EUROPEAN COMMISSION Brussels, 30.5.2016 COM(2016) 363 final 2013/0027(COD) COMMUNICATION FROM THE COMMISSION

TO THE EUROPEAN PARLIAMENT



pursuant to Article 294(6) of the Treaty on the Functioning of the European Union



concerning the position of the Council on the adoption of a Directive of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union (Text with EEA relevance)



2013/0027 (COD) COMMUNICATION FROM THE COMMISSION

TO THE EUROPEAN PARLIAMENT



pursuant to Article 294(6) of the Treaty on the Functioning of the European Union



concerning the position of the Council on the adoption of a Directive of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union (Text with EEA relevance) 1.Background Date of transmission of the proposal to the European Parliament and to the Council (COM(2013) 48 – 2013/0027/COD):

07.02.2013 Date of the opinion of the European Economic and Social Committee:

22.05.2013 Date of the position of the European Parliament, first reading: 13.03.2014 Date of adoption of the position of the Council: 17.05.2016 2.Objective of the proposal from the Commission First, the proposal requires all Member States to ensure that they have in place a minimum level of national capabilities by: establishing competent authorities for network and information security (NIS); setting up Computer Security Incident Response Teams (CSIRTs); adopting national NIS strategies and national NIS cooperation plans. Secondly, the national competent authorities should cooperate within a network enabling secure and effective coordination, including coordinated information exchange as well as detection and response at EU level. Through this network, Member States should exchange information and cooperate to counter NIS threats and incidents on the basis of the European NIS cooperation plan. In order to ensure that all relevant authorities are duly and timely involved, the proposal also requires law enforcement agencies to be notified of incidents of a criminal nature and Europol to be involved in the EU-wide coordination mechanisms. Thirdly, based on the model of the Framework Directive for electronic communications, the proposal aims to ensure that a culture of risk management develops and that information is shared between the private and public sectors. Companies in specific critical sectors and public administrations will be required to assess the risks they face and adopt appropriate and proportionate measures to ensure NIS. They will be required to report to the competent authorities any incidents that seriously compromise their networks and information systems and significantly affect the continuity of critical services and the supply of goods. 3.Comments on the position of the Council Overall the Council’s position endorses the core objectives of the Commission proposal, namely to ensure a high common level of security of network and information systems. However, the Council makes a number of changes regarding how to achieve this goal. National cybersecurity capabilities Under the Council position, Member States will be required to adopt a national NIS strategy setting out the strategic objectives and appropriate policy and regulatory measures for cybersecurity. Member States will also be required to designate a national competent authority for the implementation and enforcement of the Directive, as well as Computer Security Incident Response Teams (CSIRTs) responsible for handling incidents and risks. Although the Council position does not require Member States to adopt a national NIS cooperation plan, as envisaged in the original proposal, the position can be supported as some aspects of the cooperation plan are retained in the provision on the NIS strategy. Cooperation between Member States