experts to the highly skilled professionals;


### a policy on promoting and developing cybersecurity skills , awareness raising and research and development initiatives; ### a policy on promoting and developing cybersecurity skills , awareness raising and research and development initiatives , including targeted policies addressing issues relating to gender representation and balance in the aforementioned areas;


### a policy on supporting academic and research institutions to develop cybersecurity tools and secure network infrastructure; ### a policy on supporting academic and research institutions to develop cybersecurity tools and secure network infrastructure and promoting the coherent and synergic use of available funds;


### a policy addressing specific needs of smes , in particular those excluded from the scope of this directive , in relation to guidance and support in improving their resilience to cybersecurity threats. ### a policy addressing specific needs of smes , in particular those excluded from the scope of this directive , in relation to guidance and support in improving their resilience to cybersecurity threats , promotion of cybersecurity skills and competences , and assistance in responding to cyberattacks;


### 2. enisa shall develop and maintain a european vulnerability registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures with a view in particular to enabling important and essential entities and their suppliers of network and information systems to disclose and register vulnerabilities present in ict products or ict services , as well as to provide access to the information on vulnerabilities contained in the registry to all interested parties. the registry shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , the availability of related patches and , in the absence of available patches , guidance addressed to users of vulnerable products and services as to how the risks resulting from disclosed vulnerabilities may be mitigated. ### 2. enisa shall develop and maintain a european vulnerability registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures with a view in particular to enabling important and essential entities and their suppliers of network and information systems to disclose and register vulnerabilities present in ict products or ict services , as well as to provide access to the information on vulnerabilities contained in the registry to all interested parties. the registry shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , the availability of related patches and , in the absence of available patches , guidance addressed to users of vulnerable products and services as to how the risks resulting from disclosed vulnerabilities may be mitigated. enisa may enter into information sharing agreements and structured cooperation with other vulnerability registries developed and maintained by trusted partners.


### 2. enisa shall develop and maintain a european vulnerability registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures with a view in particular to enabling important and essential entities and their suppliers of network and information systems to disclose and register vulnerabilities present in ict products or ict services , as well as to provide access to the information on vulnerabilities contained in the registry to all interested parties. the registry shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , the availability of related patches and , in the absence of available patches , guidance addressed to users of vulnerable products and services as to how the risks resulting from disclosed vulnerabilities may be mitigated. ### 2. enisa shall develop and maintain a european vulnerability registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures , and the necessary technical and organisational measures to ensure the security and integrity of the registry , with a view in particular to enabling important and essential entities and their suppliers of network and information systems , as well as entities excluded from the scope of this directive , and their suppliers , to disclose and register vulnerabilities present in ict products or ict services , as well as to provide access to the information on vulnerabilities contained in the registry to all interested parties , enabling all parties and in particular , the users of the ict products or ict services concerned to adopt appropriate mitigating measures. the registry shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , and the availability of related patches.


### responding to incidents; ### responding to incidents and , whenever possible and adequate , providing assistance to entities that may request it;


### providing dynamic risk and incident analysis and situational awareness regarding cybersecurity; ### providing dynamic risk and incident analysis and situational awareness regarding cybersecurity , namely through the analysis of early warnings and notifications as referred to in article 20;


### participating in the csirts network and providing mutual assistance to other members of the network upon their request. ### actively participating in the csirts network and providing mutual assistance to other members of the network upon their request.


### 2. member states shall ensure that either their competent authorities or their csirts receive notifications on incidents , and significant cyber threats and near misses submitted pursuant to this directive. where a member state decides that its csirts shall not receive those notifications , the csirts shall , to the extent necessary to carry out their tasks , be granted access to data on incidents notified by the essential or important entities , pursuant to article 20. ### 2. member states shall ensure that either their competent authorities or their csirts receive notifications on incidents , and significant cyber threats and near misses submitted pursuant to this directive. where a member state decides that its csirts shall not receive those notifications , the csirts shall , to the extent necessary to effectively carry out their tasks , be granted adequate access to data on incidents notified by the essential or important entities , pursuant to article 20.


### 4. to the extent necessary to effectively carry out the tasks and obligations laid down in this directive , member states shall ensure appropriate cooperation between the competent authorities and single points of contact and law enforcement authorities , data protection authorities , and the authorities responsible for critical infrastructure pursuant to directive (eu) xxxx/xxxx [resilience of critical entities directive] and the national financial authorities designated in accordance with regulation (eu) xxxx/xxxx of the european parliament and of the council39 [the dora regulation] within that member state. ### 4. to the extent necessary to effectively carry out the tasks and obligations laid down in this directive , member states shall ensure appropriate cooperation between the competent authorities and single points of contact and law enforcement authorities , data protection authorities , and the authorities responsible for critical infrastructure pursuant to directive (eu) xxxx/xxxx [resilience of critical entities directive] and the national financial authorities designated in accordance with regulation (eu) xxxx/xxxx of the european parliament and of the council39 [the dora regulation] within that member state , as well as with cyber defence and cyber intelligence authorities.


### increasing the level of preparedness of the management of large scale incidents and crises; ### increasing the level of preparedness of the management of large scale incidents and crises , including cross-border cyber threats;


### 1. enisa shall issue , in cooperation with the commission , a biennial report on the state of cybersecurity in the union. the report shall in particular include an assessment of the following: ### 1. enisa shall issue , in cooperation with the commission , a biennial report on the state of cybersecurity in the union and present it to the european parliament. the report shall in particular include an assessment of the following:


### the development of cybersecurity capabilities across the union; ### the development of cybersecurity capabilities across the union , including the general level of skills and competences in cybersecurity in the digital single market;


### 1. the commission shall establish , after consulting the cooperation group and enisa , and at the latest by 18 months following the entry into force of this directive , the methodology and content of a peer-review system for assessing the effectiveness of the member states’ cybersecurity policies. the reviews shall be conducted by cybersecurity technical experts drawn from member states different than the one reviewed and shall cover at least the following: ### 1. the commission shall establish , after consulting the cooperation group and enisa , and at the latest by 18 months following the entry into force of this directive , the methodology and content of a peer-review system for assessing the effectiveness of the member states’ cybersecurity policies. the reviews shall be conducted by cybersecurity technical experts drawn from enisa and several member states different than the one reviewed , and shall cover at least the following:


### 1. the commission shall establish , after consulting the cooperation group and enisa , and at the latest by 18 months following the entry into force of this directive , the methodology and content of a peer-review system for assessing the effectiveness of the member states’ cybersecurity policies. the reviews shall be conducted by cybersecurity technical experts drawn from member states different than the one reviewed and shall cover at least the following: ### 1. the commission shall establish , after consulting the cooperation group and enisa , and at the latest by 18 months following the entry into force of this directive , the methodology and content of a peer-review system for assessing the effectiveness of the member states’ cybersecurity policies. enisa shall develop templates for the self-assessment of the reviewed aspects , which member states being reviewed shall complete and provide to designated experts prior to the commencement of the peer-review process. the reviews shall be conducted by cybersecurity technical experts drawn from enisa and at least two member states different than the one reviewed and shall cover at least the following:


### 2. the methodology shall include objective , non-discriminatory , fair and transparent criteria on the basis of which the member states shall designate experts eligible to carry out the peer reviews. enisa and the commission shall designate experts to participate as observers in the peer-reviews. the commission , supported by enisa , shall establish within the methodology as referred to in paragraph 1 an objective , non-discriminatory , fair and transparent system for the selection and the random allocation of experts for each peer review. ### 2. the methodology shall include objective , non-discriminatory , fair and transparent criteria on the basis of which the member states shall designate experts eligible to carry out the peer reviews. the commission , supported by enisa , shall develop appropriate codes of conduct underpinning the work methods of designated experts participating in peer-reviews to safeguard the confidentiality of information obtained through the peer-review process , and the non-disclosure of such information to any third parties. enisa and the commission shall designate experts to participate as observers in the peer-reviews. the commission , supported by enisa , shall establish within the methodology as referred to in paragraph 1 an objective , non-discriminatory , fair and transparent system for the selection and the random allocation of experts for each peer review.


### 7. experts participating in peer reviews shall draft reports on the findings and conclusions of the reviews. the reports shall be submitted to the commission , the cooperation group , the csirts network and enisa. the reports shall be discussed in the cooperation group and the csirts network. the reports may be published on the dedicated website of the cooperation group. ### 7. experts participating in peer reviews shall draft reports on the findings and conclusions of the reviews. the reports shall be submitted to the commission , the cooperation group , the csirts network and enisa. the reports shall be discussed in the cooperation group and the csirts network.


### 7. experts participating in peer reviews shall draft reports on the findings and conclusions of the reviews. the reports shall be submitted to the commission , the cooperation group , the csirts network and enisa. the reports shall be discussed in the cooperation group and the csirts network. the reports may be published on the dedicated website of the cooperation group. ### 7. experts participating in peer reviews shall draft reports on the findings and conclusions of the reviews. the reports shall include recommendations to enable improvement on the aspects covered by the peer-review process , including recommendations on the transfer of technologies , tools , measures , and processes from member states carrying out the peer-review to the member state being reviewed. the reports shall be submitted to the commission , the cooperation group , the csirts network and enisa. the reports shall be discussed in the cooperation group and the csirts network. the reports may be published on the dedicated website of the cooperation group.


### 1. member states shall ensure that essential and important entities shall take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which those entities use in the provision of their services. having regard to the state of the art , those measures shall ensure a level of security of network and information systems appropriate to the risk presented. ### 1. member states shall ensure that essential and important entities shall take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which those entities use in the provision of their services. having regard to the state of the art , those measures shall ensure a level of security of network and information systems appropriate to the risk presented. in particular , measures shall be taken to prevent and minimise the impact of security incidents on consumers.


### 1. member states shall ensure that essential and important entities shall take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which those entities use in the provision of their services. having regard to the state of the art , those measures shall ensure a level of security of network and information systems appropriate to the risk presented. ### 1. member states shall ensure that essential and important entities take appropriate and proportionate technical , operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services. having regard to the state of the art , those measures shall ensure a level of security of network and information systems appropriate to the risk presented.


### 3. member states shall ensure that , where considering appropriate measures referred to in point (d) of paragraph 2 , entities shall take into account the vulnerabilities specific to each supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers , including their secure development procedures. ### 3. member states shall ensure that , where considering appropriate measures referred to in point (d) of paragraph 2 , entities shall take into account the overall quality of products and cybersecurity practices of their suppliers and service providers , including their secure development procedures.


### 1. the cooperation group , in cooperation with the commission and enisa , may carry out coordinated security risk assessments of specific critical ict services , systems or products supply chains , taking into account technical and , where relevant , non-technical risk factors. ### 1. the cooperation group , in cooperation with the commission and enisa , shall carry out coordinated security risk assessments of specific critical ict services , systems or products supply chains , taking into account technical and , where relevant , non-technical risk factors.


### 1. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt in accordance with paragraphs 3 and 4 of any incident having a significant impact on the provision of their services. where appropriate , those entities shall notify , without undue delay , the recipients of their services of incidents that are likely to adversely affect the provision of that service. member states shall ensure that those entities report , among others , any information enabling the competent authorities or the csirt to determine any cross-border impact of the incident. ### 1. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt in accordance with paragraphs 3 and 4 of any incident having a significant impact on the provision of their services. those entities shall notify , without undue delay , the recipients of their services of incidents that are likely to adversely affect the provision of that service. member states shall ensure that those entities report , among others , any information enabling the competent authorities or the csirt to determine any cross-border impact of the incident.


### 1. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt in accordance with paragraphs 3 and 4 of any incident having a significant impact on the provision of their services. where appropriate , those entities shall notify , without undue delay , the recipients of their services of incidents that are likely to adversely affect the provision of that service. member states shall ensure that those entities report , among others , any information enabling the competent authorities or the csirt to determine any cross-border impact of the incident. ### 1. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt in accordance with paragraphs 2 and 3 of any incident having a significant impact. where the incident concerns the provisions of entities’ services , those entities shall notify affected users about the unavailability or underlying risks of use of the service in order to mitigate the adverse effects of the incident. essential and important entities may deviate from notifying affected users in case of overriding reasons inducing , but not limited to , that notification worsening the impact of an ongoing incident. member states shall ensure that those entities report , among others , any information enabling the competent authorities or the csirt to determine any cross-border impact of the incident. the notification shall not make the notifying entity subject to increased liability.


### 2. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt of any significant cyber threat that those entities identify that could have potentially resulted in a significant incident. ### deleted


### the incident has caused or has the potential to cause substantial operational disruption or financial losses for the entity concerned; ### the incident has caused or it can be assumed to cause substantial operational disruption or financial losses for the entity concerned;


### the incident has affected or has the potential to affect other natural or legal persons by causing considerable material or non-material losses. ### the incident has affected or it can be assumed to affect other natural or legal persons by causing considerable material or non-material losses.


### without undue delay and in any event within 24 hours after having become aware of the incident , an initial notification , which , where applicable , shall indicate whether the incident is presumably caused by unlawful or malicious action; ### without undue delay and in any event within 72 hours after having become aware of the incident , an initial notification , which , where applicable , shall indicate whether the incident is presumably caused by unlawful or malicious action;


### a final report not later than one month after the submission of the report under point (a) , including at least the following: ### a comprehensive report not later than one month after the submission of the report under point (b) , including at least the following:


### a final report not later than one month after the submission of the report under point (a) , including at least the following: ### a comprehensive report not later than one month after the submission of the report under point(a) , including at least the following:


### member states shall provide that in duly justified cases and in agreement with the competent authorities or the csirt , the entity concerned can deviate from the deadlines laid down in points (a) and (c). ### member states shall provide that in duly justified cases and in agreement with the competent authorities or the csirt , the entity concerned can deviate from the deadlines laid down in points (a) , (b) and (d).


### 5. the competent national authorities or the csirt shall provide , within 24 hours after receiving the initial notification referred to in point (a) of paragraph 4 , a response to the notifying entity , including initial feedback on the incident and , upon request of the entity , guidance on the implementation of possible mitigation measures. where the csirt did not receive the notification referred to in paragraph 1 , the guidance shall be provided by the competent authority in collaboration with the csirt. the csirt shall provide additional technical support if the concerned entity so requests. where the incident is suspected to be of criminal nature , the competent national authorities or the csirt shall also provide guidance on reporting the incident to law enforcement authorities. ### 5. the competent national authorities or the csirt shall provide , within 24 hours after receiving the initial notification referred to in point (b) of paragraph 4 , a response to the notifying entity , including initial feedback on the incident and , upon request of the entity , guidance on the implementation of possible mitigation measures. where the csirt did not receive the notification referred to in paragraph 1 , the guidance shall be provided by the competent authority in collaboration with the csirt. the csirt shall provide additional technical support if the concerned entity so requests. where the incident is suspected to be of criminal nature , the competent national authorities or the csirt shall also provide guidance on reporting the incident to law enforcement authorities.


### 5. the competent national authorities or the csirt shall provide , within 24 hours after receiving the initial notification referred to in point (a) of paragraph 4 , a response to the notifying entity , including initial feedback on the incident and , upon request of the entity , guidance on the implementation of possible mitigation measures. where the csirt did not receive the notification referred to in paragraph 1 , the guidance shall be provided by the competent authority in collaboration with the csirt. the csirt shall provide additional technical support if the concerned entity so requests. where the incident is suspected to be of criminal nature , the competent national authorities or the csirt shall also provide guidance on reporting the incident to law enforcement authorities. ### 5. the competent national authorities or the csirt shall provide , within 72 hours after receiving the initial notification referred to in point (a) of paragraph 4 , a response to the notifying entity , including initial feedback on the incident and , upon request of the entity , guidance on the implementation of possible mitigation measures. where the csirt did not receive the notification referred to in paragraph 1 , the guidance shall be provided by the competent authority in collaboration with the csirt. the csirt shall provide additional technical support if the concerned entity so requests. where the incident is suspected to be of criminal nature , the competent national authorities or the csirt shall also provide guidance on reporting the incident to law enforcement authorities.


### 5. the competent national authorities or the csirt shall provide , within 24 hours after receiving the initial notification referred to in point (a) of paragraph 4 , a response to the notifying entity , including initial feedback on the incident and , upon request of the entity , guidance on the implementation of possible mitigation measures. where the csirt did not receive the notification referred to in paragraph 1 , the guidance shall be provided by the competent authority in collaboration with the csirt. the csirt shall provide additional technical support if the concerned entity so requests. where the incident is suspected to be of criminal nature , the competent national authorities or the csirt shall also provide guidance on reporting the incident to law enforcement authorities. ### 5. the competent national authorities or the csirt shall provide , within 24 hours after receiving the initial notification referred to in point (b) of paragraph 3 , a response to the notifying entity , including initial feedback on the incident and , upon request of the entity , guidance on the implementation of possible mitigation measures. where the csirt did not receive the notification referred to in paragraph 1 , the guidance shall be provided by the competent authority in collaboration with the csirt. the csirt shall provide additional technical support if the concerned entity so requests. where the incident is suspected to be of criminal nature , the competent national authorities or the csirt shall also provide guidance on reporting the incident to law enforcement authorities.


### 1. in order to demonstrate compliance with certain requirements of article 18 , member states may require essential and important entities to certify certain ict products , ict services and ict processes under specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881. the products , services and processes subject to certification may be developed by an essential or important entity or procured from third parties. ### 1. in order to demonstrate compliance with certain requirements of article 18 , and following guidance from enisa , the commission , and the cooperation group , member states shall call for essential and important entities to certify certain ict products , ict services and ict processes , developed either by the essential and important entities or procured from third parties , under specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881 , or under equivalent and internationally accepted certification schemes. whenever possible , the call for certification shall be adopted by all member states in a harmonised way.


### 1. in order to demonstrate compliance with certain requirements of article 18 , member states may require essential and important entities to certify certain ict products , ict services and ict processes under specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881. the products , services and processes subject to certification may be developed by an essential or important entity or procured from third parties. ### 1. in order to elevate the overall level of cybersecurity resilience , the commission may issue a legislative proposal under article 114 tfeu requiring certain essential and important entities to certify certain ict products , ict services and ict processes under existing specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881. the products , services and processes subject to certification may be developed by an essential or important entity or procured from third parties. such certification requirements shall foresee a transition period that allows providers and end users to get into conformity , and they shall be developed in a way that avoids market distortion.


### 1. in order to demonstrate compliance with certain requirements of article 18 , member states may require essential and important entities to certify certain ict products , ict services and ict processes under specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881. the products , services and processes subject to certification may be developed by an essential or important entity or procured from third parties. ### 1. in order to demonstrate compliance with certain requirements of article 18 , and following guidance from enisa , the commission , and the cooperation group , member states shall encourage essential and important entities to certify certain ict products , ict services and ict processes , developed either by the essential and important entities or procured from third parties , under specific european cybersecurity certification schemes adopted pursuant to article 49 of regulation (eu) 2019/881 , or under equivalent and internationally accepted certification schemes.


### 2. the commission shall be empowered to adopt delegated acts specifying which categories of essential entities shall be required to obtain a certificate and under which specific european cybersecurity certification schemes pursuant to paragraph 1. the delegated acts shall be adopted in accordance with article 36. ### deleted


### 3. the commission may request enisa to prepare a candidate scheme pursuant to article 48(2) of regulation (eu) 2019/881 in cases where no appropriate european cybersecurity certification scheme for the purposes of paragraph 2 is available. ### 3. in order to elevate the overall level of cybersecurity resilience , the commission may request enisa to prepare a candidate scheme pursuant to article 47 and article 48 of regulation (eu) 2019/881 in cases where no appropriate european cybersecurity certification scheme is available. such candidate schemes shall comply with the requirements laid down in article 56(2)and article 56(3) of regulation (eu) 2019/881.


### 1. in order to promote the convergent implementation of article 18(1) and (2) , member states shall , without imposing or discriminating in favour of the use of a particular type of technology , encourage the use of european or internationally accepted standards and specifications relevant to the security of network and information systems. ### 1. in order to promote the convergent implementation of article 18(1) and (2) , member states shall , without imposing or discriminating in favour of the use of a particular type of technology , and according to guidance from enisa and the cooperation group , encourage the use of european or internationally accepted standards and specifications relevant to the security of network and information systems.


### 1. for the purpose of contributing to the security , stability and resilience of the dns , member states shall ensure that tld registries and the entities providing domain name registration services for the tld shall collect and maintain accurate and complete domain name registration data in a dedicated database facility with due diligence subject to union data protection law as regards data which are personal data. ### 1. for the purpose of contributing to the security , stability and resilience of the dns , member states shall ensure that tld registries and entities providing domain name registration services shall collect and maintain accurate and complete domain name registration data in a dedicated database.


### 4. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld publish , without undue delay after the registration of a domain name , domain registration data which are not personal data. ### 4. member states shall ensure that tld registries and entities providing domain name registration services make publicly available , within 72 hours after the registration of a domain name , domain registration data of legal persons as registrants.


### 5. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld provide access to specific domain name registration data upon lawful and duly justified requests of legitimate access seekers , in compliance with union data protection law. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld reply without undue delay to all requests for access. member states shall ensure that policies and procedures to disclose such data are made publicly available. ### 5. member states shall ensure that tld registries and entities providing domain name registration services provide access to specific domain name registration data , including personal data , upon duly justified requests of legitimate access seekers , in compliance with union data protection law. member states shall ensure that the tld registries and entities providing domain name registration services reply within 72 hours to all requests for access. member states shall ensure that policies and procedures to disclose such data are made publicly available. the commission may adopt implementing acts laying out the requirements to be demonstrated by legitimate access seekers to tld registries and entities providing domain name registration services before access to specific domain name registration data is granted. those implementing acts shall be adopted in accordance with the examination procedure referred to in article 37(2).


### 2. for the purposes of this directive , entities referred to in paragraph 1 shall be deemed to have their main establishment in the union in the member state where the decisions related to the cybersecurity risk management measures are taken. if such decisions are not taken in any establishment in the union , the main establishment shall be deemed to be in the member state where the entities have the establishment with the highest number of employees in the union. ### 2. for the purposes of this directive , entities referred to in paragraph 1 shall be deemed to have their main establishment in the union in the member state where the decisions related to the cybersecurity risk management measures are taken , or where cybersecurity operations are carried out. if such decisions are not taken in any establishment in the union , the main establishment shall be deemed to be in the member state where the entities have the establishment with the highest number of employees in the union.


### 1. enisa shall create and maintain a registry for essential and important entities referred to in article 24(1). the entities shall submit the following information to enisa by [12 months after entering into force of the directive at the latest]: ### 1. enisa shall create and maintain a registry for essential and important entities referred to in article 24(1). for that purpose the entities shall submit the following information to the national competent authority by [12 months after entering into force of the directive at the latest]:


### 1. enisa shall create and maintain a registry for essential and important entities referred to in article 24(1). the entities shall submit the following information to enisa by [12 months after entering into force of the directive at the latest]: ### 1. enisa shall create and maintain a registry for essential and important entities referred to in article 24(1). enisa shall establish appropriate information classification and management protocols to ensure the security and confidentiality of disclosed information , and restrict the access , storage , and transmission of such information to intended users. the entities shall submit the following information to enisa by [12 months after entering into force of the directive at the latest]:


### 2. the entities referred to in paragraph 1 shall notify enisa about any changes to the details they submitted under paragraph 1 without delay , and in any event , within three months from the date on which the change took effect. ### 2. the entities referred to in paragraph 1 shall notify the national competent authority about any changes to the details they submitted under paragraph 1 without delay , and in any event , within three months from the date on which the change took effect.


### 3. upon receipt of the information under paragraph 1 , enisa shall forward it to the single points of contact depending on the indicated location of each entity’s main establishment or , if it is not established in the union , of its designated representative. where an entity referred to in paragraph 1 has besides its main establishment in the union further establishments in other member states , enisa shall also inform the single points of contact of those member states. ### 3. upon receipt of the information under paragraph 1 , the national competent authorities shall forward it to enisa. where an entity referred to in paragraph 1 has besides its main establishment in the union further establishments in other member states , enisa shall also inform the single points of contact of those member states.


### 2. member states shall ensure that the exchange of information takes place within trusted communities of essential and important entities. such exchange shall be implemented through information sharing arrangements in respect of the potentially sensitive nature of the information shared and in compliance with the rules of union law referred to in paragraph 1. ### 2. member states shall facilitate the exchange of information by enabling the establishment of trusted communities of essential and important entities. such exchange shall be implemented through information sharing arrangements in respect of the potentially sensitive nature of the information shared.


### 3. member states shall set out rules specifying the procedure , operational elements (including the use of dedicated ict platforms) , content and conditions of the information sharing arrangements referred to in paragraph 2. such rules shall also lay down the details of the involvement of public authorities in such arrangements , as well as operational elements , including the use of dedicated it platforms. member states shall offer support to the application of such arrangements in accordance with their policies referred to in article 5(2) (g). ### 3. member states shall facilitate information sharing by making operational elements (including the use of dedicated ict platforms) , and content available of the information sharing arrangements referred to in paragraph 2 , and may impose certain conditions on the information made available by competent authorities or csirts. member states shall also lay down the details of the involvement of public authorities in such arrangements , as well as operational elements , including the use of dedicated it platforms. member states shall offer support to the application of such arrangements in accordance with their policies referred to in article 5(2)(l).


### member states shall ensure that , without prejudice to article 3 , entities falling outside the scope of this directive may submit notifications , on a voluntary basis , of significant incidents , cyber threats or near misses. when processing notifications , member states shall act in accordance with the procedure laid down in article 20. member states may prioritise the processing of mandatory notifications over voluntary notifications. voluntary reporting shall not result in the imposition of any additional obligations upon the reporting entity to which it would not have been subject had it not submitted the notification. ### member states shall ensure that , without prejudice to article 3 , entities falling outside the scope of this directive may submit notifications , on a voluntary basis , of significant incidents , cyber threats or near misses. when processing notifications , member states shall act in accordance with the procedure laid down in article 20. member states shall prioritise the processing of mandatory notifications over voluntary notifications. voluntary reporting shall not result in the imposition of any additional obligations upon the reporting entity to which it would not have been subject had it not submitted the notification , but it may grant it assistance from csirts.


### 1. member states shall ensure that competent authorities effectively monitor and take the measures necessary to ensure compliance with this directive , in particular the obligations laid down in articles 18 and 20. ### 1. member states shall ensure that competent authorities effectively monitor and take the measures necessary to ensure compliance with this directive , in particular the obligations laid down in articles 18 and 20 , and are provided with the adequate means to perform their function.


### 2. competent authorities shall work in close cooperation with data protection authorities when addressing incidents resulting in personal data breaches. ### 2. competent authorities shall work in close cooperation with data protection authorities when addressing incidents resulting in personal data breaches , including data protection authorities from other member states whenever relevant.


### targeted security audits based on risk assessments or risk-related available information; ### targeted security audits based on risk assessments performed by the competent authorities , risk assessments performed by the audited entity , or in the absence thereof , risk-related available information;


### impose or request the imposition by the relevant bodies or courts according to national laws of a temporary ban against any person discharging managerial responsibilities at chief executive officer or legal representative level in that essential entity , and of any other natural person held responsible for the breach , from exercising managerial functions in that entity. ### impose or request the imposition by the relevant bodies or courts according to national laws of a temporary ban against any person discharging managerial responsibilities at chief executive officer or legal representative level in that essential entity from exercising managerial functions in that entity. this provision shall not apply to public administration entities as referred to in point (23) of article 4.


### targeted security audits based on risk assessments or risk-related available information; ### targeted security audits based on risk assessments performed by the competent authority , risk assessments performed by the audited entity , or in the absence thereof , risk-related available information;


### 1. where the competent authorities have indications that the infringement by an essential or important entity of the obligations laid down in articles 18 and 20 entails a personal data breach , as defined by article 4(12) of regulation (eu) 2016/679 which shall be notified pursuant to article 33 of that regulation , they shall inform the supervisory authorities competent pursuant to articles 55 and 56 of that regulation within a reasonable period of time. ### 1. where the competent authorities have indications that the infringement by an essential or important entity of the obligations laid down in articles 18 and 20 entails a personal data breach , as defined by article 4(12) of regulation (eu) 2016/679 which shall be notified pursuant to article 33 of that regulation , they shall inform the supervisory authorities competent pursuant to articles 55 and 56 of that regulation without undue delay.


### 1. where the competent authorities have indications that the infringement by an essential or important entity of the obligations laid down in articles 18 and 20 entails a personal data breach , as defined by article 4(12) of regulation (eu) 2016/679 which shall be notified pursuant to article 33 of that regulation , they shall inform the supervisory authorities competent pursuant to articles 55 and 56 of that regulation within a reasonable period of time. ### 1. where the competent authorities have indications that the infringement by an essential or important entity of the obligations laid down in articles 18 and 20 entails a personal data breach , as defined by article 4(12) of regulation(eu) 2016/679 which shall be notified pursuant to article 33 of that regulation , they shall inform the supervisory authorities competent pursuant to articles 55 and 56 of that regulation without undue delay.


### 3. where the supervisory authority competent pursuant to regulation (eu) 2016/679 is established in another member state than the competent authority , the competent authority may inform the supervisory authority established in the same member state. ### 3. where the supervisory authority competent pursuant to regulation (eu) 2016/679 is established in another member state than the competent authority , the competent authority shall also inform the supervisory authority established in the same member state.


### (3) network and information systems have developed into a central feature of everyday life with the speedy digital transformation and interconnectedness of society , including in cross-border exchanges. that development has led to an expansion of the cybersecurity threat landscape , bringing about new challenges , which require adapted , coordinated and innovative responses in all member states. the number , magnitude , sophistication , frequency and impact of cybersecurity incidents are increasing , and present a major threat to the functioning of network and information systems. as a result , cyber incidents can impede the pursuit of economic activities in the internal market , generate financial losses , undermine user confidence and cause major damage to the union economy and society. cybersecurity preparedness and effectiveness are therefore now more essential than ever to the proper functioning of the internal market. ### (3) network and information systems have developed into a central feature of everyday life with the speedy digital transformation and interconnectedness of society , including in cross-border exchanges. that development has led to an expansion of the cybersecurity threat landscape , bringing about new challenges , which require adapted , coordinated and innovative responses in all member states. the number , magnitude , sophistication , frequency and impact of cybersecurity incidents are increasing , and present a major threat to the functioning of network and information systems. as a result , cyber incidents can impede the pursuit of economic activities in the internal market , generate financial losses , undermine user confidence and cause major damage to the union economy and society. cybersecurity preparedness and effectiveness are therefore now more essential than ever to the proper functioning of the internal market. malicious cyber activities threaten not only our economies , but also the functioning of our democracies , our freedom and our values. our future security depends on transforming our capacity to protect the eu against cybersecurity threats both within the civilian infrastructure , as well as the military capacity.


### (8) in accordance with directive (eu) 2016/1148 , member states were responsible for determining which entities meet the criteria to qualify as operators of essential services (‘identification process’). in order to eliminate the wide divergences among member states in that regard and ensure legal certainty for the risk management requirements and reporting obligations for all relevant entities , a uniform criterion should be established that determines the entities falling within the scope of application of this directive. that criterion should consist of the application of the size-cap rule , whereby all medium and large enterprises , as defined by commission recommendation 2003/361/ec15 , that operate within the sectors or provide the type of services covered by this directive , fall within its scope. member states should not be required to establish a list of the entities that meet this generally applicable size-related criterion. ### (8) in accordance with directive (eu) 2016/1148 , member states were responsible for determining which entities meet the criteria to qualify as operators of essential services (‘identification process’). in order to eliminate the wide divergences among member states in that regard and ensure legal certainty for the risk management requirements and reporting obligations for all relevant entities , a uniform criterion should be established that determines the entities falling within the scope of application of this directive. that criterion should consist of the application of the size-cap rule , whereby all medium and large enterprises , as defined by commission recommendation 2003/361/ec15 , that operate within the sectors or provide the type of services covered by this directive , fall within its scope. the commission , together with the member states and stakeholders , should develop guidelines that enable member states to identify in a harmonised way which entities in selected sectors should be designated as essential or important entities and which entities would be considered smaller entities with a high security risk profile. those guidelines should take into account the diverse nature of the entities , as they vary in size and in activities performed , and as their strategic importance may vary.


### member states shall establish a list of entities identified pursuant to points (b) to (f) and submit it to the commission by [6 months after the transposition deadline]. member states shall review the list , on a regular basis , and at least every two years thereafter and , where appropriate , update it. ### member states , in close cooperation with relevant industry stakeholders , shall establish a list of entities identified pursuant to points (b) to (f) and submit it to the commission by [6 months after the transposition deadline]. member states shall review the list , on a regular basis , and at least every two years thereafter and , where appropriate , update it.


### 6. where provisions of sector–specific acts of union law require essential or important entities either to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats , and where those requirements are at least equivalent in effect to the obligations laid down in this directive , the relevant provisions of this directive , including the provision on supervision and enforcement laid down in chapter vi , shall not apply. ### 6. where provisions of sector–specific acts of union law require essential or important entities either to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats , and where those requirements are at least equivalent in effect to the obligations laid down in this directive , including as to the power , mandate and functions of the respective supervisory authorities , the relevant provisions of this directive , including the provision on supervision and enforcement laid down in chapter vi , shall not apply.


### 6. where provisions of sector–specific acts of union law require essential or important entities either to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats , and where those requirements are at least equivalent in effect to the obligations laid down in this directive , the relevant provisions of this directive , including the provision on supervision and enforcement laid down in chapter vi , shall not apply. ### 6. sector-specific acts that require essential or important entities either to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats , shall , where possible , refer to the definitions in article 4 of this directive. where provisions of sector–specific acts of union law require essential or important entities either to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats , and where those requirements are at least equivalent in effect to the obligations laid down in this directive , the relevant provisions of this directive , including the provision on supervision and enforcement laid down in chapter vi , shall not apply.


### 6. where provisions of sector–specific acts of union law require essential or important entities either to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats , and where those requirements are at least equivalent in effect to the obligations laid down in this directive , the relevant provisions of this directive , including the provision on supervision and enforcement laid down in chapter vi , shall not apply. ### 6. where provisions of sector–specific acts of union law require essential or important entities either to adopt cybersecurity risk management measures or to notify incidents or significant cyber threats , and where those requirements are at least equivalent in effect to the obligations laid down in this directive , including with regards to the competence and obligations of the supervisory authority , the relevant provisions of this directive , including the provision on supervision and enforcement laid down in chapter vi , shall not apply.


### 3. member states shall notify their national cybersecurity strategies to the commission within three months from their adoption. member states may exclude specific information from the notification where and to the extent that it is strictly necessary to preserve national security. ### 3. member states shall notify their national cybersecurity strategies to the commission within three months from their adoption. member states may exclude specific information from the notification where and to the extent that it is necessary to preserve national security.


### 5. the commission may adopt implementing acts in order to lay down the technical and the methodological specifications of the elements referred to in paragraph 2. where preparing those acts , the commission shall proceed in accordance with the examination procedure referred to in article 37(2) and follow , to the greatest extent possible , international and european standards , as well as relevant technical specifications. ### 5. the commission may adopt delegated acts in order to lay down the technical and the methodological specifications of the elements referred to in paragraph 2. the delegated act shall be adopted in accordance with article 36 and follow , to the greatest extent possible , international and european standards , as well as relevant technical specifications.


### 5. the commission may adopt implementing acts in order to lay down the technical and the methodological specifications of the elements referred to in paragraph 2. where preparing those acts , the commission shall proceed in accordance with the examination procedure referred to in article 37(2) and follow , to the greatest extent possible , international and european standards , as well as relevant technical specifications. ### 5. the commission may adopt delegated acts in order to lay down the technical and the methodological specifications of the elements referred to in paragraph 2. where preparing those acts , the commission shall proceed in accordance with the examination procedure referred to in article 37(2) and follow , to the greatest extent possible , international and european standards , as well as relevant technical specifications.


### without undue delay and in any event within 24 hours after having become aware of the incident , an initial notification , which , where applicable , shall indicate whether the incident is presumably caused by unlawful or malicious action; ### without undue delay and in any event within 72 hours after having become aware of the incident , an initial notification , which , where applicable , shall indicate whether the incident is presumably caused by unlawful or malicious action;


### 11. the commission , may adopt implementing acts further specifying the type of information , the format and the procedure of a notification submitted pursuant to paragraphs 1 and 2. the commission may also adopt implementing acts to further specify the cases in which an incident shall be considered significant as referred to in paragraph 3. those implementing acts shall be adopted in accordance with the examination procedure referred to in article 37(2). ### 11. the commission , may adopt delegated acts further specifying the type of information , the format and the procedure of a notification submitted pursuant to paragraphs 1 and 2. the commission may also adopt implementing acts to further specify the cases in which an incident shall be considered significant as referred to in paragraph 3. those implementing acts shall be adopted in accordance with the examination procedure referred to in article 37(2).


### 11. the commission , may adopt implementing acts further specifying the type of information , the format and the procedure of a notification submitted pursuant to paragraphs 1 and 2. the commission may also adopt implementing acts to further specify the cases in which an incident shall be considered significant as referred to in paragraph 3. those implementing acts shall be adopted in accordance with the examination procedure referred to in article 37(2). ### 11. the commission shall be empowered to adopt delegated acts further specifying the cases in which an incident shall be considered significant as referred to in paragraph 2 , and in accordance with the exercise of delegation power referred to in article 36.


### (2) since the entry into force of directive (eu) 2016/1148 significant progress has been made in increasing the union’s level of cybersecurity resilience. the review of that directive has shown that it has served as a catalyst for the institutional and regulatory approach to cybersecurity in the union , paving the way for a significant change in mind-set. that directive has ensured the completion of national frameworks by defining national cybersecurity strategies , establishing national capabilities , and implementing regulatory measures covering essential infrastructures and actors identified by each member state. it has also contributed to cooperation at union level through the establishment of the cooperation group12 and a network of national computer security incident response teams (‘csirts network’)13. notwithstanding those achievements , the review of directive (eu) 2016/1148 has revealed inherent shortcomings that prevent it from addressing effectively contemporaneous and emerging cybersecurity challenges. ### (2) since the entry into force of directive (eu) 2016/1148 significant progress has been made in increasing the union’s level of cybersecurity resilience. the review of that directive has shown that it has served as a catalyst for the institutional and regulatory approach to cybersecurity in the union , paving the way for a significant change in mind-set. that directive has ensured the completion of national frameworks by defining national cybersecurity strategies , establishing national capabilities , and implementing regulatory measures covering essential infrastructures and actors identified by each member state. it has also contributed to cooperation at union level through the establishment of the cooperation group12 and a network of national computer security incident response teams (‘csirts network’)13. notwithstanding those achievements , the review of directive (eu) 2016/1148 has revealed inherent shortcomings that prevent it from addressing effectively contemporaneous and emerging cybersecurity challenges. the expansion of online activities in the context of the covid-19 pandemic has highlighted the importance not only of cybersecurity issues , but also of providing relevant education and training on a large scale , practically to the entire population of the planet.


### (21) in view of the differences in national governance structures and in order to safeguard already existing sectoral arrangements or union supervisory and regulatory bodies , member states should be able to designate more than one national competent authority responsible for fulfilling the tasks linked to the security of the network and information systems of essential and important entities under this directive. member states should be able to assign this role to an existing authority. ### (21) in view of the differences in national governance structures and in order to safeguard already existing sectoral arrangements or union supervisory and regulatory bodies , member states should be able to designate more than one national competent authority responsible for fulfilling the tasks linked to the security of the network and information systems of essential and important entities under this directive. member states should be able to assign this role to an existing authority and make sure that this authority has adequate resources to fulfil its duties in an efficient and effective way.


### (29) member states should therefore take measures to facilitate coordinated vulnerability disclosure by establishing a relevant national policy. in this regard , member states should designate a csirt to take the role of ‘coordinator’ , acting as an intermediary between the reporting entities and the manufacturers or providers of ict products or services where necessary. the tasks of the csirt coordinator should in particular include identifying and contacting concerned entities , supporting reporting entities , negotiating disclosure timelines , and managing vulnerabilities that affect multiple organisations (multi-party vulnerability disclosure). where vulnerabilities affect multiple manufacturers or providers of ict products or services established in more than one member state , the designated csirts from each of the affected member states should cooperate within the csirts network. ### (29) member states should therefore take measures to facilitate coordinated vulnerability disclosure by establishing a relevant national policy. in this regard , member states should designate a csirt to take the role of ‘coordinator’ , acting as an intermediary between the reporting entities and the manufacturers or providers of ict products or services where necessary. the tasks of the csirt coordinator should in particular include identifying and contacting concerned entities , supporting reporting entities , negotiating disclosure timelines , and managing vulnerabilities that affect multiple organisations (multi-party vulnerability disclosure). where vulnerabilities affect multiple manufacturers or providers of ict products or services established in more than one member state , the designated csirts from each of the affected member states should cooperate within the csirts network. member states should jointly monitor the way in which eu rules are implemented , support each other in the event of any cross-border problems , establish a more structured dialogue with the private sector and cooperate on security risks and the threats associated with new technologies , as was the case with 5g technology.


### (29) member states should therefore take measures to facilitate coordinated vulnerability disclosure by establishing a relevant national policy. in this regard , member states should designate a csirt to take the role of ‘coordinator’ , acting as an intermediary between the reporting entities and the manufacturers or providers of ict products or services where necessary. the tasks of the csirt coordinator should in particular include identifying and contacting concerned entities , supporting reporting entities , negotiating disclosure timelines , and managing vulnerabilities that affect multiple organisations (multi-party vulnerability disclosure). where vulnerabilities affect multiple manufacturers or providers of ict products or services established in more than one member state , the designated csirts from each of the affected member states should cooperate within the csirts network. ### (29) member states should therefore take measures to facilitate coordinated vulnerability disclosure by establishing a relevant national policy. in this regard , member states should designate a csirt to take the role of ‘coordinator’ , acting as an intermediary between the reporting entities and the manufacturers or providers of ict products or services , where the reporting entity , or the manufacturer or the provider of ict products or services , engages a third-party coordinator to assist with the disclosure process. the tasks of the csirt coordinator should , in particular , include identifying and contacting concerned entities , supporting reporting entities , negotiating disclosure timelines , and managing vulnerabilities that affect multiple organisations (multi-party vulnerability disclosure). where vulnerabilities affect multiple manufacturers or providers of ict products or services established in more than one member state , the designated csirts from each of the affected member states should cooperate within the csirts network.


### (29) member states should therefore take measures to facilitate coordinated vulnerability disclosure by establishing a relevant national policy. in this regard , member states should designate a csirt to take the role of ‘coordinator’ , acting as an intermediary between the reporting entities and the manufacturers or providers of ict products or services where necessary. the tasks of the csirt coordinator should in particular include identifying and contacting concerned entities , supporting reporting entities , negotiating disclosure timelines , and managing vulnerabilities that affect multiple organisations (multi-party vulnerability disclosure). where vulnerabilities affect multiple manufacturers or providers of ict products or services established in more than one member state , the designated csirts from each of the affected member states should cooperate within the csirts network. ### (29) member states should therefore take measures to facilitate coordinated vulnerability disclosure by establishing a relevant national policy. in this regard , member states should designate a csirt to take the role of ‘coordinator’ , acting as an intermediary between the manufacturers or providers of ict products or services , which report the vulnerability , and their customers , which are likely to be affected by the vulnerability , where necessary. the tasks of the csirt coordinator should in particular include identifying and contacting concerned entities , supporting reporting entities , providing guidelines on disclosure timelines , and managing vulnerabilities that affect multiple organisations (multi-party vulnerability disclosure). where vulnerabilities affect multiple manufacturers or providers of ict products or services established in more than one member state , the designated csirts from each of the affected member states should cooperate within the csirts network in providing assistance and guidance to the affected manufacturers.


### (43) addressing cybersecurity risks stemming from an entity’s supply chain and its relationship with its suppliers is particularly important given the prevalence of incidents where entities have fallen victim to cyber-attacks and where malicious actors were able to compromise the security of an entity’s network and information systems by exploiting vulnerabilities affecting third party products and services. entities should therefore assess and take into account the overall quality of products and cybersecurity practices of their suppliers and service providers , including their secure development procedures. ### (43) addressing cybersecurity risks stemming from an entity’s supply chain and its relationship with its suppliers is particularly important given the prevalence of incidents where entities have fallen victim to cyber-attacks and where malicious actors were able to compromise the security of an entity’s network and information systems by exploiting vulnerabilities affecting third party products and services. entities should evaluate their own cybersecurity capabilities and pursue the integration of cybersecurity enhancing technologies driven by ai or machine learning systems to automate their capabilities and the protection of network architectures. entities should also assess and take into account the overall quality of products and cybersecurity practices of their suppliers and service providers , including their secure development procedures.


### (43) addressing cybersecurity risks stemming from an entity’s supply chain and its relationship with its suppliers is particularly important given the prevalence of incidents where entities have fallen victim to cyber-attacks and where malicious actors were able to compromise the security of an entity’s network and information systems by exploiting vulnerabilities affecting third party products and services. entities should therefore assess and take into account the overall quality of products and cybersecurity practices of their suppliers and service providers , including their secure development procedures. ### (43) addressing cybersecurity risks stemming from an entity’s supply chain and its relationship with its suppliers is particularly important given the prevalence of incidents where entities have fallen victim to cyber-attacks and where malicious actors were able to compromise the security of an entity’s network and information systems by exploiting vulnerabilities affecting third party products and services. entities should therefore assess and take into account the overall quality and resilience of products , services and cybersecurity practices of their suppliers and service providers , including their secure development procedures.


### 2. member states shall ensure that members of the management body follow specific trainings , on a regular basis , to gain sufficient knowledge and skills in order to apprehend and assess cybersecurity risks and management practices and their impact on the operations of the entity. ### 2. member states shall ensure that members of the management body of essential and important entities follow specific trainings , and shall encourage essential and important entities to offer similar trainings to all employees , on a regular basis , to gain sufficient knowledge and skills in order to apprehend and assess cybersecurity risks and management practices and their impact on the operations of the entity.


### 2. the report shall include particular policy recommendations for increasing the level of cybersecurity across the union and a summary of the findings for the particular period from the agency’s eu cybersecurity technical situation reports issued by enisa in accordance with article 7(6) of regulation (eu) 2019/881. ### 2. the report shall include the obstacles identified at the national level , particular policy recommendations for increasing the level of cybersecurity across the union , and a summary of the findings for the particular period from the agency’s eu cybersecurity technical situation reports issued by enisa in accordance with article 7(6) of regulation (eu) 2019/881.


### (iii) the operational capabilities and effectiveness of csirts; ### (iii) the technical capabilities and effectiveness of csirts in executing their tasks;


### 4. peer reviews shall entail actual or virtual on-site visits and off-site exchanges. in view of the principle of good cooperation , the member states being reviewed shall provide the designated experts with the requested information necessary for the assessment of the reviewed aspects. any information obtained through the peer review process shall be used solely for that purpose. the experts participating in the peer review shall not disclose any sensitive or confidential information obtained in the course of that review to any third parties. ### 4. peer reviews shall entail actual or virtual on-site visits and off-site exchanges. in view of the principle of good cooperation , the designated experts tasked with carrying out the peer-review shall communicate the aspects under review as referred to in paragraph 1 , including any additional targeted issues specific to the member state or sectors referred to in paragraph 3 , and request a corresponding self-assessment report from the member states being reviewed. the member states being reviewed shall provide the designated experts with the requested information necessary for the assessment of the reviewed aspects. any information obtained through the peer review process shall be used solely for that purpose.


### 6. member state shall ensure that any risk of conflict of interests concerning the designated experts are revealed to the other member states , the commission and enisa without undue delay. ### 6. member states shall ensure that any risk of conflict of interests concerning the designated experts are revealed to the other member states , the commission and enisa , before the designation of experts referred to in paragraphs 1 and 2.


### 1. member states shall ensure that the management bodies of essential and important entities approve the cybersecurity risk management measures taken by those entities in order to comply with article 18 , supervise its implementation and be accountable for the non-compliance by the entities with the obligations under this article. ### 1. member states shall ensure that the management bodies of essential and important entities approve the cybersecurity risk management measures taken by those entities in order to comply with article 18 , supervise its implementation and be accountable for the non-compliance by the entities with the obligations under this article. those measures shall non-exhaustively include an appropriate deployment of state-of-the-art products , services and processes for the resilience of the entity’s network and information systems.


### incident handling (prevention , detection , and response to incidents); ### incident handling (prevention , detection , mitigation , response to , recovery from , and attribution of incidents);


### business continuity and crisis management; ### business continuity , disaster recovery and crisis management;


### where applicable , those entities shall notify , without undue delay , the recipients of their services that are potentially affected by a significant cyber threat of any measures or remedies that those recipients can take in response to that threat. where appropriate , the entities shall also notify those recipients of the threat itself. the notification shall not make the notifying entity subject to increased liability. ### deleted


### where applicable , those entities shall notify , without undue delay , the recipients of their services that are potentially affected by a significant cyber threat of any measures or remedies that those recipients can take in response to that threat. where appropriate , the entities shall also notify those recipients of the threat itself. the notification shall not make the notifying entity subject to increased liability. ### where applicable and in respect to their contractual arrangements , those entities shall notify , without undue delay , the recipients of their services that are potentially affected by a significant cyber threat of any measures or remedies that those recipients can take in response to that threat. where appropriate , the entities shall also notify those recipients of the threat itself. the notification shall not make the notifying entity subject to increased liability