COMMISSION STAFF WORKING DOCUMENT EXECUTIVE SUMMARY OF THE IMPACT ASSESSMENT REPORT Accompanying the document Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the resilience of critical entities
Date: 2020-12-16
Institutions: Directorate-General for Migration and Home Affairs, European Commission
Subjects: EU strategy, European security, critical infrastructure security, exchange of information, provision of services, risk management, single market

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 16.12.2020  SWD(2020) 359 final  COMMISSION STAFF WORKING DOCUMENT  EXECUTIVE SUMMARY OF THE IMPACT ASSESSMENT REPORT  Accompanying the document Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the resilience of critical entities {COM(2020) 829 final} - {SEC(2020) 433 final} - {SWD(2020) 358 final}  
 
 
Impact assessment on additional measures for Critical Infrastructure Resilience (CWP 2020 item) 

Executive Summary Sheet 

A. Need for action 

Why? What is the problem being addressed?  

The provision of essential services using critical infrastructures that underpin vital societal functions or economic 
activities in the Union requires that such services are provided reliably, meaning that the relevant operators must 
be  resilient  to  current  and  anticipated  future  risks  (such  as  natural  hazards,  hybrid  actions,  terrorism,  insider 
incidents, public health emergencies or accidents). The European framework that exists today is neither fully fit-
for-purpose nor future-proof. Despite the 2008 European Critical Infrastructure (ECI) Directive and other EU- and 
national-level measures that have been taken since, operators are not always adequately equipped to address 
risks created by an increasingly complex operational context defined by  inter alia a dynamic risk landscape and 
deeper interdependencies between sectors. The ECI Directive, focused on asset protection rather than operator 
resilience, concerns a small number of European critical infrastructures with identified cross-border implications 
in two sectors (energy and transport). Furthermore, divergent approaches and deficiencies exist at national level, 
concerning sectoral coverage, criteria, risk assessment, information-exchange, etc. This results in obstacles for 
the proper functioning of the internal market, significantly hampering the operators’ ability to provide the services 
concerned across the Union reliably and unhampered by any unjustified restrictions. 

What is this initiative expected to achieve?  

The general  objective of the  initiative  is to ensure the continuous provision of essential services in the internal 
market  by  enhancing  the  resilience  of  operators  of  critical  infrastructure  (referred  to  in  the  proposal  as  ‘critical 
entities’) in the Member States. This general objective will be met by pursuing the following specific objectives: 

  Ensure a greater understanding of risks and interdependencies, as well as the means to address them; 
  Ensure that all relevant entities in all key sectors are identified as critical by Member States authorities;  
  Ensure  that  a  wide  range  of  resilience-enhancing  activities  are  reflected  in  both  public  policy  and 

operational practice; and, 

  Strengthen capacities and improve cooperation and communication between stakeholders.  

What is the value added of action at the EU level?  

An  EU  intervention  is  justified  due  to  the  common  nature  of  many  of  the  risks  faced  by  operators  of  critical 
infrastructures  in  Europe,  which  continue  to  grow  increasingly  interdependent  upon  one  another,  as  well  as 
diverging national rules on the subject matter, which hamper the operators’ ability to provide their services in the 
internal  market.  The  transnational  nature  of  the  provision  of  essential  services  means  that  even  localised 
disruptions  can  have  far-reaching  European  implications  that  national  action  alone  cannot  reasonably  be 
expected to mitigate.  A coherent  EU-wide approach to all-hazards risk management in this area  would ensure 
that  all  relevant  operators  take  adequate  resilience-enhancing  measures.  This  in  turn  would  ensure  the  more 
reliable provision of essential services, but also contribute to a more level playing field in the internal market. 

B. Solutions 

What  legislative  and  non-legislative  policy  options  have  been  considered?  Is  there  a  preferred 
choice or not? Why?  

Four policy options have been considered.  

Policy  Option  1  envisages  voluntary,  non-legislative  measures  to  encourage  more  common  approaches  and 
information-sharing as a complement to the existing ECI Directive.  

Policy Option 2 entails a revision of the existing ECI Directive in order to align the sectoral coverage with that of 
the  existing  Network  and  Information  Systems  (NIS)  Directive,  and  to  refine  the  selection  criteria  for  and 
requirements  on  ECI  operators,  e.g.  maintaining  an  operator  resilience  plans.  Both  Member  States  and 
designated ECI operators would also be required to carry out risk assessments. 

2 

 
 
Meanwhile, Policy Option 3 involves replacing the existing  ECI Directive  with an overarching framework legal 
instrument in order to enhance the resilience of critical entities in at least the sectors covered by the existing NIS 
Directive and improve the functioning of the internal market in this respect. Implementation would be supported 
by a knowledge hub  within the Commission. Member States  would be required  to identify, on the basis of risk 
assessment,  critical  entities,  which  would  be  subject  to  different  resilience-enhancing  requirements.  Both 
Member  States  and  critical  entities  would  be  obliged  to  carry  out  risk  assessments.  A  procedure  for  the 
identification  of critical  entities  with particular  European significance  would also  be included, as  well as certain 
particular rules applicable to those entities.  

Policy  Option  4  includes  all  elements  outlined  in  Option  3.  In  addition,  the  Commission  would  play  a  more 
active role in designating critical entities and a dedicated EU Agency for critical infrastructure resilience would be 
created. 

Having considered the anticipated impacts and value of each option, the preferred option is Option 3, which 
would result in a more comprehensive resilience framework accounting for existing EU measures and national 
specificities. 

Who supports which option?  

A  limited  number  of  Member  States  and  operators  found  the  current  framework  sufficient  and  preferred  the 
voluntary  measures  under  Option  1.  As  for  Option  2,  one  Member  State  preferred  keeping  the  focus  on 
European Critical Infrastructures in their current form, while others were in favour of revising the ECI concept to 
cover infrastructures with a clear pan-European dimension. A majority of Member States preferred Option 3. The 
operators were most supportive of Options 2 and 3. Of all of the options, Option 4 was the least favoured by both 
Member States and operators; the option was seen to be too intrusive and inflexible, i.e. not allowing for room to 
account for sectoral specificities.  

C. Impacts of the preferred option 

What are the benefits of the preferred options (if any, otherwise main ones)?  

Given  the  vital  role  that  essential  services  play  in  the  lives  of  EU  citizens  and  the  EU  economy,  actors  in  all 
economic sectors, including small-, medium- and large-scale enterprises, would benefit from enhanced operator 
resilience. Besides having positive effects on individual businesses, EU-level efforts to ensure the uninterrupted 
delivery  of  essential  services  would  also  serve  to  enhance  overall  economic  stability  and  further  improve  the 
attractiveness of the EU market to investors. 

Besides  the  economic  impact,  the  resilience-building  measures  contained  in  Option  3  would  lead  to  fewer 
disruptions,  safer  working  conditions,  improved  quality  of  life  and  health  for  EU  citizens.  Indeed,  the  more 
reliable  the  provision  of  essential  services  becomes,  the  greater  the  likelihood  for  positive  economic,  social, 
educational,  professional  and  recreational  benefits  in  citizens’  lives.  Moreover,  additional  efforts  to  reduce  the 
frequency  and  severity  of  disruptions  to  the  provision  of  essential  services  would  also  have  a  positive 
environmental  impact  insofar  as  they  would  guarantee  the  more  efficient  use  of  resources  as  well  as  more 
sustainable consumption and production patterns in the EU.  

3 

 
 
 
 
What are the costs of the preferred options (if any, otherwise main ones)?  

The main costs for the Member States would relate to the development of national strategies, the conduct of risk 
assessments, and the identification of critical entities, as well as oversight and enforcement. However, in doing 
so,  competent  authorities  would  be  able  to  draw  on  existing  policies  and  processes,  including  strategy 
documents, risk assessment arrangements, as well as the designation procedure provided in the Network and 
Information System Directive, as a basis to support implementation, thus limiting overall costs. Meanwhile, the 
direct  costs  experienced  by  identified  critical  entities  would  be  associated  with,  where  necessary  or  where  not 
already  being  done,  carrying  out  operator-level  risk  assessments,  taking  appropriate  organisational  and/or 
technical measures to enhance operator resilience, and reporting incidents to competent authorities. 

How will businesses, SMEs and micro-enterprises be affected?  

Among those operators affected by the various options, the number of SMEs that would be affected is expected 
to be small. While in sectors such as transport, energy or water, actors likely to be designated as critical entities 
are  typically  medium-  to  large-scale  enterprises  with  thousands  of  employees,  critical  entities  in  other  sectors 
may  be  smaller  in  size.  For  instance,  it  is  conceivable  that  in  the  health  sector,  SMEs  might  provide  specific, 
highly  technical  or  specialised  services.  However,  SMEs  in  this  position  are  arguably  incentivised  to  ensure  a 
high level of resilience on their own and/or are subject to specific national- and/or EU-level requirements, thus 
reducing the additional costs associated with the preferred option.  

Will there be significant impacts on national budgets and administrations?  

There  will  be  some  impacts  on  competent  Member  State  authorities  stemming  from  specific  obligations,  e.g. 
regular  national-level  risk  assessments,  national  strategies,  and  supervisory  and  enforcement  measures. 
Furthermore, the need to provide additional support to operators identified as being critical entities in fulfilling the 
obligations arising from the legislation would entail certain costs. 

Will there be other significant impacts?  

N/A 

When will the policy be reviewed?  

D. Follow up 

The  evaluation  of  the  impact  of  the  legislative  act  will  be  engaged  four  years  after  the  deadline  for 
implementation of the legislative act to ensure that there is a sufficiently long period to evaluate the effects of the 
initiative after it has been fully implemented across all Member States. 

4