20.1.2023
EN
Official Journal of the European Union
C 20/5
HAS ADOPTED THIS RECOMMENDATION:
CHAPTER I: AIM, SCOPE AND PRIORITISATION
(1)
This Recommendation sets out a series of targeted actions at Union and national level to support and enhance the resilience of critical infrastructure, on a voluntary basis, with a focus on critical infrastructure with significant crossborder relevance and in identified key sectors, such as energy, digital infrastructure, transport and space.
Those targeted actions consist of enhanced preparedness, enhanced response and international cooperation.
(2)
Information shared in order to meet the objectives of this Recommendation, that is confidential pursuant to Union and national rules, as well as rules on business confidentiality, should be exchanged with the Commission and other relevant authorities only where that exchange is necessary for the good application of this Recommendation.
This Recommendation does not affect the protection of essential interests of Member States’ national security, public security or defence, and no Member State should be expected to share information that goes against these interests.
CHAPTER II: ENHANCED PREPAREDNESS
Actions at Member State level (3)
Member States should consider an all-hazard approach when updating their risk assessments or their existing equivalent analyses, in line with the evolving nature of the current threats to their critical infrastructure, especially in identified key sectors and, where possible, in all sectors covered by upcoming new legal framework applicable to critical entities.
(4)
Member States are invited to accelerate preparatory work and adopt resilience-enhancing measures, where possible, as mandated by the upcoming legal framework applicable for critical entities, with a particular focus on cooperation and relevant information sharing among Member States and with the Commission, on identifying critical entities with significant cross-border relevance and on enhancing support for identified critical entities in order to improve their resilience.
(5)
Member States should support experts’ training and exercises and the sharing between experts of best practices and lessons learnt.
Member States should encourage experts to participate in existing training platforms, both national and international, for example under the UCPM.
(6)
Member States should encourage and support critical infrastructure operators, at least in the energy sector, to conduct stress tests, following principles commonly agreed at Union level where beneficial.
Stress tests should assess the resilience of critical infrastructure against antagonistic man-made threats.
Therefore, Member States should aim to identify relevant critical infrastructure to be tested and consult with relevant critical infrastructure operators as soon as possible, and no later than by the end of the first quarter of 2023.
In addition, Member States should support the critical infrastructure operators so that they undertake those tests as soon as possible and aim to complete them by the end of 2023, in accordance with national law.
The Council intends to assess the state of play on stress tests by the end of April 2023.
(7)
Due to the rapidly evolving threats to critical infrastructure, maintaining its high level of protection is of vital importance.
Member States are encouraged to allocate sufficient financial resources to strengthen the capacities of their relevant national authorities and to support them, in order to be able to enhance the resilience of critical infrastructure.
Member States are also encouraged to allocate sufficient financial resources to authorities responsible for the management of large-scale cybersecurity incidents to support them, and to ensure that their computer security incident response teams (CSIRTs) and competent authorities are fully mobilised in the CSIRTs Network and EU-CyCLONe, respectively.