EUROPEAN COMMISSION Brussels, 16.12.2020 SWD(2020) 345 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT REPORT

Accompanying the document Proposal for a Directive of the European Parliament and of the Council on measures for a high common level of cybersecurity across the Union, repealing Directive (EU) 2016/1148 {COM(2020) 823 final} - {SEC(2020) 430 final} - {SWD(2020) 344 final}



Table of contents 1.Introduction 1.1.Political context and legal framework 1.2.Results of the evaluation of the NIS Directive 2.Problem definition 2.1.What are the problems? 2.2.What are the problem drivers? 3.How will the problem evolve? 4.Why should the EU act? 4.1.Legal basis 4.2.Subsidiarity: Necessity of EU action 4.3.Subsidiarity: Added value of EU action 5.Objectives: What is to be achieved? 5.1.General objectives 5.2.Specific objectives 6.What are the available policy options? 6.1.Description of the policy options 6.2.Options discarded at an early stage 7.What are the impacts of the policy options?

7.1.Economic impact and efficiency 7.2.Social impacts 7.3.Environmental impacts 7.4.Impacts on fundamental rights 8.How do the options compare? 9.Preferred option 9.1.Rationale and benefits of the preferred option 9.3.REFIT (simplification and improved efficiency) 10.How will actual impact be monitored and evaluated? Glossary: acronyms Term or acronym Meaning AI Artificial Intelligence CDN Content delivery network CSIRTs Computer Security Incident Response Teams CyCLONe European Cyber Crises Liaison Organisation Network DDoS Distributed Denial of Service DEP Digital Europe Programme DESI Digital Economy and Society Index DNS Domain Name System DORA Digital Operational Resilience Act for the financial sector DSP Digital service provider EASA The European Union Aviation Safety Agency ECCSA European Centre for Cybersecurity in Aviation ECI Directive Directive on the identification and designation of European critical infrastructures ECJ European Court of Justice EECC European Electronic Communications Code EMSA European Marine Safety Agency eIDAS (Regulation) Regulation on electronic identification and trust services for electronic transactions in the internal market ENISA The European Union Agency for Cybersecurity GDPR General Data Protection Regulation IaaS Infrastructure as a service (cloud service model) ICS Industrial control system IOCTA Internet Organised Crime Threat Assessment IoT Internet of Things ISAC Information Sharing and Analysis Centre ISO International Organisation for Standardisation ITU International Telecommunications Union: The United Nations specialised agency for information and communication technologies IXPs Internet Exchange Points JRC European Commission’s Joint Research Centre LOTL European List of eIDAS Trusted Lists OES Operator of essential services OPC Open public consultation MeliCERTes Cybersecurity Digital Service Infrastructure Maintenance and Evolution of Core Service Platform Cooperation Mechanism for CSIRTs NACE Statistical Classification of Economic Activities in the European Community NIS Directive Directive concerning measures for a high common level of security of network and information systems across the Union NIST National Institute of Standards and Technology – US Department of Commerce PaaS Platform as a Service (cloud service model) PPP Private Public Partnership ROSI Return of Security Investment SaaS Software as a Service (cloud service model) SME Small and medium-sized enterprises SPOC Single Point of Contact TFEU Treaty on the Functioning of the European Union TLD Top-level domain



Glossary: terms and definitions Term/concept Definition ARGUS General rapid alert system linking all the European Commission’s specialised systems for emergencies Cloud computing service A digital service that enables on-demand administration and broad remote access to a scalable and elastic pool of shareable computing resources Content delivery network A network of geographically distributed servers for the purpose of ensuring high availability, accessibility or fast delivery of digital content and services to internet users on behalf of content and service providers Cybersecurity The activities necessary to protect network and information systems, the users of such systems, and other persons affected by cyber threats Cybersecurity certification scheme A comprehensive set of rules, technical requirements, standards and procedures developed and adopted by a public authority and that apply to the certification or conformity assessment of ICT products, ICT services and ICT processes falling under the scope of the specific scheme Cyber threat Any potential circumstance, event or action within the meaning of point 8 of Article 2 of Regulation (EU) 2019/881 Data centre service A service that encompasses structures, or groups of structures, dedicated to the centralised accommodation, interconnection and operation of information technology and network telecommunications equipment providing data storage, processing and transport services together with all the facilities and infrastructures for power distribution and environmental control Distributed denial-of-service (DDoS) attack A malicious attempt to disrupt the normal traffic of a targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of internet traffic Domain name system (DNS) A hierarchical distributed naming system which allows end-users to reach services and resources on the open internet DNS service provider An entity that provides recursive or authoritative domain name resolution services to internet end-users and other DNS service providers based on information contained in the hierarchical structure of the DNS Edge computing Distributed, open IT architecture that features decentralised processing power, enabling mobile computing and Internet of Things (IoT) technologies. In edge computing, data is processed by the device itself or by a local computer or server, rather than being transmitted to a data centre Incident Any event compromising the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the related services offered by, or accessible via, network and information systems Incident handling All procedures supporting the detection, analysis and containment of an incident and the response thereto Internet exchange point (IXP) A network facility which enables the interconnection of more than two independent autonomous systems, primarily for the purpose of facilitating the exchange of internet traffic; an IXP provides interconnection only for autonomous systems; an IXP does not require the internet traffic passing between any pair of participating autonomous systems to pass through any third autonomous system, nor does it alter or otherwise interfere with such traffic ISO 27000-series standards Series of mutually supporting information security standards that can be combined to provide a globally recognised framework for best-practice information security management NIST standards Standards aimed at driving innovation and economic competitiveness at U.S.-based organizations in the science and technology industry developed by the National Institute of Standards and Technology (NIST). NIST standards are based on best practices from several security documents, organizations, and publications, and are designed as a framework for federal agencies and programs requiring stringent security measures Network and information system An electronic communications network or any device or group of inter–connected or related devices, one or more of which, pursuant to a program, perform automatic processing of digital data, or digital data stored, processed, retrieved or transmitted by elements covered under the previous points for the purposes of their operation, use, protection and maintenance Online marketplace Digital service that allows consumers and/or traders to conclude online sales or service contracts with traders either on the online marketplace's website or on a trader's website that uses computing services provided by the online marketplace Online search engine A digital service that allows users to perform searches of, in principle, all websites or websites in a particular language on the basis of a query on any subject in the form of a keyword, phrase or other input, and returns links in which information related to the requested content can be found Operators of government-owned and privately-owned ground-based infrastructure that support the provision of space-based services Ground-based government-owned and privately-owned infrastructure that supports the provision of space-based services, with the exception of specific ground-based infrastructure that directly supports space-based components of the EU’s space programme, including Galileo, EGNOS, Copernicus, GOVSATCOM and Space Surveillance and Tracking Provision of an electronic communications network The establishment, operation, control or making available of such a network, as defined by the Directive (EU) 2018/1972 establishing the European Electronic Communications Code Public electronic communications networks or of publicly available electronic communications services Electronic communications network used wholly or mainly for the provision of publicly available electronic communications services which support the transfer of information between network termination points, as defined by the Directive (EU) 2018/1972 establishing the European Electronic Communications Code Public administration entities Public entities that: (i) are established for the purpose of meeting needs in the general interest and does not have an industrial or commercial character; (ii) have legal personality; (iii) are financed, for the most part, by the State, regional authority, or by other bodies governed by public law; or is subject to management supervision by those authorities or bodies; or have an administrative, managerial or supervisory board, more than half of whose members are appointed by the State, regional authorities, or by other bodies governed by public law and (iv) have the power to address to natural or legal persons administrative or regulatory decisions affecting their rights in the cross-border movement of persons, goods, services and capital. Ransomware Type of malware (e.g. viruses, trojans, etc.) that infects the computer systems of users and manipulates the infected system in a way, that the victim cannot (partially or fully) use it and the data stored on it. The victim usually shortly after receives a blackmail note by pop-up, pressing the victim to pay a ransom to regain full access to system and files. Security of network and information systems The ability of network and information systems to resist, at a given level of confidence, any action, that compromises the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the related services offered by, or accessible via, those network and information systems Social network An online multi-sided platform that enables users to connect, share, discover and communicate with each other across multiple devices (mobile and desktop) and means (e.g., via chats, posts, videos, recommendations) Top–level domain name registry An entity which administers and operates a specific top-level domain (TLD) by providing the registration of domain names under the TLD and the technical operation of the TLD, including the operation of its name servers, the maintenance of its databases and the distribution of TLD zone files across name servers Trust service provider Trust Service Providers, within the meaning of Article 3(19) of the eIDAS Regulation, are responsible for assuring the digital ID of people through authentication, digital certificates and digital signatures Vulnerability A weakness, susceptibility or flaw of an asset, system, process or control that can be exploited by a threat Waste water Water that is of no further immediate value to the purpose for which it was used or in the pursuit of which it was produced because of its quality, quantity or time of occurrence.



1.Introduction 1.1.Political context and legal framework The Directive concerning measures for a high common level of security of network and information systems across the Union (hereinafter called the ‘NIS Directive’), which entered into force in August 2016, was the first piece of EU-wide legislation on cybersecurity. By now, all Member States have transposed the NIS Directive into national law.

Article 23(2) of the NIS Directive requires the Commission to review the functioning of the Directive by 9 May 2021. The review is also mentioned in the Adjusted Commission Work Programme 2020, which envisages a legislative proposal accompanied by an impact assessment in Q4 of 2020. Furthermore, the EU Security Union Strategy for 2020 to 2025, which focuses on priority areas where the EU can bring value to support Member States in fostering security, also comprises provisions on cybersecurity, mentioning the review of the NIS Directive planned to be completed by the end of 2020. Cybersecurity is also one of the Commission’s priorities in its response to the COVID-19 crisis, and consequently the Recovery Plan for Europe includes additional investments in cybersecurity. In its Communication on Shaping Europe’s Digital Future of February 2020, the Commission highlighted the need to cooperate with a view to “setting consistent rules for companies and stronger mechanisms for proactive information-sharing; ensuring operational cooperation between Member States, and between the EU and Member States”. At the level of the European Parliament, a resolution from 12 March 2019 called “[…] on the Commission to assess the need to further enlarge the scope of the NIS Directive to other critical sectors and services that are not covered by sector-specific legislation”. The Council, in its conclusions from 9 June 2020, welcomed “[…] the Commission’s plans to ensure consistent rules for market operators and facilitate secure, robust and appropriate information-sharing on threats as well as incidents, including through a review of the Directive on security of network and information systems (NIS Directive), to pursue options for improved cyber resilience and more effective responses to cyber-attacks, particularly on essential economic and societal activities, whilst respecting Member States’ competences, including the responsibility for their national security.” The NIS Directive provided the overall framework for cybersecurity cooperation at national and EU levels. It has also served as a catalyst in many Member States, paving the way for a significant change in mind-set, institutional and regulatory approach to cybersecurity. In particular, it sets the basis for: (I).improved cybersecurity capabilities at national level by requiring Member States to draw up national strategies and appoint authorities with responsibility for cybersecurity. (II).increased EU-level cooperation through the creation of two new EU fora, both strategic and operational, as well as exchange of information among Member States, mainly on a voluntary basis. (III).requirements for Member States to define risk management (security requirements) and incident reporting obligations, notably for operators of essential services (hereinafter called ‘OESs’) in seven specific sectors, i.e. healthcare, transport, energy, banking, financial market infrastructure, drinking water supply and distribution and digital infrastructure, and digital service providers (hereinafter called ‘DSPs’), i.e. online marketplaces, online search engines and cloud computing services. Through the Cooperation Group, the NIS Directive also brought Member States’ authorities together and, despite some initial reluctance to engage at EU and cross-country level due to perceived national security sensitivities and lack of trust, it made everybody more aware of the need for unity and coordinated efforts as a pre-requisite for enhanced resilience against cybersecurity risks. The Cooperation Group therefore set up a solid basis for EU level cooperation on cybersecurity policy aspects, developing into an extensive setting where specific work streams focusing on a wide range of NIS-related aspects are constantly being consolidated and expanded. To illustrate this, the NIS Directive provided a structure and the Cooperation Group provided the forum for the work on 5G network security. The network of national Computer Security Incident Response Teams (hereinafter called ‘CSIRTs’) facilitated some more operational exchanges among Member States. It is also within the NIS Directive’s cooperation framework that the Commission, with support from Member States, issued a blueprint for rapid emergency response in case of large-scale cross-border cyber incidents or crisis. Based on this, Cyber Europe incident and crisis management exercises were developed and a Cyber Crises Liaison Organisation Network (“CyCLONe”) is being set up. The entities subject to the NIS Directive’s requirements are as follows: ·operators of essential services (OESs) in the seven sectors mentioned above, as identified by the Member States. The companies active in these sectors must go through an identification process at Member State level, to establish whether they qualify as OESs within the NIS scope. The Member States also define the security requirements that OESs have to put in place and establish the concrete thresholds and procedures for incident reporting. ·digital service providers (DSPs) of the types mentioned above. These are not subject to an identification process, the maximum harmonisation principle applies to their obligations and they are subjected to a so called light-touch approach based on reactive ex post supervisory activity justified by the nature of their services and operations. DSPs do not have to gather evidence on the implementation of security policies and the competent authorities should have no general obligation to supervise DSPs. As regards the supervision and enforcement framework, the NIS Directive contains general provisions, which neither specify minimum requirements for supervisory measures that can be applied by the competent authorities, nor set a minimum level of penalties for non-compliance with the obligations stipulated by the Directive. However, in spite of the above-mentioned achievements, the NIS Directive also proved its limitations, falling short of ensuring a fully engaging, coherent and pro-active setting that could guarantee an effective take of shared responsibilities and trust among all relevant authorities and businesses. As shown by the evaluation of its functioning (see Annex 5), the NIS Directive revealed inherent weaknesses and gaps that make it incapable of addressing contemporaneous and emerging cybersecurity challenges. These concern, among others, the lack of clarity on the NIS scope, the insufficient consideration of the increasing interconnectivity and interdependencies within EU economies and societies, the lack of alignment of security requirements and reporting obligations, the lack of effective incentives for information sharing or operational cooperation among relevant authorities and the difference in treatment of comparable businesses across Member States and sectors. For example, as a result of some of these gaps, there are situations where major hospitals in a Member State do not fall within the scope of the NIS Directive and hence are not required to have in place the resulting security measures, while another Member State with a similar population size included under the NIS scope almost every single hospital in the country. Similarly, while a major European railway operator is included under the NIS scope in one big Member State, another major railway operator in another big Member State is not covered by the NIS security requirements. In addition, the speedy digital transformation of society has expanded the threat landscape and is bringing about new challenges, which require adapted and innovative responses. More advanced policy responses in the field of cybersecurity have become a matter of urgency, as the number of cyber-attacks continues to rise, with increasingly sophisticated attacks coming from a wide range of sources inside and outside the EU. State or state-backed actors are frequently involved. There were almost 450 cybersecurity incidents in 2019 involving critical infrastructures in Europe like health, finance and energy. One cyberattack alone can cause substantial damages across organisations, sectors, and citizens. For example, the economic impact of the 2017 WannaCry incident is estimated in the order of hundreds of million euros or even more. In its latest Global Risks Report, the World Economic Forum mentions cyberattacks as one of the top 10 risks by likelihood and by impact over the next 10 years. The COVID-19 crisis and the resulting sudden increase in demand for internet-based solutions has emphasised an even stronger need for a state of the art cybersecurity. The pressures of the COVID-19 outbreak have led to cyber-attacks exploiting the situation in different ways, from taking advantage of the intense pressure on hospitals, to abusing the mass move to home digital working. Ransomware and distributed denial of service (DDoS) attacks remain a permanent threat, targeting key digital services like major cloud providers. The move to connected devices will bring great benefits for users: but with less data stored or processed in data centres, and more processed closer to the user ‘at the edge’, cybersecurity will no longer be able to focus on protecting central points. Overall, since the implementation of the NIS Directive, European countries have become increasingly dependent on digital and information systems, while their networks have become ever-more interconnected. As highlighted by the EU Security Union strategy , security threats are feeding more and more on the ability to work cross-border and on inter-connectivity, exploiting the blurring boundaries between the physical and digital world. To this end, while reviewing the NIS Directive, the Commission is also preparing a proposal, due by the end of 2020, for additional measures to enhance the protection and resilience of critical infrastructure, to replace the Directive on the identification and designation of European critical infrastructures (hereinafter called ‘the ECI Directive’) with an overarching cross-sectoral framework focused on non-cyber threats. The current ECI Directive covers infrastructures the disruption of which would have an impact on at least two Member States in two sectors: energy and transport. It is envisaged to ensure greater coherence between the EU critical infrastructure protection and the NIS Directive, especially when it comes to the sectoral scope of both initiatives. The initiative considers introducing measures to enhance the resilience of critical infrastructures in the face of non-cyber risks. Sector-specific initiatives are also addressing cybersecurity aspects, in synchronisation with the NIS framework. For example, the Network Code for the cybersecurity of cross-border energy flows, the rules for cybersecurity in the aviation security domain and the Commission proposal for a Digital Operational Resilience Act for financial services (DORA) provide sector-specific cybersecurity provisions. Finally, there is a number of related laws at EU level aiming to achieve complementary objectives, most notably the General Data Protection Regulation (GDPR), which contains provisions on the security of personal data for data controllers and processors, but also the e-Privacy Directive. See also Annex 7 on related policy and legislative initiatives, including the Regulation on electronic identification and trust services for electronic transactions in the internal market (hereinafter called the ‘eIDAS Regulation’) and the GDPR. In the run-up to this impact assessment, the Commission has been extensively consulting with all relevant stakeholders and in particular with the Member States. Thanks to the Cooperation Group, the Commission has been in constant touch with the competent authorities in charge of implementing the NIS Directive. The Cooperation Group has extensively covered various cross-cutting and sectoral implementation aspects. In addition, during its NIS country visits in 2019 and 2020, the Commission has interviewed 154 public and private entities, as well as 117 competent authorities. Member States and other stakeholders were also invited to participate in the Open Public Consultation and in the surveys and workshops organised by the NIS review study on behalf of the Commission. Both the Open Public Consultation and the surveys explicitly also covered those entities that are currently not under the scope of the NIS Directive. The Commission has also published an inception impact assessment, to which stakeholders could submit feedback. See also Annex 2 on stakeholder consultation. Being an initiative within the Regulatory Fitness Programme (REFIT), the impact assessment will not only look at ways to improve the cyber resilience of the Union but it will also examine to what extent the regulatory burden for competent authorities and compliance costs for public and private entities can be reduced. 1.2.Results of the evaluation of the NIS Directive

An evaluation on the functioning of the NIS Directive (see Annex 5) was conducted as part of the review process required by Article 23(2) of the NIS Directive. The conclusions of the evaluation can be summarised into six main categories of findings (see Figure 1 ). These findings are further elaborated on in the problem definition described below, linked to the problem drivers (see section 2). They are regarded as underlying causes for the identified problems. Evaluation finding 1: Increased interconnectedness and interdependencies in sectors not covered The evaluation suggests that the current scope of the NIS Directive is too limited in terms of the sectors covered. This is mainly due to: (i) increased digitisation in recent years and a higher degree of interconnectedness, (ii) the scope of the NIS Directive no longer reflecting all digitised sectors providing key services to the economy and society as a whole. Critical infrastructure (such as airports or hospitals) and other economic operators are becoming increasingly interconnected and reliant on network and information systems. Attacks on such infrastructure can therefore trigger chain reactions and send ripples throughout the economy. The availability, integrity and confidentiality of a specific essential service cannot be effectively protected through regulatory requirements imposed on the provider of that service alone since the functioning of that service is affected by the level of protection of other sectors or services. Evaluation finding 2: Scope not clearly determined by the NIS Directive and unclear national competence over digital service providers Public and private entities that belong to the seven sectors under the NIS scope, as described in section 1.1., are not automatically required to put in place security measures and report incidents. Member States must first identify them as operators of essential services (so-called OES identification process). The evaluation has shown that national authorities have developed a wide variety of identification practices leading to inconsistencies in the de-facto scope of the NIS Directive in the Member States. While this reflects the different approaches of Member States in determining the criticality of economic operators, it has led to a situation in which certain types of entities have not been identified in all Member States and are therefore not required to put in place security measures and report incidents. The evaluation also identified that Member States are not fully aware of their potential competence for specific DSPs. Evaluation finding 3: Divergent security and reporting requirements The NIS Directive allowed wide discretion to the Member States when laying down security and incident reporting requirements for OESs. The evaluation shows that in some instances Member States have implemented these requirements in significantly different ways. For example, Member States have modelled their national security requirements along different international standards or have chosen different degrees of prescriptiveness. Incident reporting requirements also diverge considerably when it comes to which incidents need to be reported and when and how reports are to be made. Evaluation finding 4: Ineffective supervision and enforcement For the purpose of supervision, competent authorities can request documentation from OESs, gather evidence of effective implementation of security policies and issue binding instructions to remedy deficiencies (so-called ex-ante supervision of OESs). During the country visits conducted in 2019-2020, the Commission observed that many Member States only make limited use of these options. In even fewer cases, they are systematically checking whether companies are complying with the NIS rules. The evaluation has also shown that the ex-post supervision approach was not effective as far as the DSPs are concerned. This is notably due to: (i) the lack of a conclusive overview by the competent authorities of these services across the Member States, (ii) the lack of clarity of the jurisdiction rules and (iii) an insufficiently harmonised supervision and ineffective enforcement system. Finally, the evaluation has revealed that penalties are almost never applied and that there are considerable discrepancies when setting penalties across Member States, with the maximum level of penalties varying greatly. Evaluation finding 5: Uneven resources for competent authorities The NIS Directive requires Member States to designate one or more competent authorities to supervise the implementation of the provisions thereof. In addition, Member States are required to designate a single point of contact (SPOC) for cross-border cooperation and one or more computer security incident response teams (CSIRTs) for incident handling. Despite the fact that the NIS Directive lays down detailed tasks for each of these authorities, the financial and human resources set aside by Member States for fulfilling these tasks, and consequently the different levels of maturity in dealing with cybersecurity risks, vary greatly. This makes it challenging for certain competent authorities to effectively meet their obligations stemming from the NIS Directive. Evaluation finding 6: Limited information sharing between Member States Even though the current structures allowed for a substantial improvement in building mutual trust, Member States do not share information systematically with one another. In addition, there are deficiencies when it comes to the sharing of information between authorities within Member States. At EU level, the NIS Directive has created two new fora for information exchange between the Member States: the Cooperation Group to support and facilitate strategic exchanges and policy coordination, and the CSIRTs network, which promotes technical cooperation between national CSIRTs. Nonetheless, the exchange of information throughout the cybersecurity lifecycle remains limited and mostly unstructured. This is also the case for information sharing among private entities, and for the engagement between the EU level cooperation structures and private entities. 2.Problem definition 2.1.What are the problems? 2.1.1.Low level of cyber resilience of businesses operating in the European Union

Cybercrime and cybersecurity can hardly be separated in an interconnected environment. Deterring cybercrime is an integral component of cybersecurity policies. Cybercrime comes at a high cost for societies and economies. A study of the Commission’s Joint Research Centre (JRC) stressed that cybercrime is estimated to cost the world EUR 5.5 trillion by the end of 2020, up from EUR 2.7 trillion in 2015, due in part to the exploitation of the COVID-19 pandemic by cyber criminals. According to the report: ‘this figure represents the largest transfer of economic wealth in history, more profitable than the global trade in all major illegal drugs combined, putting at risk incentives for innovation and investment.’ The same study mentions that ‘the number of citizens impacted simultaneously by a single cyber incident can be huge as a consequence of the pervasiveness of connected devices: 3 billion accounts in the attack on Yahoo in 2013, 77 million users in the attack on Sony PS3 in 2011, 1.3 million and 250 000 impacted citizens, respectively, in the attacks on Estonia and Ukraine in 2017, and 7 major security incidents in December 2019 alone. […] In April 2007, Estonia […] suffered a series of coordinated cyber attacks that targeted governmental institutions and bodies, financial entities, telecommunication infrastructure and newspapers. […]’ The 2020 Digital Economy and Society Index (DESI) shows that in 2020, 39 % of EU citizens who used the internet experienced security-related problems. In 2019, security concerns limited or prevented 50 % of EU internet users from performing online activities. The JRC report stresses that the number of cyber-attacks has grown constantly over the years, with a corresponding growth in the resulting financial damage. The number of cyber-attacks continues to rise, with increasingly sophisticated attacks coming from a wide range of sources inside and outside the EU. Microsoft’s Digital Defence Report confirmed that ‘threat actors rapidly increased in sophistication in the past year, using techniques that make them harder to spot that threaten even the savviest targets.’[…]. In 2019, one in eight businesses were affected by cyberattacks . One cyber-attack alone can cause substantial damages across organisations, sectors, as well as citizens. The economic impact of the 2017 WannaCry incident is estimated in the order of hundreds of million euros with some cyber risk modelling analysts placing the losses in the order of billions. Apart from the economic costs, cyber-attacks can seriously affect and potentially lose lives. For example, in September 2020, a ransomware attack targeted a hospital in Düsseldorf; a death occurred after a patient who needed urgent care was diverted to a nearby hospital. Cyber incidents do not only represent costs for those organisations directly affected by them (such as the entity where a breach has occurred or that has been the direct target of an attack) but they can also have an impact on the wider economy and society as a whole, including across borders. For example, incidents can also cause costs to companies that have a link with the direct victim of an incident (for example, because the companies collaborate closely or because one company supplies goods or services to the other company). Moreover, incidents can also have an impact on other parts of society (such as consumers or health care patients) and erode the trust in those entities that provide essential services. A study looking at the cyber readiness of companies shows that most companies still have a long way to go. Even though there has been a marked increase in the proportion of businesses considered to be well prepared, 64 % are still considered to be novice in the field of cybersecurity. Even for those (sub)sectors already covered by the NIS Directive, the results of the Open Public Consultation (OPC) have shown that on average the level of cybersecurity resilience is assessed by respondents only as medium. Regarding DSPs, respondents to the OPC consider them to exhibit a medium to high level of cyber resilience, with cloud services being regarded as the most resilient. Small and medium sized enterprises (SMEs) in particular exhibit a relatively low level of cyber resilience. At the same time, an overwhelming majority of 97 % of the OPC respondents indicated that the cyber threat level has increased since 2016. At the level of individual businesses, the 2020 Annual Cost of a Data Breach Report of the Ponemon Institute estimated the average cost of a data breach to be EUR 3.5 million in 2018, an increase of 6.4 % over the previous year . Member States have made significant progress when it comes to the cyber resilience of companies, notably by identifying thousands of entities across the Union and by requiring them to take cybersecurity measures and report incidents. Nonetheless, the level of cyber resilience in the Union remains relatively low. For example, when it comes to the level of cyber resilience in Europe in the global context, a study comparing the cyber resilience of companies across five world regions puts European companies behind Asia and America in all six areas that the study had focussed on. In a recent comparative analysis of the cybersecurity programmes of companies in 18 major economies, EU companies scored significantly lower than their counterparts in the United States, South Korea and Japan. Overall, this suggests that European businesses are not sufficiently prepared for cyber-related risks as compared to a global context. At the same time, the cybersecurity landscape has changed considerably since the NIS Directive has come into force. The continuous digitisation is leading to an ever increasing attack surface. For example, more and more manufacturers are connecting industrial control systems (ICS) to the internet, with a year-on-year increase of connected ICS of 27 % between 2017 and 2018. New technological trends also have an impact on the criticality of certain service providers so far not covered by the NIS Directive. For instance, content delivery networks (CDNs) have become a major part of the infrastructure of the modern internet. Since the NIS Directive has come into force in 2016, CDN-based internet traffic has overtaken non-CDN-based traffic and is projected to make up 72 % of total internet traffic by 2022. The COVID-19 crisis and its impact on digitisation is expected to reinforce these trends even more. On the cybercrime side, attacks are increasingly becoming a commodity and can now often be achieved at very low costs. See Figure 3 from the JRC report with a screenshot taken from the dark web where various cyberattack ‘offers’ are advertised at very low prices. 2.1.2.Inconsistent resilience across Member States and sectors The evaluation has shown that the NIS Directive has been a trigger for a significant EU-wide cybersecurity risk assessment undertaken by the Member States in those sectors covered by the Directive. As a result, competent authorities have identified thousands of public and private entities as OESs, requiring them to take cybersecurity measures and report incidents. However, the evaluation has also revealed certain discrepancies in how Member States have transposed and implemented the rules of the NIS Directive. Entities can be subject to different regulatory treatment, depending on the jurisdiction that applies. This is especially true when it comes to the identification of OESs (i.e. whether entities are inside or outside the de-facto scope of the NIS Directive). For example, as shown in Figure 4 , certain Member States (e.g. Italy) have identified much more OESs than other Member States (e.g. Spain, France). First and foremost, these discrepancies result in an uneven level of cyber resilience across the Union including among sectors, with entities sometimes not achieving the level of cyber resilience that the NIS Directive set out to achieve. Secondly, in the event of an incident, companies with a lower level of resilience can negatively impact even those companies that already exhibit a high level of resilience, as cyber threats and the costs of incidents can spread across supply chains and throughout the economy. A recent Commission report (hereinafter called ‘the OES Report’) also highlights that due to the many interdependencies between companies in the internal market, discrepancies in OES identification can have serious consequences, including uneven degrees of cyber resilience that can lead to threats propagating more easily across borders. It is the very nature of cybersecurity in the value chain that investments undertaken by one company can have a positive impact on the cybersecurity of other companies (externalities). In the OPC, 97 % of respondents agreed that “cyber risks can propagate across borders at high speed, which is why cybersecurity rules should be aligned at Union level”. An inconsistent resilience across Member States can therefore contribute to the negative consequences for the economy and society that section 2.1.1 describes in detail. In the OPC, 80 % of stakeholders disagreed with the statement that “there is a sufficient degree of alignment of security requirements for OES and DSPs in all Member States”. Similarly, when asked about notification requirements, 60 % of stakeholders disagreed with the statement that the “current approach ensures that OES across the Union face sufficiently similar incident notification requirements”. There are also notable differences in the level of cyber resilience across different NIS sectors: In the OPC, respondents were asked to evaluate the level of cyber resilience of the different sectors and digital services covered by the NIS Directive on a scale from “very low” to “very high”. Sectors such as banking, financial market infrastructure and digital infrastructure are considered as much more resilient than the other sectors with health, transport and drinking water supply scoring particularly low. These results are very much in line with the conclusions drawn by the Commission after the NIS review country visits. According to a recent report of the Ponemon Institute on the cost of data breaches, the healthcare sector, for the tenth year in a row, continued to incur the highest average breach costs at global level, at about EUR 6.13 million: a 10 % increase as compared to the previous year estimates. Similarly, the energy sector saw a 13 % increase from 2019, to an average of EUR 5.50 million. Overall, 13 of 17 industries experienced an average total cost decline year over year. Discrepancies in the way entities are treated by the Member States not only have consequences on the level of cyber resilience, but can also have a meaningful impact on the internal market: Divergent requirements create an uneven level playing field for companies that are active across the internal market, putting providers of essential services in certain Member States at a disadvantage compared with similar providers in other Member States. 69 % of OPC respondents disagree with the statement that the “identification process has contributed to the creation of a level playing field for companies from the same sector across the Member States”. Respondents to the Commission’s inception impact assessment are also very critical of the OES identification process, citing the lack of alignment as a major problem. Respondents have commented that the current approach can have negative consequences for competition, as similar companies might be subject to different requirements depending on the Member State where they operate. Moreover, having to cope with a multitude of requirements can increase the regulatory burden and costs for companies active in several Member States. 94 % of OPC respondents agree with the statement that from an internal market perspective the general “approach [of the Directive] increases costs for OES operating in more than one Member State”.When it comes to security requirements, 93 % of the OPC respondents agree with the statement that the “different level of prescriptiveness of requirements increases the regulatory burden for companies operating across different national markets”. Regarding incident reporting requirements, 87 % of respondents feel that the “different reporting thresholds and deadlines across the EU create unnecessary compliance burden for OES”. The many different reporting requirements a company is facing across the internal market do not only increase its costs but can also consume valuable resources that could be used for the handling of an incident. Along similar lines, the respondents to the Commission’s inception impact assessment are largely in favour of more harmonized security and incident notification requirements. When it comes to national enforcement, 75 % of respondents that provided an answer disagreed with the statement that “there is a sufficient degree of alignment of penalty levels between the Member States”.Finally, 86 % of respondents support the statement that the approach of the Directive “leads to significant differences in the application of the directive and has a strong negative impact on the level playing field for companies in the internal market”.

2.1.3.Low level of joint situational awareness and lack of joint crisis response The cooperation between Member States in the field of cybersecurity does not lead to joint situational awareness from a strategic and operational point of view. Strategically, national authorities do not gather or share information to assess the state of cybersecurity in the EU nor structured feedback from businesses. Operationally, there is no regular information sharing on the impact of cybersecurity incidents and threats at national or EU level. The sharing of information about incidents within the Cooperation Group is voluntary and on ad-hoc basis. As a result of the small number of incidents reported on national level (section 2.2.1), the incidents submitted annually by Member States to the Cooperation Group only represent a small subset of the incidents taking place within the EU. Member States have rarely made use of the cross-border notification provisions, which require them to inform other Member States affected by incidents. Despite the efforts of the Cooperation Group, the information exchange between Member States on cross-border dependencies remains limited, leading to conclude that Member States are not fully integrating potential cybersecurity-related cross-border spillovers into their risk assessments. As far as the CSIRTs network is concerned, information is shared also on an ad-hoc basis and does not contribute to the development of a systematic, comprehensive situational picture about incidents identified across the EU. Under the current rules, neither the Commission nor the cooperation fora are able to: ·systematically analyse and detect differences and patterns in attack intensity between Member States and sectors, subsectors and types of entities, ·jointly determine in which (sub)sectors and types of entities competent authorities should channel resources, ·have a comparative view across Member States on the resilience and preparedness of public and private entities and the degree of institutional maturity. Finally, there is no mutual assistance in incident response (operational cooperation) on European level beyond the sharing of information within the different cooperation fora established by the NIS Directive. For example, Member States do not lend operational support to each other in the event of a major incident or crisis, including during the recent COVID-19 crisis, which gave rise to a number of new cybersecurity related challenges. 2.2.What are the problem drivers? 2.2.1.Lack of cybersecurity measures taken by key companies Overall, only a limited number of sectors is covered by the NIS Directive and, within these sectors, there are inconsistencies in the OES identification. As a result, a significant number of companies providing essential services outside the scope of the NIS Directive but also some companies in the sectors listed by the NIS Directive are not required by law to put in place adequate cybersecurity measures and report incidents. This includes new economic activities which have only relatively recently taken on an essential role within the economy, such as social networks. The fact that several Member States chose to apply the NIS Directive to additional sectors further highlights that the current scope of the Directive does not reflect all the entities considered as essential in a highly digitised and interconnected economy. The scope of the NIS Directive covers certain types of entities in seven sectors (OESs) and, in addition, three types of DSPs. The Statistical Classification of Economic Activities in the European Community (NACE) groups economic activity into 21 economic areas. Only six of these economic areas are covered by the Directive and within each of these areas only a subset of types of entities are included in the scope. The scope of the NIS Directive therefore only represents a fraction of the economic activities in the Member States. Investment in cybersecurity by entities not falling under the scope of the NIS Directive remains limited because entities do not have to bear the full costs of a potential incident, as some of the costs have to be borne by other parties, such as suppliers or customers. These negative externalities create an incentive for businesses not to limit their exposure to risk (so-called moral hazard). In addition, since in an interconnected economy the security of one institution highly depends on the security of other institutions (so-called interdependent security), companies have an incentive to free-ride by profiting from the security measures taken by other companies without sufficiently investing in cybersecurity themselves. Recent survey data suggests that moral hazard does play a role in investment decisions, with companies citing regulatory compliance as the leading factor for cybersecurity spending and not cybersecurity-related factors, such as reducing incidents and breaches. 2.2.2.Inconsistent treatment of entities covered by the Directive across Member States Underlying driver 1: Discrepancies in OES identification and DSP coverage In the OES report, the Commission has shown that there is a certain degree of fragmentation across the Union as regards the identification of OESs. National authorities have developed a wide variety of identification practices when it comes to the overall approach to OES identification, but also regarding the definition of essential services. For example, in the electricity subsector some Member States have identified “electricity supply” as an essential service while others have broken that service down into very granular categories, such as “distribution”, “transmission” or “production”. Moreover, there are inconsistencies between the thresholds used by competent authorities to identify OESs. For example, in the drinking water supply and distribution sector, some Member States identify waterworks as OESs when they serve more than 10,000 consumers while other Member States have set an OES identification threshold of 500,000 consumers. In addition, thresholds do not only vary quantitatively but also qualitatively. This diversity is partly due to the design of the NIS Directive (which provides Member States with a considerable level of discretion) and partly due to the different implementation methodologies used by the Member States. Because of the current identification landscape, the scope of the NIS Directive becomes fragmented, with some operators subject to additional regulation (because they have been identified by their respective Member State) while others providing similar services remaining excluded and not having to put in place cybersecurity measures (because they have not been identified). The identification of critical entities has traditionally been a central element of critical infrastructure protection. It has the clear benefit of taking into account regional or national specificities. And while identification can be considered a reasonable approach for ensuring resilience of critical infrastructure against non-cyber threats, the diversity produced by the identification process laid down in the NIS Directive seems inappropriate for raising the level of resilience of entities when it comes to cybersecurity, especially given their high degree of interconnectedness, the increased digitisation of the economy and the many interdependencies between operators and sectors. Competent authorities also reported major shortcomings in the design of the NIS Directive regarding the extent to which DSPs are covered by national rules. DSPs located in the EU fall under the jurisdiction of the Member State where they have their main establishment. However, the NIS Directive does not provide enough guidance to determine the main establishment. The non-EU based DSPs which offer services within the EU are deemed under the jurisdiction of the Member State where they have designated a representative. However, the NIS Directive does not require DSPs to inform the competent authority of the very Member State in which they have designated their representative. Taking into account the specific nature of digital services, the NIS Directive does not provide competent authorities with the necessary powers and means to determine which entities fulfil the requirements for being subject to their own jurisdiction and which fall under the jurisdiction of other Member States. As a result, competent authorities cannot exercise effectively their supervision tasks, with the consequence that DSPs are often de facto excluded from the application of the directive’s rules.

Underlying driver 2: Inconsistent security measures and reporting requirements The NIS Directive grants Member States considerable discretion to define both the cybersecurity measures that OESs have to put in place and the procedures and thresholds for reporting incidents. As a result, entities are faced with a wide range of different approaches across the Union. The evaluation of the functioning of the NIS Directive identified several inconsistencies in how security requirements have been put in place. For example, while most Member States have modelled their national requirements in line with international standards, some have chosen different standards (such as the ISO 27000-series or NIST standards) or even more specific national provisions. Member States have also chosen different degrees of prescriptiveness for the requirements. While some Member States imitated the approach of the NIS Directive by putting forward very general provisions, others are requiring companies to take very specific measures, which can go as far as specifying the minimum length of passwords. Along similar lines, Member States are free to define thresholds on which incidents to report. Even though Member States are required to take into account several factors (the number of users affected by an incident, its duration and its geographical spread), they are at liberty to set their own quantitative thresholds. As a result, the number of incidents reported by OESs in each Member State differs significantly and does not reflect the scale of incidents affecting companies’ network and information systems: For example, during the 2019 annual summary reporting exercise, while one Member State reported to have received 266 incident reports, six Member States have received either no or only one single incident report. The remaining Member States received between 2 and 31 reports. Overall, Member States have defined relatively high thresholds for incident reporting for OESs, which has led to only few incidents being reported. Member States are also free to determine at what time and how an incident shall be reported. Companies operating in several Member States are therefore confronted with a variety of different reporting requirements. Underlying driver 3: Ineffective supervision and enforcement While the NIS Directive requires Member States to ensure that competent authorities have the powers and means to assess operators’ compliance of essential services with their obligations, it does not define any supervisory standards that competent authorities should live up to. As a result, the supervisory measures taken by competent authorities deviate significantly and put in question their effectiveness. For example, in-depth checks of the security measures taken by OESs are limited. While the NIS Directive requires competent authorities to supervise OESs in an active manner, this is not the case for DSPs: Despite the fact that digital services covered by the Directive, such as cloud services, are just as essential for the economy as services provided by OESs, DSPs are only to be supervised reactively ex-post (i.e. once the authority has been made aware of any shortcomings). This means that a large majority of DSPs in the internal market does not face any compliance checks at all. As a matter of fact, as most competent authorities are not even aware of the names of the DSPs falling under their jurisdiction, most DSPs are essentially never in touch with the authorities that are supposed to supervise them. As regards enforcement, the NIS Directive neither provides for principles and/or types of sanctions Member States should provide for in their national legislation, nor does it guide Member States on penalty levels that could ensure effectiveness, proportionality and dissuasiveness. The evaluation of the functioning of the NIS Directive has shown that, as a result, penalty levels vary considerably between Member States. For example, the level of maximum penalties ranges from around EUR 1,400 to EUR 5,000,000, or in the case of Member States applying percentages of the global annual turnover of undertakings, from 0.5% to 5%. With a median maximum penalty of around EUR 100,000, maximum penalties are too low in most Member States and are therefore neither effective nor dissuasive, especially when it comes to large companies. In addition, competent authorities have so far been reluctant to actually apply penalties. Not a single case of a penalty having been applied to a public or private entity has been brought to the attention of the Commission at the time of writing of this report. Underlying driver 4: Discrepancies in Member State capabilities There are significant differences in capability amongst Member States when it comes to dealing with the challenges posed by cyber threats. In the National Cyber Security Index from 2018, which provides an overview of the cyber security capacity of 100 countries worldwide, EU Member States differ significantly, scoring between 31.17 and 83.12 (out of a maximum of 100 points). Along similar lines, the Global Cybersecurity Index 2018 of the UN specialised agency for ICT (International Telecommunication Union – ITU) ranks EU Member States from 0.479 to 0.918 (on a scale from 0 to 1). It is worth noting that Member States were still in the process of fully transposing the NIS Directive at the time of writing of the two above-mentioned indexes. In fact, the Commission’s country visits in 2019 and 2020 have revealed major progress across the Union when it comes to national capabilities. Nonetheless, the country visits have also shown that competent authorities still exhibit different degrees of maturity when it comes to primary NIS-related tasks, such as OES identification, incident handling, supervision and cross-border cooperation. The Commission has also observed major differences in the degrees of achievement of a well-functioning cybersecurity ecosystem, including the ability to offer technical support to operators or set up sectoral or cross-sector cooperation fora. The amount of resources dedicated to cybersecurity policies at national levels and the degree of maturity in dealing with cybersecurity risks depend to a great extent on the level of economic development (different spending capacities), political prioritisation and advancement of cybersecurity measures prior to the NIS Directive. The impact of economic development is exacerbated by the fact that cybersecurity professionals compete on a European (if not global) market. During the NIS country visits, competent authorities from some Member States have lamented the fact that they do not have the financial capacities to compete with market salaries. 2.2.3.Voluntary nature of cooperation, limited information sharing and lack of crisis management structures Underlying driver 1: Voluntary nature of cooperation The provisions on cooperation laid down by the NIS Directive are often very general in nature. As a result, Member States tend to interpret them as voluntary. For example, the NIS Directive requires Member States to consult one another before identifying OESs that provide services in more than one Member State. To support Member States in carrying out cross-border consultations, the Cooperation Group issued a reference document in July 2018. However, only very few Member States have used the cross-border consultation procedure to engage with one another. Only two Member States have done so in a systematic manner. The main reasons for this lack of engagement are the fact that the NIS Directive does not specify how such consultations are supposed to be carried out or whether the authorities are required to mutually agree on a certain outcome of the consultation procedure. Also, no platform is provided to facilitate the exchange of confidential information between Member States (such as on cross-border dependencies). Moreover, in the event of an incident affecting another Member State, competent authorities are obliged to inform the other affected Member State if the incident significantly affects the continuity of essential services in that Member State. However, the NIS Directive does neither specify the modalities for information sharing nor does it set common objectives incentivising such exchange. As a result, this kind of information exchange rarely takes place. Finally, it is worth pointing out that the problems described in this section cannot be fully addressed by issuing additional guidance in the Cooperation Group alone, as Cooperation Group guidance is again voluntary and non-binding in nature, lacking the appropriate means to align national approaches to implementation. Underlying driver 2: Limited information feeding into the existing groups The Cooperation Group receives a summary report of incidents notified under the NIS Directive in each Member State, which represents a small subset of the overall incidents handled by an authority. The focus on incidents leaves out a wealth of information making it difficult to develop a shared understanding of the level of cybersecurity capabilities across the Union (e.g. uptake of cybersecurity solutions, human capital, level of skills in cybersecurity, maturity levels among sectors). Furthermore, the interaction with the private sector is limited and unstructured, making it difficult to reflect the needs of European stakeholders. Underlying driver 3: Lack of crisis management structures

Cooperation under the NIS Directive is voluntary and does not cover the entire crisis management cycle (from preparedness to coordinated response). The mandates of the Cooperation Group and the CSIRTs network, two fora setup by the NIS Directive to facilitate information sharing, also do not include crisis management. The Blueprint recommendation, adopted in 2017, was the first EU attempt to improve cooperation in times of crisis. However, while representing a valuable first building block, the recommendation remains non-binding and the task of building comprehensive EU crisis management framework remains incomplete. 3.How will the problem evolve? Emerging technologies will continue to drive digitisation within the economy and society as a whole. Increased use of artificial intelligence (AI), advancements in quantum computing or the roll-out of 5G networks are just some of the examples of how companies providing essential services will become even more reliant on technology and connectivity, resulting in an ever larger attack surface for malicious actors. According to the Internet Security Forum, cybersecurity will remain a major concern in the coming years: “By 2022, organisations will be plunged into crisis as ruthless attackers exploit weaknesses in immature technologies and take advantage of an unprepared workforce. [..] The impact of threats will be felt on an unprecedented scale as aging and neglected infrastructure is attacked and disrupted due to vulnerabilities in the underlying technology.” As a result, the number of cybersecurity incidents within the EU is likely to increase, triggering further costs for the companies directly affected by these incidents but also for the wider economy and citizens, as threats spread along supply-chains. As the general awareness of cyber-related risks is increasing, public and private entities in sectors outside the scope of the NIS Directive are likely to step up their investments in cybersecurity to some extent even without additional regulation. Estimates based on Gartner forecasts suggest that even for the sectors already covered by the NIS Directive, the ICT security spending is projected to grow by 12 % in the coming three to four years (section 7.1). At the same time, innovation in the field of cybersecurity and the roll-out of technologies with the potential of raising the level of cyber resilience will also contribute to making the provision of essential services more secure. However, in the absence of further regulatory intervention, moral hazard and the free-riding behaviour as described in section 2.1.1 will not disappear, as companies lack the incentives necessary to take into account the broader societal cost of cyber incidents when determining their level of investment in cybersecurity. At the same time, digitisation and exposure to cyber risks across sectors will continue to mount. As a result, public and private entities are very unlikely to take all the measures necessary to achieve a high level of cyber resilience on a voluntary basis. This is especially true for those entities currently not covered by the provisions of the NIS Directive, such as manufacturing companies or data centres, but also for entities that are under the scope of the NIS Directive but whose level of cyber resilience remains low due to problems and drivers described in sections 2.1.2 and 2.2.2 respectively. As the discrepancies in the OES identification process are mainly caused by the way in which the NIS Directive has been designed, they are very unlikely to disappear without additional intervention. Nonetheless, the Cooperation Group may continue issuing non-binding guidance to further align the identification process. In addition, some Member States have notified the Commission that they intend to identify additional operators in the near future. As a result, some of the discrepancies observed may be reduced as the national implementation of the NIS Directive is becoming more mature, but nevertheless such alignment is expected to be rather limited. As to the regulatory coverage of DSPs across the internal market, the provisions of the NIS Directive will continue to prevent competent authorities from ensuring that all companies take adequate cybersecurity measures. The Cooperation Group will continue issuing non-binding guidance to further align security measures across the Member States. However, as described in the evaluation on the functioning of the NIS Directive and in section 2.2.2, Member States have chosen very different approaches to imposing security measures. It will therefore be very difficult to encourage Member States to align measures to such an extent that the negative effects of fragmentation will disappear. As regards supervision, it is likely that the wide differences among supervisory approaches taken by competent authorities at national levels will be maintained, influenced also by the overall level of cybersecurity maturity and resources available. Furthermore, because of the shortcomings of the NIS Directive described in section 2.2.2, it is unlikely that all entities across the internal market will become subject to adequate supervisory measures. As to the supervision of DSPs across the Union, the shortcomings of the NIS Directive, notably as regards the overview by the competent authorities, the applicable jurisdiction rules and the supervisory regime make it likely for these to continue to operate under the radar of competent authorities. With the NIS ecosystem expected to become more mature in the coming years and the increased awareness of policy makers regarding cyber risks, it is possible that Member States will provide more funding to competent authorities. However, as the problem drivers described in section 2.2.2 are of a long-term structural nature, the discrepancies in Member State capabilities are likely to remain considerable. The regular exchange and cooperation within the fora established by the NIS Directive is likely to continue to have a positive effect on trust and confidence amongst their members and can further boost information sharing in the medium term. Nonetheless, as described in section 2.2.2, the lack of information exchange and the deficiencies in the existing structures facilitating stakeholder consultation and operational cooperation, including crisis management, will continue to prevent a notable increase in information sharing and operational cooperation. 4.Why should the EU act? 4.1.Legal basis The current legal basis of the NIS Directive is Article 114 of the Treaty on the Functioning of the European Union (TFEU), whose objective is the establishment and functioning of the internal market by enhancing measures for the approximation of national rules. Any proposed actions would build on the objectives of the current NIS Directive. They would also improve the level playing field for companies in the internal market, subjecting them to the same requirements across the Union. Any new legislative act would therefore have the same legal basis as the current NIS Directive. 4.1.Subsidiarity: Necessity of EU action Cybersecurity resilience across the Union cannot be effective if approached in a severed manner through national or regional silos. The NIS Directive came to address this shortcoming, by setting a framework for network and information systems security at national and Union levels for legal, policy, institutional, technical and operational measures, as well as for cross-border cooperation. The transposition and implementation of the NIS Directive also brought to light inherent flaws of certain provisions or approaches which, in spite of the intended effects, affected the authorities’ and industries’ focus on core cybersecurity issues. As described in section 2 above, some of these flawed provisions concern the unclear delimitation of the scope of the NIS Directive leading to fundamental differences in the extent and depth of de facto EU intervention at Member State level. Furthermore, while notable progress was made in terms of cooperation across borders, the current voluntary cooperation remains largely at policy level, while at operational level it is rather limited to an ad-hoc or regional basis. All these inherent flaws have eventually led to considerable disparities across the Member States in terms of capabilities, planning and level of protection, which affect at the same time the level playing field for similar companies on the internal market. Information asymmetry and lack of transparency risk undermining the supply by market operators and manufacturers of networks, services and products, as well as the trust of the users, which is one of the key drivers of the internal market. Last, but not least, well-functioning networks and systems are essential for the EU economy. Since the COVID-19 crisis, the European economy has grown more dependent on network and information systems than ever before and sectors and services are increasingly interconnected. Disruptions resulting from cybersecurity incidents are increasing in frequency and magnitude with the potential of undermining the internal market, including negative consequences for growth and jobs.

For all the above-mentioned reasons, the first periodical review of the NIS Directive, as requested by Article 23 thereof, created the opportunity for further EU action in relation to the NIS framework. Such EU action would also aim at addressing more effectively cases with cross-border relevance, where further coordination at the level of planning and response, as well as mutual assistance, are needed. 4.1. Subsidiarity: Added value of EU action EU intervention going beyond the current measures of the NIS Directive is justified by the subsidiarity principle mainly due to the: Øcross-border nature of the problem. Given the cross-border nature of NIS threats and problems, a non-intervention at EU level to improve the current NIS framework would lead to a situation where Member States’ joint action would remain rather limited, taking insufficient account of the cross-border and cross-sector interdependence as regards the network and information systems. An appropriate degree of coordination among the Member States, on the other hand, would ensure that NIS-related risks can be well managed in the cross-border context in which they also arise, and therefore respects the subsidiarity principle. Øpotential of EU action to improve and facilitate effective national policies. Øcontribution of concerted and collaborative NIS policy actions to effective protection of fundamental rights, specifically the right to the protection of personal data and privacy. European citizens are increasingly entrusting their data to complex information systems, either out of choice or out of necessity, without necessarily being able to correctly assess the related data protection risks. When incidents occur, they will therefore not necessarily be able to take suitable steps, nor is it certain that the Member States would be able to effectively address cross-border incidents in the absence of an effective EU-wide NIS coordination. As regards the proportionality of the approach, the measures in the policy options considered do not go beyond what is needed to achieve the general and specific objectives, and do not impose disproportionate costs. As shown in sections 7 and 8, the measures proposed in the considered policy options to further streamline the security requirements and reporting obligations at Union level take account of the already existing practices in the Member States. An enhanced level of protection achieved through such streamlined requirements would be proportionate to the risks faced and hence reasonable and generally corresponding to the interest of the entities involved in ensuring continuity and quality of their services. The costs for ensuring systematic cooperation amongst Member States would be small when compared to the economic and societal losses and damages which may be caused by NIS incidents. Furthermore, the stakeholder consultations held in the context of the NIS review, including the OPC results (Annex 2) and the targeted surveys conducted by the NIS review study (Annex 6) show support for the revision of the NIS Directive along the above-mentioned lines. 5.Objectives: What is to be achieved? This section identifies the general and strategic objectives for a possible EU intervention to address the gaps identified in section 1. 0.0.General objectives There are three general policy objectives, which describe the overarching goals of a possible EU intervention: 1)Increase the level of cyber resilience of a comprehensive set of businesses operating in the European Union across all relevant sectors, the main general objective, by putting in place rules that ensure that all public and private entities across the internal market, which fulfil important functions for the economy and society as a whole, are required to take adequate cybersecurity measures. 2)Reduce inconsistencies in the resilience across the internal market in the sectors already covered by the NIS Directive, by further aligning (1) the de-facto scope of the legal instrument, (2) the security and incident reporting requirements that public and private entities are required to put in place, (3) the provisions governing national supervision and enforcement and (4) the capabilities of competent authorities in the Member States. 3)Improve the level of joint situational awareness and the collective capability to prepare and respond, by taking measures aimed at increasing the level of trust between competent authorities, by sharing more information and by putting in place rules and procedures in the event of a large-scale incident or crisis. These objectives are interrelated: ·Synergies: Reducing internal market fragmentation would contribute to increasing the level of cyber resilience in Member States as public and private entities subject to less stringent requirements would have to adhere to stricter rules. In addition, measures aimed at increasing the level of joint situational awareness would also have a positive impact on the level of resilience of public and private entities as such entities would benefit from the cooperation between competent authorities. ·Trade-offs: enhancing security could entail additional costs and constraints to the digital single market. For example, the implementation of increased security measures could bring additional costs to businesses, which could have a negative impact in their operations, in particular for SMEs. 0.0.Specific objectives The specific objectives are defined for each area for which problems and problem drivers were described. To address the problem of low level of cyber resilience of businesses operating in the European Union

1.Ensure that entities in all sectors that are dependent on network and information systems and that provide key services to the economy and society as a whole are required to take cybersecurity measures and report incidents with a view to increasing the overall level of cyber resilience throughout the internal market To address the problem of inconsistent resilience across Member States and sectors 2.Ensure that all entities that are active in sectors covered by the NIS legal framework and that are similar in size and have a comparable role are subject to the same regulatory regime (are either inside or outside the scope) no matter under which jurisdiction they fall within the EU 3.Ensure that all entities that are active in sectors covered by the NIS legal framework are required to follow aligned obligations based on the concept of risk management when it comes to security measures and must report incidents based on a uniform set of criteria 4.Ensure that competent authorities enforce the rules laid down by the legal instrument more effectively through aligned supervisory and enforcement measures 5.Ensure a comparable level of resources across Member States allocated to competent authorities that would allow them to fulfil the core tasks laid out by the NIS framework To address the problem of joint situational awareness and lack of joint crisis response 6.Ensure that essential information is exchanged between Member States by introducing clear obligations for competent authorities to share information and cooperate when it comes to cyber threats and incidents and by developing a Union joint operational crisis response capacity A review should evaluate in how far these objectives have been achieved within 54 months after coming into force. 6.What are the available policy options? 0.0.Description of the policy options This section presents the policy options, including the baseline scenario, that have been considered for addressing the problems identified in Section 2 and meeting the objectives set out in Section 5. The policy options analysed are designed based on the degree and nature of a potential intervention and in a ‘package’ format that groups envisaged actions and measures in the main areas that are already included or considered for being included in the NIS framework: (1) the sectoral scope and coverage of entities; (2) security requirements and reporting obligations (3) supervision and enforcement; (4) cooperation and information sharing (including the aspects relating to crisis management). The actions and measures envisaged in the areas of intervention, which correspond to the specific objectives, are interrelated and linked to the type and degree of intervention. The policy options are, therefore, developed as a unified set of actions and measures in the above-mentioned areas which function as a whole: the policy choice made in one area being dependent on the choices made in the others. Furthermore, the description of each policy option includes a reference to the synergies with other related instruments, including sector-specific legislation or policies. The list of actions and measures in the areas of intervention analysed within the policy options was developed with the purpose of putting forward viable alternatives. The description of each policy option therefore refers to potential alternatives for the areas of intervention that were not considered viable and explains the reasons why. The intervention logic and the links between problem drivers, specific objectives and policy options is illustrated by Table 1 below. A more detailed table with an overview of the policy options and their correspondence with the specific objectives is also included in Annex 8. Problem drivers Specific policy objectives Policy options PO0 (status quo) PO1 (non-legislative) PO2 (limited changes) PO3 (subst. changes) DR1: Lack of cybersecurity measures taken by key companies SPO1: Entities in NIS-dependent sectors to take measures and report incidents Keep scope, requirements and obligations. Continue existing CG and CSIRTs network work Keep scope, requirements and obligations + guidance Extend scope with OES and DSP categories Extend scope and introduce categories essential and important with different requirements DR2.1: Discrepancies in OES identification and DSP coverage SPO2: Similar entities in covered sectors subject to the same regulatory regime Guidelines on OES identification and coverage of DSPs Harmonize essential services and identification thresholds. Replace identification by uniform criteria for all entities, excluding micro or small. ¾Clearer DSP definitions ¾Clarify jurisdiction rules ¾Equal footing for OESs and DSPs ¾Equal footing for all entities in same category ¾Registry of cross-border digital service providers ¾Clear jurisdiction DR2.2: Inconsistent security measures and reporting requirements SPO3: Entities to follow aligned security and reporting obligations Guidelines on security and incident reporting requirements Harmonize security and reporting requirements ¾Introduce uniform security and reporting requirements ¾Explicit incident reporting rules Explicit incident reporting requirements DR2.3: Ineffective supervision and enforcement SPO4: Competent authorities to enforce more effectively Guidelines on supervision and enforcement Principles for supervisory measures and penalties ¾Principles + minimum requirements ¾General conditions + minimum level for fines ¾Peer-review system ¾Liability rules for natural persons Guidelines on DSPs supervision Subject DSPs to the same rules as OES ¾Subjecting entities under the same category to the same regulatory regime ¾Important entities subject to a light-touch regime DR2.4: Discrepancies in Member State capabilities SPO5: Comparable level of resources allocated to authorities Incentivise MS to adequately fund their competent authorities and other relevant structures MS to take measures to ensure that the competent authorities have the necessary resources Peer-review mechanism to assess the capabilities of MS DR3.1: Voluntary nature of cooperation SPO6: Essential information to be exchanged between MS by introducing clear obligations and by developing a joint operational crisis response capacity Continue existing work of the Cooperation Group and the CSIRTs network ¾Further develop SOPs by the Cooperation Group and the CSIRTs network. ¾Launch CyCLONe, without a set legal framework. Mandate or incentivize information sharing for competent authorities and companies (ISACs, PPPs) ¾Mandatory mutual assistance and cooperation ¾Voluntary info sharing through ISACs and PPPs ¾MS to develop CVD policies ¾ENISA as state of cybersecurity observatory ¾Regular reports on the state of cybersecurity DR3.1: Limited information feeding into the existing groups DR3.1: No crisis management structures Crisis management framework, for both national and EU levels, including institutionalising CyCLONe Option 0: Baseline scenario – maintaining the status quo In this scenario, the NIS Directive would remain unchanged and no other measures of non-legislative nature would be taken to target the problems identified by the evaluation of the NIS Directive. A more sector-specific shift could be expected in this scenario, advancing sectoral legislation that would also include cybersecurity aspects. The Cooperation Group and the CSIRTs network would continue the activities in line with their mandates, leading to further voluntary information sharing, exchange of practices and development of reference documents and guidance. The Cooperation Group would continue expanding to sector-specific work streams. However, in the medium and long term, the drivers of cybersecurity policies at EU level would mainly stem from other related legal acts and policy measures, be them sector-specific or cross-sectoral. This would maintain the fragmented approach on cybersecurity across the EU, with more ad hoc solutions and less coherent responsibility sharing.

In particular, in the areas covered by the specific objectives (section 5.2.) the following main developments would be expected: 1.Sectoral scope and coverage of entities The sectors and services that fall under the scope of the NIS Directive would remain unchanged. In this scenario, it is expected for a subset of Member States to identify OESs in certain sectors, while the imbalance in key operators’ preparedness would deepen, with potential negative consequences for the internal market. Sectors and services which have developed interdependencies with other essential sectors or have proven essential in times of COVID-19 crisis, would remain outside the NIS scope. 67% of the competent authorities responding to the NIS review study survey considered that the NIS Directive does not effectively cover all relevant (sub)sectors essential for the economy and society as a whole. The OES identification process and the DSP coverage would remain unchanged. Some further guidance could be expected as part of the Cooperation Group’s work, as well as via the EU Agency for Cybersecurity (ENISA). No change in the identification process would perpetuate or potentially amplify existing shortcomings. The sectoral work streams of the Cooperation Group are expected to further expand and more sector-specific guidance issued. Some further sector-specific legislation (e.g. in relation to energy or transport) may also be expected. Relying on only sector-specific initiatives is likely to have very little impact on the overall level of cross-sector and cross-border cyber resilience in the EU. Cyberattacks and vulnerabilities are often not sector- or country-specific. More information on cross-sector and cross-border propagation of incidents is included in Annex 9. 2.Security requirements and reporting obligations The current system for setting the security requirements and the thresholds for incident notifications would remain unchanged. Further guidance on these aspects is expected through the work of the Cooperation Group and ENISA. However, this would not be likely to effectively address the problems identified in practice and highlighted in section 2.1. 76% of the OES responding to the NIS review study survey faced challenges in implementing the NIS security requirements, while 71% consider that the misalignment of security requirements is among the main shortcomings of the current NIS Directive. This matches the views of the competent authorities. Currently there is a very low number of reported incidents. Each year a number of Member States report zero incidents, while the majority report very low numbers. Very few Member States (on average 5) report incidents concerning DSPs. The last two years did not show any notable improvement and it is highly likely that, without a change in the common denominator and clarity of reporting obligations, no conclusive picture of incidents, underlying causes, typology and effects may be drawn at EU level. 3.Supervision and enforcement The approaches towards supervision and enforcement at Member State level would remain unchanged and uneven. The light-touch approach on the DSP supervision would be maintained. The Cooperation Group could issue guidelines on such approaches, but given the differences encountered so far and how little enforcement systems have been used, it appears as highly unlikely for such guidance to increase alignment across the EU on these matters. 70% of respondents to the NIS review study surveys targeting competent authorities considered that their supervisory powers are effective only to some or to a moderate extent. By perpetuating the current approach towards the supervision and enforcement system, it is unlikely the addressees of the NIS requirements would be dissuaded from non-compliant behaviour. The differences in the Member States’ capabilities are likely to be largely maintained, depending also on the evolution of national economies, as well as the political will at national level at any given moment and the priority given to cybersecurity on the political agenda. The NIS review country visits revealed insufficient resourcing of competent authorities and CSIRTs in a number of Member States, with adverse effects on the build-up of cybersecurity capabilities and trust among authorities across borders. The cybersecurity competence centre and its related network, as well as the funds made available through Digital Europe and Horizon Europe programmes, would have a certain impact in this regard, but they cannot compensate for the level of cybersecurity policy prioritisation and political will at national levels. 4.Cooperation and information sharing In terms of cooperation and information sharing of public authorities and private entities, this would remain largely voluntary. The Cooperation Group and the CSIRTs network would also continue to function within the existing mandate. Information sharing, for both national authorities and private entities, appears to take place scarcely. At operational level, a survey conducted by ENISA in July 2020 among the CSIRTs network revealed that, while the network is overall satisfied with its activities, it considers that more needs to be done to improve operational information exchange and operational support in addressing cross-border incidents. Currently, there are seven sector-specific ISACs identified at EU level and the tendency is to encourage the setting up of more such partnerships, both at EU level and at national level. Without a clearer framework for information exchange, the impact of these developments is likely to be limited and dispersed in time. As regards crisis management, currently there is no established European framework for cybersecurity crisis management. Building on the Blueprint Recommendation issued based on the NIS framework, CyCLONe is being developed at operational level. Member States largely support this initiative and have already designated their contact points in CyCLONe, even if the structure is only voluntary. While this project is materialising, it would still benefit from a legal framework as a basis to ensure coherence, structure and certainty. In the NIS review consultations, a third of the Member States raised the need for formalizing CyCLONe within the NIS framework, clarifying the links between CyCLONe (operational level) and the CSIRTs network (technical level), and considering establishing an EU crisis management framework within the NIS context. At political level, crisis management is carried out through horizontal instruments, such as the Council Integrated Political Crisis Response (IPCR) arrangements (for Member States), the Commission ARGUS high-level cross-sectoral crisis coordination process (for the Commission) and the EEAS Crisis Response Mechanism. The EU civil protection mechanism, which aims to improve prevention, preparedness and response to disasters, does not have a cybersecurity focus. 5.Synergies with other related instruments The NIS Directive provides for a lex specialis principle, establishing that where a sector-specific Union legal act provides for equivalent cybersecurity requirements or incident notification obligations, the latter shall apply. This principle is, for example, currently applicable in the case of the security requirements and notification obligations for payment service providers as stipulated in the Directive on payment services in the internal market (‘PSD2’).

The proposal for a Digital Operational Resilience Act (DORA) for the financial sector, if adopted, will also represent such lex specialis for all financial services as it provides detailed provisions on security requirements and reporting obligations. The DORA framework envisages a one-stop-shop, proposing a system of reporting major ICT-related incidents to competent authorities in the financial sector which in their turn would notify the NIS single points of contact Nevertheless, the lex specialis provisions of the NIS Directive have also triggered certain interpretation challenges in practice. Thus, certain Member States included under the NIS scope sectors where specific regulations provided also for cybersecurity requirements. In addition, security-related obligations are provided in some other EU instruments, such as those concerning the public electronic communication providers in the European Electronic Communications Code or the Regulation on electronic identification and trust services for electronic transactions in the internal market (eIDAS). These services are now excluded from the scope of the NIS Directive. Another related EU legal instrument is the Directive on the European Critical Infrastructure (ECI). The ECI Directive is limited only to infrastructures the destruction or disruption of which would have a significant cross-border impact. The ECI Directive is therefore limited to physical protective arrangements. While both critical (physical) infrastructures and network and information systems are by their nature crucial to the provision of essential services, the ECI Directive is focused on the protection of specific assets that provide certain essential services; instead, the NIS Directive takes a broader approach that aims at ensuring a high and common level of security for the essential services as such (some of which are provided by infrastructures designated as ECIs). A review of the ECI Directive is envisaged. The envisaged ECI revision aims to replace the current ECI Directive with an overarching cross-sectoral framework to enhance the resilience of operators of essential services in the sectors covered by the NIS Directive, as well as telecommunications and space.The envisaged initiative is complementing the NIS Directive, avoiding overlaps. It would entail a different material approach and different types of measures and means which complement each other. The ECI framework would establish minimum requirements to address non-cyber threats for operators defined as critical as it focuses on enhancing the security of physical assets against threats such as terrorism and other intentional and unintentional man-made threats, as well as natural hazards. Option 1: Non-legislative measures to align the implementation of the NIS Directive In this scenario, there would be no changes at legislative level. Instead, the Commission would issue recommendations and guidelines, upon consultation of the Cooperation Group, ENISA and, as applicable, the CSIRTs network. In particular, aside the developments described in the baseline scenario, which are also expected in this option, the following additional measures and/or developments are expected: 1.Sectoral scope and coverage of entities In this policy option, the sectoral scope of the NIS Directive, the OES identification process and the DSP coverage would remain unchanged, same as in the baseline scenario. At the same time, the sectoral work streams of the Cooperation Group corresponding to the current scope are expected to further expand and more sector-specific guidance could be issued in this context, including by the Commission, in cooperation with various work streams of the Cooperation Group and ENISA. Further sector-specific legislation would also be expected, as in the baseline scenario. In addition to the baseline scenario, more guidance and recommendations would be issued by the Commission on sector-specific aspects stemming from the differences in the OES identification process. 2.Security requirements and reporting obligations In this policy option, in addition to the expected developments in the baseline scenario, the Commission would issue recommendations on security requirements or thresholds for incident reporting and potentially DSP-related aspects, including jurisdiction issues. 3.Supervision and enforcement In this scenario, no changes would be expected as compared to the baseline scenario. The Commission is unlikely to issue recommendations to the Member States on these aspects since the current NIS Directive provisions are of very general nature in this respect and the discretion of the Member State is too wide. The Cooperation Group could potentially agree to issue certain guidelines on such approaches, but given the differences encountered in practice so far and the little use of the enforcement systems it appears as highly unlikely for such guidance to have a potential to raise the level of alignment across the EU on these matters. The light-touch approach on the DSP supervision would remain in force. The differences in the Member States’ capabilities are likely to be largely maintained, depending also on the evolution of the potency of national economies, as well as the political will at national level at any given moment and the priority given to cybersecurity on the political agenda 4.Cooperation and information sharing As in the baseline scenario, the cooperation among public authorities and private entities would remain largely of voluntary nature. The Cooperation Group and the CSIRTs network would also continue to function within the existing mandate. In addition to the baseline scenario, the Commission may issue recommendations to encourage Member States to set up information-sharing frameworks or tools, such as Information Sharing and Analysis Centres – ISACs (with participation of public authorities) or other public private partnerships (PPPs). In this scenario, self-regulatory solutions within ISACs or PPPs could be incentivised and supported. However, self-regulatory solutions in a global digital environment have proven challenging. Giving more prominence to self-regulatory solutions as compared to regulatory intervention would raise additional fragmentation risks, with little evidence of effectiveness of supervision of security-related requirements in suc