Enhanced national CSIRTs' capabilities
Without effective and adequately resourced national CSIRTs across the EU, as laid out in
Article 9 of the NIS Directive, the EU will remain too vulnerable to cross-border cyber
threats. Member States could therefore consider extending the scope of CSIRTs beyond
sectors and services that are included in the scope of the Directive (see section 3.3 of the
Annex). This would enable national CSIRTs to provide operational support to cyber incidents
that occur in companies and organisations which are not in the scope of the Directive but are
also important for the society and economy. In addition, Member States could make full use
of additional funding opportunities offered by the Cybersecurity Digital Service
Infrastructures (DSI) programme of the Connecting Europe Facility (CEF), designed to
enhance capabilities of national CSIRTs and cooperation among them (see section 3.5 of the
Annex).
Consistency of the identification process of OES
In accordance with Article 5 of the NIS Directive Member States are required to identify the
entities that will be considered operators of essential services by 9 November, 2018. In
relation to this task, Member States could consider using consistently the definitions and
guidance included in this Communication in order to ensure that similar type of entities
playing a similar role in the internal market would consistently be identified as operators of
essential services in other Member States. Member States could also consider extending the
scope of the NIS Directive to public administrations, given the role they play for society and
the economy as a whole (see sections 2.1. and 4.1.3 of the Annex).
Aligning national approaches to the identification of operators of essential services to a
maximum extent, notably by following guidance developed by the Cooperation Group (see
section 4.1.2 of the Annex) would be very useful, as it would lead to a more harmonised
application of the Directive's provisions and thus reduce the risk of market fragmentation. In
cases where operators of essential services provide essential services in two or more Member
States, striving to reach an agreement between Member States in the context of the
consultation process under Article 5(4)) on the consistent identification of entities, (see
section 4.1.7 of the Annex) is essential, as this would avoid a different regulatory treatment of
the same entity under different Member State jurisdictions.
Submission of information on identification of OES to the Commission
In accordance with Article 5(7), Member States are requested to provide to the Commission
information on national measures allowing for the identification of OES, the list of essential
services, the number of identified OES and the relevance of those operators for the sector.
Furthermore, Member States are requested to provide thresholds, where such exist, used in the
identification process to determine the relevant supply level or the importance of the
particular operator for maintaining a sufficient level of supply. Member States could also
consider sharing with the Commission the lists of identified operators of essential services and
5
Select target paragraph3
Connect to a paragraph
Connect to an entity
Disable highlights
Add to table of contents