Enhanced national CSIRTs' capabilities Without effective and adequately resourced national CSIRTs across the EU, as laid out in Article 9 of the NIS Directive, the EU will remain too vulnerable to cross-border cyber threats. Member States could therefore consider extending the scope of CSIRTs beyond sectors and services that are included in the scope of the Directive (see section 3.3 of the Annex). This would enable national CSIRTs to provide operational support to cyber incidents that occur in companies and organisations which are not in the scope of the Directive but are also important for the society and economy. In addition, Member States could make full use of additional funding opportunities offered by the Cybersecurity Digital Service Infrastructures (DSI) programme of the Connecting Europe Facility (CEF), designed to enhance capabilities of national CSIRTs and cooperation among them (see section 3.5 of the Annex). Consistency of the identification process of OES In accordance with Article 5 of the NIS Directive Member States are required to identify the entities that will be considered operators of essential services by 9 November, 2018. In relation to this task, Member States could consider using consistently the definitions and guidance included in this Communication in order to ensure that similar type of entities playing a similar role in the internal market would consistently be identified as operators of essential services in other Member States. Member States could also consider extending the scope of the NIS Directive to public administrations, given the role they play for society and the economy as a whole (see sections 2.1. and 4.1.3 of the Annex). Aligning national approaches to the identification of operators of essential services to a maximum extent, notably by following guidance developed by the Cooperation Group (see section 4.1.2 of the Annex) would be very useful, as it would lead to a more harmonised application of the Directive's provisions and thus reduce the risk of market fragmentation. In cases where operators of essential services provide essential services in two or more Member States, striving to reach an agreement between Member States in the context of the consultation process under Article 5(4)) on the consistent identification of entities, (see section 4.1.7 of the Annex) is essential, as this would avoid a different regulatory treatment of the same entity under different Member State jurisdictions. Submission of information on identification of OES to the Commission In accordance with Article 5(7), Member States are requested to provide to the Commission information on national measures allowing for the identification of OES, the list of essential services, the number of identified OES and the relevance of those operators for the sector. Furthermore, Member States are requested to provide thresholds, where such exist, used in the identification process to determine the relevant supply level or the importance of the particular operator for maintaining a sufficient level of supply. Member States could also consider sharing with the Commission the lists of identified operators of essential services and 5

Select target paragraph3

Connect to a paragraph
Connect to an entity
Disable highlights
Add to table of contents