EUROPEAN COMMISSION Brussels, 16.12.2020 SWD(2020) 358 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT

Accompanying the document Proposal for a Directive of the European Parliament and of the Council on the resilience of critical entities {COM(2020) 829 final} - {SEC(2020) 433 final} - {SWD(2020) 359 final}



Table of contents 1.Introduction: Political and legal context 2.Problem definition 2.1 What is the problem? 2.2 What are the problem drivers? 2.2.1 Driver 1: Risk assessment requirements are not comprehensive and do not account for complex interdependencies 2.2.2 Driver 2: Diverging sectoral coverage and designation criteria 2.2.3 Driver 3: Critical Infrastructure resilience policies and approaches are divergent at different levels and between sectors 2.2.4 Driver 4: Uneven capacities and limited exchange of information 2.2.5 How will the problem evolve? 3.Why should the EU act? 3.1 Legal basis 3.2 Subsidiarity: Necessity of EU action 3.3 Subsidiarity: Added value of EU action 4.Objectives: What is to be achieved? 4.1 General objective 4.2 Specific objectives 5.What are the available policy options? 5.1 What is the baseline from which options are assessed?

5.2 Description of the policy options 5.2.1 Policy Option 1: Non-legislative measures at EU level to encourage more common approaches and information-sharing 5.2.2 Policy Option 2: Revised selection criteria and requirements for operators of European Critical Infrastructures (ECIs) 5.2.3 Policy Option 3: New requirements on critical entities 5.2.4 Policy Option 4: New requirements on critical entities and a reinforced role for the EU 5.3 Options discarded at an early stage 5.4 Synergies with the revision of the NIS Directive 6.What are the impacts of the policy options? 6.1 Economic impacts 6.2 Social impacts 6.3 Environmental impacts 6.4 Impact on fundamental rights 7.How do the options compare? 7.1Effectiveness 7.2Efficiency 7.3Coherence 7.4Proportionality 8.Preferred option 8.1 Presentation of the preferred option 8.2REFIT (simplification and improved efficiency)

9How will actual impacts be monitored and evaluated? Annex 1: Procedural information Lead DG, Decide Planning/CWP references Organisation and timing Consultation of the RSB Evidence, sources and quality Annex 2: Stakeholder consultation 2.1Consultation strategy 2.2 Consultation activities and results 2.2.1 Consultation of competent Member State authorities via online survey 2.2.2 Targeted written consultation of Member States and CI operators 2.2.3 In-depth interviews (virtual ‘field visits’) 2.2.4 Consultative workshops 2.2.5 Inception Impact Assessment 2.2.6 Additional feedback 2.3 Stakeholder participation Annex 3: Who is affected and how? 3.1 Practical implications of the initiative 3.2 Summary of costs and benefits Annex 4: A dynamic, operational context for CI operators

Annex 5: Moving from threat protection to risk-based resilience Annex 6: Overview of national policies, relevant EU initiatives and International Frameworks Annex 7: Overview of the policy options Glossary Term Acronym Artificial intelligence AI Computer security incident response team CSIRT Continuity of government COG Critical entity of European significance CE-ES Critical information infrastructure CII Critical infrastructure CI Critical infrastructure protection CIP Critical infrastructure resilience CIR Critical Infrastructure Protection Point-of-Contact CIP PoC Critical Infrastructure Warning Information Network CIWIN Digital Operational Resilience Act DORA European Union Agency for Cybersecurity ENISA European Union Programme on Prevention, Preparedness and Consequence Management of Terrorism and other Security-Related Risks European Critical Infrastructure European Critical Infrastructure Protection European External Action Service European Programme for Critical Infrastructure Protection European Reference Network for Critical Infrastructure Protection Extreme weather event Foreign direct investment Global navigation satellite systems Industrial control system Information and communications technology Internal Security Fund International Standards Organisation Multiannual Financial Framework National critical asset National critical infrastructure Network and Information System North Atlantic Treaty Organization Operator of essential services Operator Resilience Plan Operator Security Plan Organisation for Economic Co-operation and Development Personal protective equipment Public-private partnership Regulatory Fitness and Performance Programme Supervisory control and data acquisition SCADA Security Liaison Officer SLO Small- or medium-sized enterprises SME Treaty establishing the European Community TEC Treaty on European Union TEU Treaty on the Functioning of the European Union TFEU Union Civil Protection Mechanism UCPM United Nations International Strategy for Disaster Reduction UNISDR United Nations Office for Disaster Risk Reduction UNDRR Unmanned aircraft system UAS World Health Organisation WHO Term Definition Critical infrastructure An asset, system or part thereof located in Member States which is essential for the maintenance of vital societal functions, health, safety, security, economic or social well-being of people, and the disruption or destruction of which would have a significant impact in a Member State as a result of the failure to maintain those functions European critical infrastructure An infrastructure the disruption or destruction of which would have significant cross-border impact on at least two Member States



1.Introduction: Political and legal context The livelihoods of European citizens and the health of the European economy and internal market depend on the reliable provision of different kinds of essential services, i.e. those that are essential for maintaining critical societal and economic activities. These services, vital in the best of times, are all the more crucial as Europe continues to manage the effects of and gradually recover from the ongoing Coronavirus pandemic. The provision of essential services to European citizens and businesses depends on the reliable performance of critical infrastructures (CIs). This means that the infrastructures must be resilient, i.e. able to resist, absorb, accommodate to and recover from incidents that have the potential to result in disruptions. In other words, they must be adequately protected against different risks and able to ‘bounce back’ into operation in the event of disruptions that will nevertheless occur from time to time (see Annex 5). Given the European implications of CI disruptions, the EU has taken different actions, including through the European Programme for Critical Infrastructure Protection (EPCIP) and the 2008 European Critical Infrastructure (ECI) Directive. The Directive, which applies only to the energy and transport sectors and focuses solely on protective measures in the face of primarily terrorist threats of a non-cyber nature, provides a procedure for designating ECIs, the disruption or destruction of which would have significant cross-border impact on at least two Member States, as well as requirements for ECI operators and the Member States that host them. To date, only 94 ECIs have been designated, of which two-thirds are located in three Member States. The scope of the EU’s work on CI extends beyond the EPCIP and the ECI Directive. Since 2008, sectoral and cross-sectoral actions on inter alia climate proofing, civil protection, foreign direct investments (FDI) and cybersecurity (Network and Information Systems Directive) have been adopted (see Annex 6).Besides implementing these and other EU legislation, Member States have continued to refine their own policies, strategies and frameworks, albeit in ways that are often divergent. Like the legislative landscape, the environment in which competent authorities and critical infrastructure operators act has changed significantly (see Annex 4). The operators face a range of risks, including cyber- and cyber-enabled attacks (addressed by the NIS Directive), natural hazards, hybrid actions, terrorism, insider incidents, epidemics, and certain kinds of accidents (such as industrial accidents). Compared to 2008 when the ECI Directive was adopted, some of these risks have gained in importance in terms of frequency and potential damage they can cause, such as extreme weather events, which are exacerbated by climate change. Other threat are of increasing concern, such as hybrid threats or the risk of insiders’ infiltration, and others are unprecedented in scale, such as pandemics. In addition, the integration of technological innovations like 5G and drones has the potential to be exploited by malicious actors. Finally, CIs are increasingly interconnected and reliant upon one another (see box 2 and 3 for examples), and the disruption of an infrastructure in disparate sectors might produce cascading effects and bring disruptions to other infrastructures and sectors, including across borders. Several proposals have been made in recent years to reform the EU’s approach to critical infrastructures. For instance, the 2017 Comprehensive Assessment of EU Security Policy called for the revision of the ECI Directive. In 2018, the European Parliament made a similar call, emphasising the need to achieve better alignment with the NIS Directive. The following year, the Council encouraged the Commission to consult with Member States on a possible revision of the ECI Directive in light of the evolving cross-border and cross-sectoral interdependencies between CIs across Europe and in view of the uninterrupted functioning of the internal market. The same year, the Commission published the findings of its own evaluation of the Directive. The evaluation found that while the Directive was successful in bringing more attention to bear on the topic, the protection- and asset-oriented nature of the Directive’s provisions were only partially relevant in the face of various developments since 2008.

In July 2020, the Commission adopted the EU Security Union Strategy, which acknowledged the increasing interconnection and interdependency between physical and digital infrastructures. It underlined the need for a more coherent and consistent approach between specifically the NIS Directive and the ECI Directive to ensure the reliable provision of essential services. The two instruments are therefore being reviewed in parallel. Nevertheless, given their differences (as shown in the box below), this Impact Assessment focuses on measures to enhance critical infrastructure resilience in the face of non-cyber risks, including natural hazards, hybrid actions, terrorism, insider incidents, epidemics, and accidents. Where relevant, it explores common elements with the ongoing review of the NIS Directive, including as regards the sectoral scope. The analysis in the report therefore goes beyond transport and energy sectors of the ECI Directive. Box 1: Interplay between the NIS Directive and the ECI Directive The NIS and ECI Directives have a similar objective aimed at ensuring the security of key actors in a number of crucial sectors, and have a similar process/logic by which Member States identify and designate those key actors that require particular guidance and oversight. At the same time, they present some differences: Material scope and threats: while the NIS Directive is focused on the security of network and information systems against cyber threats, the ECI Directive is focused on enhancing the security of physical assets against threats such as terrorism and other intentional and unintentional man-made threats, as well as natural disasters. Geographical impact: the ECI Directive is limited to those infrastructures, the destruction/disruption of which would have a significant cross-border impact, while the NIS Directive covers operators without explicitly requiring Member States to determine if negative cross-border effects can be anticipated in the event of a disruption. Asset vs. services approach: while both critical (physical) infrastructures and network and information systems are by nature crucial to the provision of essential services, the ECI Directive is focused on the protection of specific assets that provide certain essential services. The NIS Directive takes a broader approach that considers essential services as a whole (some of which are provided by infrastructures designated as ECIs). In the case of a given electricity supplier, for instance, the NIS Directive would focus on the cybersecurity of the communication networks, devices and data related to the service that the operator provides; while the ECI Directive would mainly focus on the security of specific facilities (e.g. a specific power plant, the building, surrounding perimeter, etc.) in the face of risks of non-cyber nature. In practice, this creates a situation in which actors may be designated as both ECIs and operators of essential services under the NIS Directive. This means that the network and information systems that underpin their operations are subject to requirements per the NIS Directive. Meanwhile, the ECI Directive sets out certain requirements concerning their physical security. Sectoral scope: while the ECI Directive is limited to energy and transport, the NIS Directive applies to seven sectors: transport; energy; banking; financial market infrastructure; health; drinking water supply and distribution; and digital infrastructure. Protection vs. resilience the ECI Directive focuses on physical protective arrangements, while the NIS Directive obligates operators to take risk management measures in relation to network and information systems to ensure the continuity of those services. 2.Problem definition 2.1 What is the problem? The findings of the 2019 evaluation of the ECI Directive and the external study to support the development of the impact assessment demonstrate that despite different measures at European and national level aimed at enhancing the resilience of CI operations in Europe, the critical infrastructure operators are not adequately equipped to address current and future risks that may result in disruptions to the provision of essential services. This is due to a dynamic threat landscape, deeper interdependencies and a complex operational context. Specifically, the evaluation of the ECI Directive found that the “evolving threat picture involving a combination of natural and (sometimes antagonistic) man-made threats, but also the increasingly intertwined, transboundary and ‘wired’ nature of Europe’s critical infrastructure”. The evaluation highlighted that “in many instances, the interdependencies between CIs in different sectors are considerable, extend beyond Europe’s boundaries, and need to be accounted for in addressing the security of European CI”. In this increasingly complex context, no single CI operator can reasonably be expected to independently manage and address all risks. The need for resilience of critical infrastructures is demonstrated by previous incidents (illustrated in the box below), but it is especially crucial to prevent new incidents to take place or to minimise their disruptive effect whenever these occur. Box 2: Potential cross-sectoral/cross-border impacts of disruptions of critical infrastructures While the impact of potential CI disruptions in Europe cannot be quantified, some examples give indications of their size and implications, be they economic, social, or on citizens’ daily lives. Besides cyberattacks (addressed by the NIS Directive), the main threat that CIs face include natural hazards, which are increasing due to climate change: the damage to CIs caused by extreme climatic events could multiply by ten, up to EUR 34 billion annually by the end of the century. Examples of this include the 2009 drought in France which led to a scarcity of cooling water for nuclear power stations, or the 2015 flooding in the UK that brought down a data centre of a major telecom operator -the latter being an example that digital infrastructures are also vulnerable to physical threats. Terrorist attacks, besides the loss of life, can bring critical infrastructures to a halt: after the attack in 2016, the Zaventem airport remained closed for two weeks and its capacity reduced by half in the following month – from two to one million passengers. The estimated costs for reconstructing the infrastructure amounted to 160 million EUR, while the overall impact of the attacks (including the Paris attacks the preceding year) on the economy was estimated at 2.4 billion EUR . The subsequent public enquiry called for improvements as regards emergency response procedures in relation to terrorism . Unintentional accidents and insider threats from employees can have similar implications. The collapse in 2018 of the Genoa bridge (part of the Trans-European Transport Network) disrupted the transport flows between the port of Genoa and other major cities in Europe and caused damages amounting to 360 million EUR to some 2,000 companies and a loss of economic output in port, industrial and logistics activities of more than 100 million EUR . A sabotage in 2014 caused the shutdown of a Belgian nuclear power facility for six months, making unavailable a large part of the country’s electricity production capability and requiring repairs amounting to EUR 138 million. Critical infrastructures are now also facing potential threats associated with new technologies, such as drones: the drone that disrupted London’s Gatwick airport for 33 hours in 2018 cost airlines an estimated EUR 55 million. The incident diverted or cancelled approximately 1,000 flights, affecting around 140,000 passengers. Furthermore, due to the increasing interdependencies between CIs, disruptions in a single sector (or in some cases a single facility) can have immediate cascading effects across other sectors and across borders, multiplying the economic and social impacts of CI disruptions. Only recently, the pressure on the health sector due to the COVID-19 pandemic resulted in measures across the EU to limit mobility. These measures impacted transport operators, directly affected other sectors such as agriculture (due to the shortage of seasonal workers) and put pressure on the electricity and Internet networks. A number of other earlier events illustrate how disruptions to critical infrastructures can have a negative impact across borders. For instance, in December 2017 the explosion and fire in Austria’s main gas pipeline hub affected the delivery of supplies to Hungary, Slovenia and Croatia, as well as to their biggest recipient, Italy. This led Italy to declare a state of emergency due to a serious energy supply problem . The Italian wholesale day-ahead price surged 215 % to 75 euros per megawatt-hour, its highest recorded level. A recent example outside the EU, which shows the extent of negative impacts of disruptions, is the explosion of more than 2,750 tonnes of ammonium nitrate unsafely stored at the port of Beirut in August 2020. Besides city-wide damage to housing and infrastructures estimated at between US$3.8 and US$4.6 billion , the explosion caused severe impacts on the health system. It also exacerbated food shortages after the main grain silos were destroyed, further undermined the confidence of citizens in the government and worsened the economic crisis. The impacts of disruptions of critical infrastructures will continue to grow due to the ever-increasing interdependencies, as shown in the box below. Box 3: Increasing cross-sectoral/cross-border interdependencies Critical infrastructures in different Member States are increasingly interconnected and reliant upon one another. The more complex these interdependencies, the greater the risk for so-called cascading (or ripple) effects across sectors and Member States. The illustration below shows the generic interdependencies that exist between different sectors, potentially involving actors in different Member States. However, as with any system, the depth of interdependences between and among specific sectors will vary. As an example, the energy sector enables other CIs to function, notably transport, telecommunications, healthcare or finance. The reliable delivery of electricity is also necessary for the water sector (e.g. pumping of water is entirely dependent on electricity), and vice-versa, CIs in the water sector influence the smooth functioning of the electricity sector (cooling water is necessary for the nuclear power plants). The telecommunications sector also has a crucial role, as most CIs (finance, electricity, health systems, transport, etc.) are dependent on communication systems for their daily operations. The aviation sector is heavily dependent on telecommunication services and the constant availability of the global navigation satellite systems like Galileo for air-traffic control and navigation. Some 90% of global data exchanges, including those related to air traffic, use a limited number of undersea cables. The financial services sector is also reliant on telecommunications infrastructure (e.g. electronic payments and Automated Teller Machines), and on the Internet sector, which ultimately depends on the reliability of the electric system. The examples below illustrate practical, real-world implications of cross-sectoral interdependencies. A storm in October 2019 in Estonia caused a power outage affecting more than 10% of the country’s population and leading to serious disruptions to motor fuel supply, telecommunications, drinking water and hospital operations . Earlier that year, a widespread telecommunications outage affecting large parts of Netherlands in June 2019 crippled emergency services and rendered police and other government services unreachable . Another example shows in a schematic fashion how a contamination of drinking water in Sweden in 2011 impacted across many other sectors: In addition to cross-sectoral effects, the disruptions in the water sector can have serious trans-boundary risk effects. This derives from the fact that drinking water supply and distribution networks rely on water catchment areas and groundwater reservoirs that are in the majority of cases cross-border in nature. Some 60% of river basins cross at least one national border, with Member States such as Belgium belonging to four international river basin districts. In other words, any incident, accidental or malicious, in one Member State that threatens to pollute or limit access to drinking water via these sources could have impacts on the distribution of water in other Member States. Similarly, disruptions in the health sector pose serious cross-border and cross-sectoral risks. The transboundary effects of risks affecting the health sector have been evidenced with the COVID-19 crisis: the challenge of the health sector in most Member States to face the pandemic resulted in measures to limit mobility across the EU. This disrupted sectors crucial to the EU’s economy such as tourism, impacted the free movement of labour (leading for example to a shortage of seasonal workers in agriculture), and negatively affected European supply chains that are crucial for the free movement of goods. Looking in more detail at the main problem of critical infrastructure operators not being adequately equipped to address risks in this complex context: its first element relates to the fact that CI operators in many instances do not factor in all the risks they are confronted with, and do not properly assess the scale of these risks. This claim is supported by the OECD, which found that “owners and operators cannot address all their vulnerabilities on their own and may not have incentives to assess a complete overview of the full extent of their interdependencies”. As an example, a recent study demonstrated that data centre operators do not expect to be impacted by the negative effects of climate change. Some 45% of organizations surveyed acknowledged that they are not adapting to climate change impacts and some 90% did not think they needed a plan to mitigate increased risk of flooding despite being vulnerable to risks of inundation. Similarly, a joint report by the World Health Organisation (WHO) and World Bank found that there is a global “lack of planning and readiness for a rapidly moving, lethal pandemic” with the potential to disrupt global health, social and economic systems. Secondly, relevant CI sectors and operators are not uniformly recognised as such in all Member States. Differing understandings across the EU as to which types of infrastructures should be designated as being national critical infrastructures given their strategic importance in maintaining certain societal functions and thus subject to enhanced levels of protection leads to a situation in which a specific type of asset, e.g. a power substation, might be identified as critical in one Member State and not in another, even though they fulfil the same function, employ the same equipment/systems, and face similar risks. In the absence of some form of official recognition of being critical, CI operators are neither privy to government support aimed at promoting resilient operations, nor provided with indications as to specific risks that they might need to gear their efforts toward. Thirdly, while risk reduction is a central element of many CI operators’ work to ensure continuity of service, many are confronted with other priorities that might take precedence over risk mitigation activities, e.g. expanding capacity to stockpile vital supplies/components, carrying out response exercises, regular reviews of resilience plans, etc. This tendency is reflected by NATO, which acknowledges that operators may choose to “eliminate most redundancies [critical in ensuring] continuity of essential services and for use as an emergency backup in times of crises”. In recognition of the fact that many operators’ resilience efforts are informed by a market logic, Member States set out general requirements on mitigation/security measures that CI operators must take. In many cases, these are depicted in operator security plans or equivalent documents, which tend to focus on the protection of specific critical assets. Other resilience elements, e.g. business continuity planning, recovery arrangements, are in many instances insufficiently addressed or missing. The varying types of mitigation/security measures across the EU are of particular concern when pan-European services such as Galileo or Eurocontrol depend on infrastructures in different Member States. Finally, competent authorities seek to incentivise operators to engage in risk mitigation activities by rendering different forms of support, including access to privileged information (e.g. specific threat information from security services); guidance materials (e.g. handbooks, methodologies); training activities; financial support; voluntary audits/inspections to ensure that their efforts meet existing requirements; and fora aimed at facilitating network-building/cooperation at both national level and between Member States and the EU. However, the extent of these incentives varies from one Member State to another, meaning that operators do not always have access to the official support necessary in order to ensure that their operations are resilient. In conclusion, the assessment depicts a situation in which CI operators today are not fully aware of and/or comprehend the implications of the dynamic risk landscape, and approach risk mitigation in ways that diverge between Member States and sectors. Furthermore, operators are not recognised as being critical by authorities in all Member States, which in turn provide varying degrees of official information and support tools. As a result, CI operators are not always adequately equipped to address current and future risks that may result in disruptions to the provision of essential services. Given the increasingly interconnected nature of services and sectors, an insufficient level of resilience on the part of one CI can have implications for other infrastructures and essential services that they provide elsewhere, including in other Member States and/or sectors, representing a risk for the integrity of the EU’s internal market which depends on an uninterrupted flow of these services. This situation, i.e. where systems are only as strong as their weakest links, has potential consequences not only for CI operators, but also for governments, businesses and citizens. In concrete terms, the citizens would be affected by disruptions as they rely on essential services in their daily lives to travel, work, or benefit from key public services such as hospitals, transport, and energy supplies. Businesses are also likely to be seriously affected, as disruptions of services such as transport or finance can negatively impact their supply chains and lead to business interruptions. As businesses in the EU are highly interconnected (both sectorally and geographically), a disruption of a single infrastructure could affect a number of associated businesses. Some of the disruptions could also have severe consequences for security (for instance following a terrorist attack targeting a CI) and lead to uncertainty and undermine confidence in the responsible authorities and providers of essential services. Box 4: Evaluation of the ECI Directive The ECI Directive, when adopted in 2008, was meant to address an inadequate level of protection of CIs with a European dimension in the energy and transport sectors. The specific objectives of the Directive were two-fold: to establish a procedure for the identification and designation of ECIs; and to establish a common approach to the assessment of the need to improve the protection of ECIs. While the Directive generated awareness of and political momentum around the protection of critical infrastructures, the evaluation found that the Directive has been only partially effective in achieving its objectives. This is mainly due to the generality of some of its provisions and definitions that left room for different interpretations by Member States and its limited sectoral scope. Its provisions regarding the requirement for designated operators to assess risks, for Member States to designate certain infrastructures as critical, for operators to put in place security measures and for Member States and the Commission to support them through best practices and methodologies, training and information exchange were already pointing at the existence of the problem/its main elements that are mentioned above and that still persist today. Indeed, the Directive’s narrow scope in terms of sectors, limitation to designated infrastructures with cross border impacts, the focus on protection and the voluntary character of the support measures meant that its impact remained limited. Its 2019 evaluation also found that the evolution of the context in which CIs operate means that the ECI Directive has gradually diminished in relevance. The limitations identified in the evaluation are assessed in the problem drivers’ analysis in the next section. 2.2 What are the problem drivers?

This section looks at various drivers that contribute to the main problem of CI operators facing difficulties on the ground when assessing/addressing the risks they face. The drivers relate to the limitations of the existing regulatory framework, as part of which the authorities act and guide the operators. These problem drivers have been identified on the basis of the outcomes of the 2019 evaluation of the ECI Directive, as well as the external feasibility study that was carried out to support the development of this impact assessment. EU instruments with CI relevance and national CI policies are accounted for as appropriate. 2.2.1 Driver 1: Risk assessment requirements are not comprehensive and do not account for complex interdependencies At EU level, the ECI Directive requires Member States to carry out a threat assessment, but only within the two sectors (energy and transport) within scope, and only then in cases of ECI designation. Meanwhile, the designated operators are expected to conduct a risk analysis. However, these requirements are narrow in focus and vaguely defined, and the Directive does not stipulate which specific types of contingencies should be considered in meeting the threat assessment and risk analysis requirements. Similarly, while many relevant sectoral and cross-sectoral EU measures cover risk assessment practices, they do not address all relevant risks that CI operators face. Indeed, the findings of the recent feasibility study and exchanges with competent authorities suggest that the EU’s approach to CI resilience neglects certain contingencies that have grown increasingly likely in recent years. These include: intentional operational disruptions (e.g. using drones); accidents (e.g. industrial accidents, chemical spills, etc.); hybrid actions; cyber incidents; insider threats; and natural disasters. For example, the existing aviation security regulation and current rules on security in the maritime sector focus on malicious security-related threats, but not on accidents or natural hazards. Meanwhile, the Drinking Water Directive only accounts for risks associated with water contamination and industrial incidents. The cross-sectoral NIS Directive stipulates that national network and information security strategies should include a risk assessment plan, and that designated computer security incident response teams (CSIRTs) carry out ‘dynamic risk analyses’. The Union Civil Protection Mechanism (UCPM) contains a risk assessment requirement, but this is primarily focused on natural and man-made disasters, including outside the EU. The approach to and scope of national-level risk assessment processes vary as well, sometimes significantly. While threats such as terrorism, cyberattacks, natural hazards and accidents are accounted for in most Member States, others are considered in only some. These include, for instance, threats associated with new technological advances, insider threats and pandemics. Furthermore, the risk assessment methodologies employed by Member State authorities are not always designed to allow for the identification of interdependent relationships between operators in different sectors, including ones in other countries. Only twelve Member States use a methodology that is geared toward the identification of interdependencies between operators in the same country. Of these, only five recognise the possibility of disruptions in one Member State having ‘cascading effects’ in another. Studies by other international organisations, including NATO and the OECD, have come to similar conclusions. For instance, a recent OECD report suggests that two-thirds of its members have yet to adopt methodologies capable of assessing interdependencies. In large part, this situation at national level can be attributed to the nature and focus of the EU’s current framework, which does not request Member States to identify and manage cross-sectoral and cross-border interdependencies in a systematic fashion. For instance, many sectoral EU-level measures do not set out requirements for Member States or operators to assess let alone address cross-sectoral interdependencies, except for example the Electricity Risk Preparedness Regulation. For its part, the ECI Directive does not account for cross-sectoral interdependencies beyond the energy and transport sectors, this despite the fact that both are heavily reliant on other sectors, e.g. ICT and space. In conclusion, most EU and national level risk assessment requirements do not adequately account for new and emerging threats and risks. In some cases, they emphasise intentional malicious threats, like terrorism, but neglect the possibility of non-antagonistic contingencies, including natural disasters and accidents. Furthermore, current European and national-level approaches are not well equipped to identify interdependencies between stakeholders at different levels. Taken together, this situation leaves operators in different sectors in Europe without the necessary incentives, tools and/or information by which to understand the risk landscape that they face. 2.2.2 Driver 2: Diverging sectoral coverage and designation criteria Another factor contributing to a heightened risk for disruptions to the provision of essential services relates to the fact that CI operators and/or sectors lack in some instances official status as such, meaning they are not privy to various forms of official support. This situation stems from diverging sectoral coverage and designation processes. At EU level, there is no single recognised list of CI sectors. Nonetheless, different pieces of EU legislation cover specific sectors. For instance, the ECI Directive covers two sectors, while the NIS Directive covers seven. The telecommunications and space sectors are covered by still other EU initiatives. Sectoral coverage at national level, meanwhile, varies from one Member State to another, though as the figure below demonstrates, the overwhelming majority of national approaches cover a core group of sectors (energy, transport, banking and financial market infrastructure, health, drinking water supply and distribution, digital infrastructure, and telecommunications). In roughly half of the Member States, public administration and wastewater management are considered critical. Other sectors, like election infrastructure, are only covered in two Member States. Besides diverging sectoral coverage, there are significant differences concerning the criteria and procedures used to identify and designate infrastructures as critical, at both EU and national levels. The ECI Directive has led to the designation of 94 ECIs, two-thirds of which are located in three Member States in Central and Eastern Europe; 16 Member States have not designated any ECI. The disproportionate representation of ECIs in certain Member States/regions can be attributed – at least partly – to the fact that the Directive leaves Member States with significant discretion in implementing the legislation, e.g. in setting out the thresholds to be met vis-à-vis the ECI identification/designation criteria. According to feedback from Member States, this stems in part from the fact that some of the Directive’s key terms and provisions are vaguely defined or ambiguous, but also from specific disparities in national policies/approaches. For instance, Member States employ different CI definitions and criteria by which to assess CI criticality, leading to divergent assessments on the part of authorities as to what objects/services are critical and, thus, worthy of particular support (and scrutiny). Moreover, there is no obligation for Member States to communicate the ECIs identities to the Commission. This makes for a situation in which it is not possible to know if specific CIs (e.g. air traffic control, energy transmission, cargo shipping) providing obvious essential services on a pan-European basis have been designated as ECIs, or to assess the extent to which the requirements set out in the Directive have been applied. Furthermore, it is impossible to know if different ground-based components that make up or support individual pan-European CIs (e.g. Galileo, Eurocontrol) are subject to similar security requirements in different host Member States where they are located.

Unlike the ECI Directive, which exhibits an asset- and protection-centric approach, the NIS Directive takes an output-oriented approach, requiring that Member States identify operators of essential services (OESs) based on the criticality of the services they provide, as well as more objective criteria (e.g. number of users, market share). With the exception of the Systemically Important Payments Systems Regulation, no other EU-level sectoral legislation establishes a formal process for designating operators on the basis of their criticality. The differences in the identification criteria and procedures of the NIS and ECI Directives result in mixed signals to competent authorities seeking to identify critical operators. This has, for instance, been recognised by several electricity operators, which have called for the distribution system operators to be considered critical per the ECI Directive. Divergences in sectoral coverage and national designation approaches create uncertainty for operators as to whether their infrastructure will be considered critical or not in different Member States. Ultimately, this results in different resilience levels for similar types of infrastructure around the EU, thereby creating weaker links in those systems of operators in different critical sectors in the EU that are interdependent. 2.2.3 Driver 3: Critical Infrastructure resilience policies and approaches are divergent at different levels and between sectors The third problem driver is that different actors and initiatives at different levels employ divergent risk mitigation approaches, which contribute to CI vulnerability in the EU. The first area of divergence concerns the extent to which the full scope of resilience activities is considered. Historically, the focus of efforts in this policy area has been on CI protection, i.e. ensuring that infrastructures are shielded from threats. However, recent years have seen a shift in thinking on the part of scholars, practitioners and policymakers towards approaches that acknowledge that CIs cannot realistically be fully protected all the time against all contingencies, including low probability-high impact events. Instead, the thinking is that CIs must be resilient, i.e. able to swiftly ‘bounce back’ to acceptable performance levels within an agreed-upon amount of time. Despite this shift in thinking, the notion of resilience is not yet fully incorporated in EU and national frameworks. While the need for resilience was reflected in the revised EPCIP approach set out in 2013, the non-binding nature of subsequent actions that were taken as part of the Programme meant that it had only a limited impact in Member States. Meanwhile, the ECI Directive emphasises measures (e.g. an Operator Security Plan, a Security Liaison Officer, etc.) to protect specific infrastructures. This is also true for specific EU-level sectoral initiatives, many of which tend to only focus on certain resilience elements in relation to specific assets, e.g. protective measures and incident management, but not others, e.g. business continuity and recovery arrangements. Some notable exceptions include the Electricity Risk Preparedness Regulation and relevant provisions of the single rulebook governing the EU’s financial sector. Meanwhile, the cross-sectoral NIS Directive addresses the full scope of resilience activities (protection and business continuity measures) as regards cyber risks and threats in a horizontal way. Regardless of which elements of resilience they focus on, the various EU-level sectoral measures impose different types of more or less rigid obligations on Member States. While these provisions arguably reflect the specific needs of the sectors in question, they also lead to the creation of an uneven level of resilience across sectors. As an example, requirements in the aviation and maritime sectors entail very detailed protection measures, but do not address business continuity or recovery. Similarly, EU-level telecommunications legislation puts in place general risk management and incident reporting requirements, but none relating to business continuity or recovery. Other sectors, e.g. rail, oil, health, have very limited frameworks, focusing on information exchange, minimum stocks and cooperation among authorities, respectively. Issues related to insider threats, including personnel access to sensitive areas of CI operations (background checks), are only addressed in a few instances, e.g. EU aviation security legislation and, to a lesser extent, in the Port Security Directive. Moreover, even in sectors where regulatory arrangements are more extensive, e.g. financial markets, there is a general lack of mechanisms geared toward providing authorities with competencies to provide support to CI operators in addressing physical threats specifically. Meanwhile, recent studies have shown that national CI resilience frameworks tend to focus mostly on incident prevention and protection, and much less on incident management, business continuity, etc. Half of the Member States’ CIP Points-of-Contact see a need to enhance national-level incident preparedness and consequence management capacities, for instance by setting out consequence management processes incorporating business continuity. Doing so would arguably ensure a more common public-private understanding, e.g. regarding roles and responsibilities in risk mitigation. Member States have pursued the implementation of EU legislation, including the ECI Directive and NIS Directive, in divergent ways that create potential burden for operators active in more than one Member State. As an example, in addition to specific national requirements, designated ECI operators encounter divergent requirements in different Member States in meeting the obligations contained in the ECI Directive. Operators may also experience potential contradictions in the respective reporting regimes set out in different pieces of EU legislation. Taken together, divergences in the approaches and requirements set out in different EU-level measures make for a complex operational environment, with operators in different sectors subject to different obligations, largely protection-oriented. The absence of clear provisions on the full spectrum of resilience at EU and, in some cases, national level makes for a situation in which operators are not incentivized by authorities to take resilience-enhancing measures, e.g. developing suitable business continuity plans. 2.2.4 Driver 4: Uneven capacities and limited exchange of information The problem description argued that CI operators lack key means by which to detect and respond to different risks now and in the future. This situation derives from the complex regulatory framework that they are subject to, and from the fact that many operators receive limited information and support from competent authorities. CI operators rely on the availability of accurate, timely information in order to make decisions, including ones related to risk mitigation. Without information from, for instance, security services or other operators to suggest an operator’s risk exposure, it is impossible to know which mitigation measures should be taken. The recent feasibility study found that there is scope to improve information exchange and cooperation among relevant stakeholders at EU, national and operator level, in part by improving the effectiveness of existing communication channels, e.g. CIWIN, but especially cross-border cooperation between private and public stakeholders (e.g. a competent authority in one Member State and a private operator with headquarters in another). At national level, the depth of cooperation and information-exchange is affected by multiple factors. First of all, resource levels vary between authorities in different Member States, ranging from in some cases small handfuls of staff spread across multiple authorities to, in one case, a dedicated agency. Where resources are lacking, authorities may not have an overview/oversight over relevant actions being taken by other authorities and operators, not to mention insight into incidents. Indeed, many CIP PoCs see the need for increased monitoring and evaluation capacities at national level. Secondly, not all Member States have developed platforms or initiatives aimed at fostering cooperation and information-exchange between public and private actors, including ones located in other countries. Even where such mechanisms exist, the scope of work and level of ambition varies. Examples include regular meetings between operators and authorities, public-private partnerships, and dedicated public-private coordination bodies. However, no matter how well developed such arrangements are, cooperation is in many cases still hampered by a lack of secure channels (e.g. encrypted telecommunications, etc.) to exchange sensitive information, as well as by the fact that key stakeholders at the operator level sometimes lack security clearances, thus precluding security services from sharing sensitive information, e.g. on specific threats. Box 5: Critical infrastructures - an internal market perspective As shown in boxes 2 and 3, the critical infrastructures operating in the sectors analysed in this Impact Assessment are crucial for the functioning of many other sectors of the economy, and disruptions in one such infrastructure can have significant impacts in other sectors and across borders. Besides their crucial role in underpinning the economic activities that compose the Internal Market and the cross-border nature of disruptions, the infrastructures that are the backbone of a number of essential services are by their nature cross-border as well. This is the case for the European electricity grid, with one third of the EU’s Member States exporting/importing more than 10% of their national generation/consumption of electricity and interconnection levels reaching up to 40% of power generation capacities in countries such as Denmark and Austria. Similarly, the European gas and oil networks span over hundreds or thousands of kilometres across all Member States in order to transport the gas and oil from the North Sea, Russia and other third countries to the consumption centres. For instance, the Druzhba pipeline carries oil from Russia directly to five Member States and branches out into numerous pipelines to deliver oil throughout Eastern Europe . Transport is another clear example of an interconnected network where critical operators play an essential role in the free movement of goods and people. The Port of Rotterdam, the largest port in Europe, is the entry/exit point of 470 million metric tons of goods to and from the EU annually, reaching more than 150 European terminals through inland waterway and rail networks . Air transport is also crucial for business activities and tourism: more than 500 million passengers flew between Member States in 2018, almost half of the total number of passengers travelling by air in the EU. Telecommunications and digital services are other areas where infrastructures are to a large extent cross-border: the submarine optic fibre links the Nordic countries with major data hubs in continental Europe, channelling data and phone calls from these countries to the rest of the world . Similarly, many digital services rely on a globally or Europe-wide scattered infrastructure: the backbone of Google services to the whole of the EU are the data centres located in Ireland, Netherlands, Finland and Belgium . Optic fibre submarine cables, Source: Telegeography (2020) In addition to the cross-border nature of the infrastructures in the sectors considered, many of the entities operating in the sectors considered in this Impact Assessment provide services across the Internal Market. For example, the gas transmission operator Fluxis operates more than 8,000 km of pipelines across six Member States and two third countries , while in the water sector companies like the Suez Group provide drinking water services across several Member States including France, Spain, Italy, Czech Republic, Slovenia and Croatia . Euronext, the largest stock exchange in Europe, operates markets in Amsterdam, Brussels, Dublin, Lisbon and Paris, as well as London and Oslo . The global navigation services provided by Galileo through infrastructures across several Member States is available and used by cars, mobile phones, trains, ships and aircraft across the EU. The fact that in many cases the potential operators of critical infrastructures are multinational companies adds up to the problems identified in section 2. Companies operating in more than one Member State will be subject to diverging obligations and thus suffer an additional administrative burden when operating infrastructures across borders, e.g. different certification requirements, duplication of reporting obligations, etc. The difficulties for multinational companies facing different requirements in each Member State has been pointed out by competent authorities and businesses alike as part of the consultation conducted to carry out the 2020 feasibility study. The additional effort required to ensure compliance with different national frameworks is an obstacle for companies to operate in other Member States. Furthermore, the differences in terms of designation, requirements, support and oversight can also create distortions in the Internal Market since it creates an uneven level playing field among business depending on the Member State where they operate. The absence of common criteria and processes for designating critical infrastructures implies that the same type of infrastructure may be designated as critical in one Member State but not in another. This creates a competitive disadvantage for companies from Member States with a broader sectoral scope and a more ambitious designation approach. These companies are subject to national requirements that their counterparts in other Member States do not have to comply with. The differences in requirements and oversight on critical infrastructures also results in distortions to competition. The majority of Member States (18) have some form of national legislation related to critical infrastructure resilience. Others approach this matter through non-legislative means. Generally speaking, these approaches can be categorised into three categories: stringent, hybrid, and soft. Critical infrastructure in Member States that impose stringent obligations on operators are subject to specific risk assessment, risk management and reporting obligations, including the development of plans subject to official scrutiny by competent authorities at regular intervals. Critical infrastructure operators in those Member States may be obliged to carry out additional security investments if authorities consider it necessary. The critical infrastructure policies in those Member States that apply hybrid approaches involve a combination of limited obligations on operators and voluntary measures. In some cases these limited obligations are not subject to a sanctioning regime and thus not enforceable, its compliance based on the willingness of operators to cooperate. Those Member States promote the resilience of critical entities through dialogue mechanisms such as public-private partnerships where authorities and operators work together on a voluntary basis to identify risks and promote the adoption of resilience measures. Finally, the Member States having taken a soft approach to the resilience of critical infrastructures rely on operators voluntarily self-identifying themselves as being critical, a self-assessment of risks by those operators, and voluntary cooperation through public-private networks. While these differences reflect the policy choices of different Member States as to how to approach critical infrastructure policies, this results in a competitive disadvantage for similar entities depending on the Member States where they operate. For example, designated operators in those Member States where authorities systematically review their security plans have a higher administrative burden than in those where this is not the case, and may be required to carry out additional investments. The divergences in national frameworks also create a disadvantage in relation to the support that critical operators receive, as pointed out by stakeholders from the electricity distribution or air traffic control in different Member States, which have called for their recognition as critical infrastructure operators in order to obtain such support . In conclusion, in addition to the uneven level of resilience of critical infrastructures in different Member States that may result in disruptions to the provision of essential services across the EU, such disparities between national rules cause substantial distortions of competition within the Internal Market. This problem is likely to increase in the coming years given that some Member States (IT, BE) have indicated their intention to review their national CI frameworks. Without a minimum level of harmonisation, the current national divergences and resulting obstacles to the Internal Market are foreseen to continue and even increase in the future. 2.2.5 How will the problem evolve? The problem drivers above show the extent to which the context in which CIs are operated has changed significantly since the ECI Directive was adopted. The outlook for all of these drivers indicates that the problem set will become more acute in the future. Indeed, the already challenging threat picture of today is likely to worsen.

Climate change and more frequent extreme weather events are also likely to continue and worsen, even in best-case scenarios where drastic remedial action is taken. Critical infrastructures will likely struggle to withstand at least some of these events, especially where they are aging and/or subject to insufficient maintenance. The outlook for the global security environment is also negative. The risk that hostile actors, both nation state and terrorist, would seek to impede CI operations in the EU seems likely to increase, either as a means to affect decision-making or to cause actual harm. Meanwhile, technology will continue to evolve and become more complex. This will be driven by industry needs to increase efficiency, reduce environmental impact, and lower costs in the wake of the economic slowdown precipitated by the Coronavirus pandemic. Within individual entities and infrastructures, the trend towards increased digitalisation appears likely to continue, meaning that operational and information technologies will become increasingly intertwined. This will include the integration of emerging technologies like 5G infrastructure into critical networks. The 5G (which relies on physical infrastructures) will become the backbone of many IT applications, including in critical sectors such as energy, transport, banking, and health, as well as industrial control systems that contain sensitive information and support safety systems. As many critical services will depend on 5G, ensuring the security of these networks is a strategic goal. Furthermore, the transition to a more green economy will deliver fundamental change to the nature of CI systems. In the energy sector, for instance, the transition will lead to more complex networks, but also the potential for new vulnerabilities. 3.Why should the EU act? 3.1 Legal basis Where EU action is legislative in nature, the choice of legal basis must rest on objective factors amenable to judicial review, and in particular the proposal’s primary objective and scope. Given the problem that is addressed here and the solutions proposed, Article 114 TFEU is the most appropriate legal basis for an EU intervention. The ECI Directive relies on Article 308 of the Treaty establishing the European Community as its legal basis. This provision has since been replaced by Article 352 TFEU, which can only be the legal basis for an initiative if the Treaties have not provided the necessary powers otherwise. In order to use this legal basis, other legal bases would therefore have to be excluded first. In the field of critical infrastructure resilience, the legal basis could be found either in Article 114 TFEU (approximation of laws for the improvement of the internal market) or in Article 196 TFEU (civil protection). Article 196 TFEU only allows the legislator to take action with regard to the activities of civil protection authorities aimed at the prevention and protection against disasters. While there is certainly a link between civil protection and the resilience of operators of critical infrastructure, the focus of the two policy areas is different. On the one hand, civil protection deals with prevention, preparedness and response to disasters affecting primarily people but also the environment and property at large. While the service provision by operators of critical infrastructure themselves can be impacted by a disaster that requires a response by civil protection authorities, the resilience policy in this regard can and should cover additional types of incidents and areas where civil protection authorities have only a limited role. On the other hand, policy on the resilience of operators of critical infrastructure and the essential services thus provided encompasses the range of actions required by authorities and operators to ensure that the operators are able to resist, absorb, accommodate to and recover from incidents that have the potential to result in significant functional disruptions. In meeting these aims, different public authorities (sometimes the same as for civil protections, but in other cases including the representatives of ministries of interior or sectoral ministries) provide support to and cooperate with operators. For this reason, Article 196 TFEU would not be suited to impose obligations on operators, which are ultimately the actors responsible for implementing resilience-enhancing measures. Furthermore, the overall aim of said policy is to secure the continuous supply of services essential to the wellbeing of the EU citizens and the EU economy, and to improve the functioning of the internal market and the stability of the provision of vital societal functions and economic activities. The disparities resulting from uneven situations across the Member States in terms of resilience obligations constitute a barrier to the internal market and justify EU action. In the sectors considered in this Impact Assessment, critical operators perform their activities within networks spanning across several Member States. Many of the operators of critical infrastructures have assets and deliver essential services across the internal market. The different regimes in each Member State and the variety of requirements applicable across the EU are raising challenges for operators that conduct business throughout the EU, which have to comply with different requirements depending on the Member State. Furthermore, differences in national frameworks also create situations of unfair advantage and distorted competition between operators active in Member States with more comprehensive rules and those that perform their activities under more limited and lenient legal frameworks. Given that the rules differ or are not applied in the same way across the EU, and in view of the aforementioned interdependencies and actual and potential cross-border economic activities of relevant operators, there is not a sufficient level playing field for those operators. Given the crucial role that the operators play for the functioning of the internal market, Article 114 TFEU would be the most appropriate legal basis. Moreover, the EU legislator has already used Article 114 TFEU in the context of the NIS Directive, which harmonises rules related to measures aimed at achieving a high common level of security of network and information systems within the Union and the provision of related essential services so as to improve the functioning of the internal market. The current NIS Directive and the options explored in this Impact Assessment have common objectives and have a similar scope, the main difference being in relation to the threats and the objects to be protected. While the NIS Directive addresses the security of the network and information systems (software and hardware) of the operators of essential services against cyber-threats, the options presented in section 5 aim at ensuring the resilience of those operators against all other threats that can affect their physical infrastructure, processes and personnel. Given the similarities in objectives and scope, it is appropriate to apply the same legal basis used in the NIS Directive. 3.2 Subsidiarity: Necessity of EU action According to the principle of subsidiarity laid down in Article 5(3) of the Treaty on European Union, action at EU level should be taken only when the aims envisaged cannot be achieved sufficiently by Member States alone and can therefore, by reason of the scale or effects of the proposed action, be better achieved by the EU. EU intervention in the area of resilience of operators of CIs is justified from a subsidiarity perspective due to the cross-border nature of the services provided by those operators and the internal market objective pursued, as well as the connections between nodes within a network of infrastructures in a given sector and the dependencies of CIs from other essential services. On the one hand, many CIs located in one Member State, such as data centres or ground infrastructures for satellite navigation, provide services in several other Member States or across the EU. Therefore, the disruption of one single facility could have an impact on users and activities across borders. On the other hand, given that CI networks are composed of mutually dependent hubs, the failure of one infrastructure could disrupt the normal functioning of others within the same sector. For instance, the interruption of operations at one airport or control centre could affect air traffic across Europe and beyond.

Moreover, given the increasingly dense linkages between sectors, cascading effects originating from a single disruption are likely to have cross-border consequences, e.g. where a power outage in one Member State disrupts hospital operations in another. The recent feasibility study shows that many Member State and industry stakeholders see the need for a more common and coordinated approach in this area in view of the evolving interdependencies between service provision using CIs in different sectors. At the same time, some of the most severe incidents affecting operators of certain CIs, such as accidents in nuclear or chemical facilities, could have a cross-border impact well beyond their users and affect negatively, for instance, the environment or citizens’ health in more than one Member State. The options explored in this Impact Assessment strike a balance between the need to ensure a harmonised approach and reinforce resilience of critical infrastructures on the one hand and subsidiarity considerations on the other hand. Therefore, a framework has been devised containing certain minimum standards and requirements leaving a margin of appreciation to Member States and operators concerned. The framework will structure and harmonise the activities of authorities in identifying the services and operators that are to be considered as essential respectively critical, whilst leaving a degree of flexibility to take account of national specificities, including in terms of risks. It will also provide a framework for operators to take the necessary and most adequate measures to address the risks they face, without being overly prescriptive. 3.3 Subsidiarity: Added value of EU action An intervention at the level of the EU in this policy area is justified due to the common nature of risks that operators of CIs in the EU face and the transnational character of essential services that risk being affected in case of disruption and that could not effectively be dealt with by national action alone. It would also contribute to a more level playing field in the internal market. Regardless of where in the EU they are located, electricity production facilities, transport hubs or telecommunications networks all face risks that are similar in their essential characteristics. A coherent approach to manage and address these risks that brings together knowledge and expertise from across the EU would optimise the response of operators and authorities everywhere in the EU. Furthermore, as noted above, the provision of essential services depends on an increasingly interlinked network of assets and systems operating across different Member States. However, a network is only as strong as its weakest link. In other words, vulnerabilities in one Member State have the potential to affect negatively services provided by even the most resilient operators of CIs elsewhere in the EU. Common EU action is necessary to ensure that operators can provide their services without undue restrictions and take appropriate measures to ensure that their operations are resilient in the face of disruptions, thereby harmonising and, for some, raising the proverbial bar. Finally, an EU intervention would prompt closer alignment of the policies on the resilience of operators of CIs between Member States, which would serve to ensure that operators receive a minimum level of guidance, support and information and are subject to common obligations aimed at enhancing resilience. This, in turn, would contribute to a more level playing field in the internal market and facilitate operators’ cross-border activities. Therefore, comprehensive action at EU level would produce greater benefits compared to action taken solely at the Member State level; the challenge is simply far too large for countries to handle in isolation. 4.Objectives: What is to be achieved? 4.1 General objective The general objective of the initiative is to ensure the continuous provision of essential services in the internal market by enhancing the resilience of critical infrastructure operators in the Member States. 4.2 Specific objectives Each specific objective (SO) corresponds to one of the problem drivers: ·SO 1: Ensure higher level of understanding of risks and interdependencies, as well as the means to address them; ·SO 2: Ensure that all relevant entities in all key sectors are identified as critical by Member States authorities; ·SO 3: Ensure that the full spectrum of resilience activities is included in public policies and operational practice; ·SO 4: Strengthen capacities and improve cooperation and communication between stakeholders. As this is a REFIT initiative, simplification potential for companies and public authorities is explored as part of each objective, and in the policy options described below. 5.What are the available policy options? 5.1 What is the baseline from which options are assessed? The baseline scenario entails no change over the current situation, i.e. the existing EU framework for CI resilience would remain in place without significant changes.

Here, the existing provisions contained in the ECI Directive would continue to apply to cross-border infrastructures in the transport and energy sectors designated as ECIs. However, the application of the Directive would continue to diverge considerably from one Member State to another due to, among other things, the vague articulation of key provisions. As a result, Member States would continue to pursue heterogeneous approaches to the ECI identification/designation process, and thus a comparatively small number of Member States would continue to host the vast majority of ECIs. It is conceivable that the total number of ECIs would continue to increase slowly on a year-on-year basis in keeping with the trend in recent years (no reported designations in 2017, +3 in 2018, +1 in 2019). In every instance, ECI operators would continue to be expected to meet a narrow set of obligations focused on asset protection. In terms of other relevant legislation at EU level, the baseline scenario anticipates the revision of the NIS Directive and the adoption of the Digital Operational Resilience Act (DORA), changes which are likely to enhance further the resilience of network and information systems, in particular in the financial sector given the detailed requirements contained in the latter. Besides these initiatives, no other significant changes over the status quo would be made at EU level. Meanwhile, the proposed Disaster Resilience Goals as part of a revised Union Civil Protection Mechanism (UCPM) could have an indirect impact on the current state-of-play as regards CI resilience, but especially in Member States where this policy area is managed by civil protection authorities. At national level, the baseline scenario assumes that divergences in national CI resilience frameworks would persist, meaning there would be continued differences between Member States regarding sectoral coverage, support arrangements, and designation criteria. As a result, many CI operators would not be designated as critical at national level, and thus would not benefit from access to specific forms of information and support necessary to address adequately their risk exposure. Meanwhile, operators designated as critical would continue to be subject to diverging national requirements across Europe. It could be envisaged that at least some Member States would seek to put more emphasis on CI resilience and the provision of essential services at national level, given the persisting attention to these issues in different fora, including other international organisations, including NATO, which has set out seven baseline requirements for the purpose of boosting resilience through civil preparedness. But overall, the capacity of operators to address risk would remain largely unchanged, meaning that there will be no significant improvements to the resilience of CI operators. This is even when assuming continued engagement in various network and capacity building fora, including the European Reference Network for Critical Infrastructure Protection (ERNCIP) and other EU-funded networks/projects. While their risk management capacity might remain largely unchanged, operators’ risk exposure would increase, given a shifting threat landscape, technological advances, increasingly complex networks and deeper interdependencies. In such an environment, operators would continue to struggle to adequately assess their actual risk exposure and then take timely and appropriate measures in response. In conclusion, the baseline scenario is unlikely to create conditions that lead to any significant further enhancements to the CI resilience in the years to come. 5.2 Description of the policy options 5.2.1 Policy Option 1: Non-legislative measures at EU level to encourage more common approaches and information-sharing This option envisages the retention of the existing ECI Directive, accompanied by a set of voluntary measures within the context of the existing EPCIP programme. First of all, the Commission would produce regular threat updates/reports (both general and tailored to specific risks or sectors) based on inputs from the Joint Research Centre (JRC) and Member States. These would be available to authorities (and operators depending on the information’s sensitivity), and would support their risk assessments. These reports could be developed through a structured dialoguebetween Member States and the Commission that would complement existing forms of exchange, e.g. CIP PoC meetings or sectoral fora and committees. Where appropriate, these might involve subject-matter experts and operators, and could address different topics, including: methodologies to assess risks and interdependencies; identification of critical sectors and assets; security (physical/personnel) measures, including specific/state-of-the-art solutions; business continuity management policies and practice; incident reporting criteria and methodology; and the facilitation of public-private cooperation. Through the structured dialogue, Member States and operators would be able to share knowledge, facilitating more common approaches in national policies and practice regarding the assessment of risks and interdependencies, and the definition of critical sectors and focus on resilience. On the basis of these exchanges, the Commission would develop guidelines to support the work of authorities and operators. Furthermore, the Commission would work to improve the functionality of its CIWIN platform, which enables communication and information-sharing both between the Commission and Member States, and between stakeholders at national level, including operators. Using CIWIN and the structured dialogue, the Commission would also provide a better overview of relevant activities, including EU-funded projects. Stakeholders’ views: A limited number of Member States expressed their preference for this voluntary measures option. They thought that the role of the EU should be to complement national critical infrastructure policies with measures such as exchange of best practices and methodologies. Similarly, a small number of operators found that the existing measures are sufficient, and preferred the voluntary option. Other operators did not consider this option as a ‘stand-alone’ one, but rather found that the soft measures should complement the regulatory policy options. 5.2.2 Policy Option 2: Revised selection criteria and requirements for operators of European Critical Infrastructures (ECIs) This option envisages a new ECI Directive in line with the recommendations of the 2019 evaluation. Rather than focus on asset protection in the energy and transport sectors, the revised approach would focus on ensuring the resilience of ECIs in the sectors currently covered by the NIS Directive. In practice, the new Directive would entail changes to the existing cross-border ECI designation process, as well as new requirements on Member States and operators. The broader sectoral scope, coupled with the revised criteria, would increase the number of ECIs designated by Member States. In order to clarify the ECI identification/designation process, the new Directive would refine the existing criteria and add new ones, e.g. the interdependency with other sectors, the number of users. Member States would report to the Commission concerning the application of the revised criteria, including justification as to why certain infrastructures were not designated (without disclosing their identities). In the interest of ensuring a more aligned approach across Member States, the Commission would review each report together with Member State authorities, meeting in a small-group classified setting. Compared to the limited risk assessment provisions of the existing Directive, the new Directive would require Member States to carry out regular national risk assessments relevant for designated ECIs, taking into account similar requirements in other EU legislation. This, in turn, would be the basis for more thorough risk and interdependency assessments by individual ECI operators supported by authorities in the host Member States, as well as authorities and relevant operators in other concerned Member States. In order to ensure that necessary information is available to support this work, the Directive would include provisions aimed at facilitating the sharing of sensitive data (e.g. threat information or commercially sensitive information) between authorities and operators, including ones located in other Member States, thereby improving levels of cooperation and communication between relevant stakeholders.

In order to enhance resilience, ECI operators would have to ensure that their security plans contain provisions on risk reduction and preparedness, incident management, but also business continuity and recovery arrangements. This operator resilience plan (ORP) would also need to include arrangements for employee security management - such as on access control, access rights (including to particularly sensitive information) and categories of personnel exercising critical functions including the possibility for background checks. Member States would need to ensure that background checks of personnel exercising critical functions can be carried out upon request of an operator. Member States would also retain an oversight role over designated ECIs on their territory to ensure that each operator’s ORP reflects all new requirements. Member States and operators alike would be encouraged to engage in cross-border exchanges with authorities and operators in other potentially impacted Member States, e.g. in conducting risk assessments or in developing individual ORPs. In order to support the implementation of the Directive, competent authorities would be required to ensure appropriate competencies and capacities for different capacity building activities (e.g. trainings, exercises) on topics such as risk assessment, business continuity planning, personnel security management, etc. The Commission in turn would be required to provide different forms of support, e.g. trainings, EU-wide exercises, etc., to authorities and designated ECI operators. To the extent that the requirements envisaged in the new ECI Directive are already provided for in existing sectoral legislation, those existing provisions should apply if they contain requirements that are at least equivalent in effect to the obligations under the envisaged new legislation. Stakeholders’ views: Only one Member State preferred keeping the focus on European Critical Infrastructures in their current form. Other Member States were in favour of changing their concept to cover infrastructures with real pan-European dimension. The operators’ positions were mixed between this option and option 3 – with many of them indicating the two options as a possible way forward. 5.2.3 Policy Option 3: New requirements on critical entities This option entails the replacement of the existing ECI Directive with an overarching cross-sectoral framework to enhance the resilience of critical entities delivering essential services in a number of sectors through infrastructures located in each Member State. This option would set out harmonised minimum requirements for Member States and critical entities identified under the new framework. The sectoral scope would be enlarged beyond transport and energy, to include banking; financial market infrastructures; health; drinking water; waste water; digital infrastructure (including telecommunications); public administration; and space. The larger sectoral scope is justified, as it would largely reflect the sectors that a majority of Member States consider as critical under their national critical infrastructure frameworks (as shown in Figure 2) and it would therefore ensure the alignment of all Member States within the sectoral scope. It will also bring coherence with the NIS Directive sectors (current ones and those that will feature in the future NIS Directive in the category of essential sectors). The NIS Directive already demonstrated that there was a need to ensure the security of network and information systems used by operators for the provision of services that are essential for the maintenance of critical societal or economic activities against cyber threats. These operators should therefore also be secure and resilient against a range of non-cyber risks. In addition, including the telecommunications and space sectors would ensure that these two sectors, which are important vectors for daily operations of many other sectors (as shown in box 3), are resilient. In both sectors, the operators rely on physical assets requiring protection against non-cyber risks (such as 5G towers or ground stations and centres of space systems). As to the space sector, a number of Member States advocated for its inclusion in the scope, notably given its particular European dimension. The larger sectoral scope will also respond to the finding of the evaluation of the ECI Directive, which concluded that its limited sectoral scope does not allow taking into account the increased interdependencies that exist with other sectors. The new sectoral coverage will ensure that authorities and operators adequately address the risks arising from the dependencies between sectors. Other factors that supported the selection of the sectors included stakeholders’ views reflected in the results of different consultation activities; the level of importance for society of sectors as revealed by a major crisis such as COVID-19 and the interdependency among sectors. More specifically on substance of the option: Member States would be obligated to develop a national CI resilience strategy for at least the sectors within the scope of the legislation. The strategy would set out objectives and measures aimed at enhancing the resilience of critical entities. The legislation would require Member States to carry out national cross-sectoral risk assessments, taking into account similar requirements in other EU legislation. In carrying out the risk assessment, Member States would have to identify the risks arising from interdependencies between sectors and operators, including cross-border interdependencies. On the basis of the outcomes of the risk assessment, Member States would be required to use common criteria set out in the new legislation (similar to those depicted in Option 2) to identify critical entities. The criteria included in the legislative instrument would be determined taking into account the criteria more commonly used by Member States in designating national critical infrastructures as well as the criteria currently used in the ECI Directive as well as those contained in the NIS Directive. These criteria would be aimed at ensuring that Member States, taking into account national specificities, identify in a consistent manner across the EU those entities operating infrastructures in their territory to deliver essential services that could be significantly disrupted by an incident, thus reducing the current discrepancies between Member States. The criteria would also provide Member States with guidance to determine what level of disruption would justify the identification of a given entity as critical. This risk-based identification process based on common criteria would ensure that authorities adequately identify those entities that are vulnerable to incidents that could create a significant disruption in the provision of essential services. As a basis to identify critical entities, the legislative framework explored in this option would provide with a list of the types of entities to be considered for the identification process. The type of entities would vary depending on the sector and sub-sector: suppliers, producers, and distribution and transmission system operators for electricity, infrastructure managers and railway undertakings for the rail sector. On the basis of this list, and taking into account the risk-based approach identification process based on common criteria, the number of critical entities is estimated at 5,000 operators across the EU, approximately. All critical entities would be obligated to regularly carry out risk assessments of their own, looking at the risks to delivering the service they provide rather than only to the (physical) infrastructure that underpins that service. These risk assessment would have to cover a minimum number of elements, including the vulnerability of their supply chains in case of disruptions and the risks from potential disruptions in other services on which the operator is dependent. This analysis of interdependencies by the operator would include cross-border spill-overs of security threats. Critical entities would receive the relevant elements of the national risk assessment in order to facilitate the assessment of the risks and interdependencies they are confronted with. Critical entities would be required to maintain operator resilience plans (or equivalent documents). Operator resilience plans should contain provisions on risk reduction and preparedness, incident management, business continuity and recovery arrangements, as well as arrangements as depicted in Option 2 for employee security management. Critical entities would determine the detailed resilience measures needed under the relevant requirements, taking into account the specificities of their operations and on the basis of the risk assessments, therefore ensuring that the measures are commensurate to the risks they face. Unlike in Option 2, the plans would be focused on ensuring the resilience of services and not individual infrastructures. As an example, a critical entity providing drinking water services would be required to identify risks and prescribe measures from an overarching services perspective, rather than on the basis of what is required to protect individual elements of the operator’s network, e.g. individual water treatment/purification facilities. Critical entities would also be required to engage in staff education and training on the measures contained in the plans. Member States would exercise oversight over operators insofar as they would be allowed to request – where relevant and necessary – specific information from operators about their assessment of risks and interdependencies, the ORPs and other obligations, and to issue orders to operators. Such orders would, where appropriate, be provided on the basis of a dialogue between the authorities and the operator and, in any event, the authority would only be able to require measures which are proportionate to the capacity of the operators and commensurate to the risks they face. As in Option 2, competent authorities would also be responsible for ensuring that background checks on critical personnel can be carried out upon request of an operator.

In order to promote close sectoral and cross-sectoral coordination, including during incidents, Member States would be required to establish cooperation structures involving competent authorities and operators, both of whom would in turn designate points of contact. Furthermore, the new legislative instrument would require competent authorities to ensure that appropriate resources and competencies are allocated to oversee and support resilience-building efforts on the part of critical entities. For its part, the Commission would support the implementation of the legislation by setting up a dedicated knowledge hub within the Commission. This hub could offer, for instance, assistance in relation to the following: facilitating a common approach to assessing risks relating to cross-border and cross-sectoral interdependencies; guidance materials; trainings; supporting organisation of exercises and stress tests; or exchange of knowledge and best practices with experts. The Commission and the hub more specifically would also support efforts to share information both in relation to the legislation itself and more generally as well, e.g. in the context of the external dimension involving neighbouring countries and strategic partners. Furthermore, the Commission could explore the feasibility of setting up a secure communication platform or reinforcing existing ones to facilitate information-exchange between Member States. The hub’s activities would complement those of a Commission expert group replacing the existing CIP PoC group. The expert group would also allow for coordination with other relevant EU-level groups and in particular with the NIS cooperation group. The group would act as a forum to advise the Commission and to facilitate cooperation, including between Member States, by promoting the exchange of and best practice, including on the identification of critical entities, sharing of information on national strategies, or collecting information relating to risks and incidents, among other tasks. This would add to other provisions to ensure coordination among Member States, such as a requirement for Member States to consult each other where an entity would be identified as critical by more than one Member State, with a view to reduce the burden on the critical entity. The definition of ECIs would be changed as compared with the current ECI Directive, focusing exclusively on core infrastructures of particular European significance. The new legislation would establish a process to identify critical entities of particular European significance (CE-ES), i.e. those which provide services across a large number of Member States (e.g. air traffic management, space-based navigation and timing services meeting the criteria), and thus establish an EU approach in order to ensure their resilience. The identification of critical entities of particular European significance would be done on the basis of the number of Member States to or in which the operator provides its services. Operators identified as critical entities of particular European significance would be subject to the same requirements as critical operators (regarding the risk assessments and operators resilience plans) and the oversight and enforcement of compliance would remain under the responsibility of the Member State that identified them as critical. It would be up to the Member States where the infrastructure underpinning the essential service is located to require the operators to draw up the operator resilience plans. The difference would be that all Member States would be made aware of the measures taken to ensure the resilience of the operator. Those Member States would inform other Member States and the Commission about their oversight activities for an exchange of views. Furthermore, these critical entities of particular European significance could receive additional guidance about the resilience measures through advisory mission organised at EU level, without prejudice to the Member States responsibility to ensure oversight and enforcement. The knowledge hub within the Commission could organise a pool of European Resilience Advisors from the Member States, which would be tasked with providing advisory support to the entities concerned in meeting the requirements stipulated in the legislation. On a voluntary basis, Member States could also request that European Resilience Advisors provide support to other critical entities besides those of European significance. As regards the setup of this option, it would consist of a general framework (Directive) setting out harmonised minimum requirements for Member States and critical operators. To the extent that the baseline requirements envisaged in the new legislation are already provided for in existing EU sectoral legislation, those existing provisions should apply if they contain requirements which are at least equivalent in effect to the obligations under the envisaged legislation. In some instances, critical entities might need to complement the measures already in place with additional elements. For instance, when the sectoral legislation only addresses in an equivalent manner intentional threats or requires protection measures, the identified operators would have to address other types of threats in accordance with the requirements of the new directive. The minimum baseline requirements would be, where necessary, subsequently complemented by more tailored obligations to reflect thematic specificities (for instance on risk assessment processes or employee security requirements) or covering aspects specific to a certain sector, and without obligation to amend existing EU sectoral legislative instruments. The more tailored obligations could be adopted by delegated/implementing acts, as appropriate, or by legislative measures. The general framework could also establish provisions to ensure that the relevant authorities notify incidents to other relevant authorities. The overall approach would thus aim to ensure coherence with existing sectoral obligations under EU law, so as to avoid excessive burden or duplication. Stakeholders’ views: This option focused on the shift from protection of assets to resilience of essential services provided by critical entities was considered as the preferred option by the majority of Member States that provided input. Member States considered that the best way to achieve a more common approach to resilience would be by establishing minimum criteria (for different obligations and the identification process), which would leave room for flexibility for national specificities. Member States were supportive to expanding the scope beyond transport and energy sectors (to current NIS sectors or beyond). The views of operators as regards the sectors diverged, ranging from no additional sectors to a more ambitious sectoral scope. Several operators considered that requirements under the existing sectoral legislation should be taken into account. 5.2.4 Policy Option 4: New requirements on critical entities and a reinforced role for the EU This option includes all elements outlined in Option 3. In addition, this option proposes a more substantial role for the Commission in identifying critical entities as well as either the creation of a dedicated EU Agency responsible for CI resilience in support of Member States and operators or to task existing EU Agency, such as Europol, with this responsibility. The Agency would assume the roles and responsibilities assigned to the dedicated knowledge hub proposed in Option 3. As regards the identification of critical entities, the legislation would provide clear sector and country-specific thresholds for each of the criteria used to identify operators providing essential services. On the basis of these thresholds, Member States would be required to provide the Commission with an initial list of identified operators and relevant accompanying data, which would be assessed jointly by the Commission, the EU Agency, and competent Member State authorities for the purposes of identifying those operators as critical. The identification arrangements would be established in the legislation. Just as in Option 3, identified critical entities would be required to develop an operator resilience plan and meet other specific requirements. The Commission and the EU Agency would develop binding sector-specific risk assessment and interdependency identification methodologies for use by competent authorities and critical entities in the different sectors within the scope of the legislation. Per this option, the oversight role exercised by competent national authorities over critical entities would be supported by the EU Agency, which would be tasked with carrying out regular on-site inspections of sites/facilities owned or operated by critical entities, including those of European significance (described in more detail in Option 3). As part of its capacity building mission, the Agency would also provide advice and assess individual operator plans upon request. Furthermore, the Agency would be charged with organising regular trainings and EU-level exercises as part of a multi-year EU-wide capacity building programme, which would be developed in close coordination with other relevant EU Agencies. Finally, the Agency would be in charge of organising the pool of European Resilience Advisers envisaged in Option 3. The procedure for their deployment would be aligned with relevant procedures contained within the EU Civil Protection Mechanism. As in Option 3, the new legislation would be coherent with and complement the existing EU sectoral obligations. Stakeholders’ views: This option was the least favoured by the Member States and the operators, as they considered it as too intrusive, ‘one size fits’ all approach not leaving room for sectoral specificities. The figure below presents the intervention logic and summarises the four policy options considered and their links with the problem drivers and specific objectives: Figure 3 – Intervention logic

Box 6: Relationship between the legislative options and sectoral legislation The legislative options contemplated in this