The section focuses on how the NIS Directive enhances Member States' preparedness by
requiring to have effective national competent authorities and Computer Security Incident
Response Teams (CSIRTs). More precisely, the section covers the obligation to designate
national competent authorities including the role of the single point of contact. It discusses
three topics: (a) possible national governance structures (e.g., centralised, de-centralised
models, etc.) and other requirements; (b) the role of the single point of contact and (c)
Computer Security Incident Response Teams.
3.1. Type of authorities.
Article 8 of the NIS Directive requires Member States to designate national competent
authorities on security of networks and information systems, while explicitly recognising the
possibility to designate 'one or more national competent authorities'. Recital 30 of the
Directive explains this policy choice: "In view of the differences in national governance
structures and in order to safeguard already existing sectoral arrangements or Union
supervisory and regulatory bodies, and to avoid duplication, Member States should be able to
designate more than one national competent authority responsible for fulfilling the tasks link
to the security of the network and information systems of operators of essential services and
digital service providers under this Directive".
Accordingly, Member States are free to choose to appoint one central authority dealing with
all sectors and services covered by the Directive or several authorities, depending for example
on the type of sector.
When deciding on the approach, Member States can draw on the experience from the national
approaches used in the context of the existing legislation on critical infrastructure protection
(CIIP). As described in Table 1, in the case of CIIP, Member States decided to adopt either a
centralised or a decentralised approach when assigning competences at national level.
National examples are used here for illustrative purposes only and with a view to bringing
existing organisational frameworks to the attention of Member States. Hence, the Commission
does not imply that the model used by respective countries for CIIP should be necessarily
used for the purpose of transposition of the NIS Directive.
Member States may also opt for various hybrid arrangements involving elements of both
centralised and decentralised approaches. The choices can be made in alignment with prior
national governance arrangements for the various sectors and services covered by the
Directive, or newly determined by the authorities concerned and by the relevant stakeholders
identified as operators of essential services and digital service providers. The existence of
specialist expertise on cyber security, resourcing considerations, the relations between the
stakeholders and national interests (for example economic development, public security etc.)
may also be important factors leading to the choices made by Member States.
3.2 Publicity and additional relevant aspects.
Pursuant to Article 8(7), Member States need to inform the Commission about the designation
of national competent authorities and their tasks. This must be done by the transposition
deadline.
11
Select target paragraph3
Connect to a paragraph
Connect to an entity
Disable highlights
Add to table of contents