The requirements of CSIRTs designated by the Member States are provided in Annex I of the
NIS Directive. A CSIRT has to ensure a high level of availability of its communication
services. Its premises and the supporting information systems shall be located in secure sites
and be able to ensure business continuity. Moreover, the CSIRT should be enabled to
participate in international cooperation networks.
3.5. Assistance for the development of CSIRTS.
The Cybersecurity Digital Service Infrastructures (DSI) programme of the Connecting Europe
Facility (CEF) can provide for significant EU funding in assisting Member State CSIRTs to
improve their capabilities and cooperating with each other through an information exchange
co-operation mechanism. The cooperation mechanism under development in the SMART
2015/1089 project is intended to facilitate swift and effective operational cooperation on a
voluntary basis between Member State CSIRTs, namely in support of the tasks entrusted to
the CSIRTs Network under Article 12 of the Directive.
Details of the relevant calls for proposals for capacity building of Member State CSIRTs are
available via the website of the Innovation and Networks Executive Agency (INEA) of the
European Commission.15
The CEF Cybersecurity DSI Governance Board provides an informal structure for policy
level guidance and assistance to Member States' CSIRTs for the purpose of capacity building,
and for the implementation of the voluntary cooperation mechanism.
A newly established CSIRT or one appointed to fulfil the tasks at Annex I of the NIS
Directive can rely on the advice and expertise of ENISA to improve its performance and
efficiently deliver its work16. In this regard, it is worth to point out that Member State CSIRTs
could take as a reference some of the work that ENISA has recently carried out. In particular,
as listed in section 7 of this Annex, the Agency has issued a number of documents and studies
describing good practices, recommendations at a technical level, encompassing CSIRT
maturity level assessments, for various CSIRT capabilities and services. In addition, guidance
and best practises have also been shared by networks of CSIRTs both at global (FIRST17) and
European level (Trusted Introducer, TI18).
3.6. The role of the single point of contact.
Pursuant to NIS Directive Article 8(3), each Member State must designate a national single
point of contact, which will exercise a liaison function to ensure cross–border cooperation
with the relevant authorities in other Member States and with the Cooperation Group and the
CSIRT network19 created by the Directive itself. Recital 31 and Article 8(4) explain the
rationale for this requirement, i.e., to facilitate cross-border cooperation and communication.
This is particularly needed given that Member States may decide to have more than one
15
Available at: https://ec.europa.eu/inea/en/connecting-europe-facility
See Article 9(5) NIS Directive.
17
Forum of Incident Response and Security Teams (https://www.first.org/)
18
https://www.trusted-introducer.org/
19
A network of national CSIRTs for operational cooperation between Member States under Article 12
16
18
Select target paragraph3
Connect to a paragraph
Connect to an entity
Disable highlights
Add to table of contents