19.9.2017 EN Official Journal of the European Union L 239/41 ANNEX Blueprint for coordinated response to large-scale cross-border cybersecurity incidents and crises INTRODUCTION This Blueprint applies to cybersecurity incidents which cause disruption too extensive for a concerned Member State to handle on its own or which affect two or more Member States or EU institutions with such a wide-ranging and significant impact of technical or political significance that they require timely policy coordination and response at Union political level. Such large-scale cybersecurity incidents are considered a cybersecurity ‘crisis’. In case of an EU-wide crisis with cyber elements, coordination at Union political level of the response shall be carried out by the Council, using the Integrated Political Crisis Response (IPCR) arrangements. Within the Commission, coordination will take place in accordance with the ARGUS rapid alert system. If the crisis entails an important external or Common Security and Defence Policy (CSDP) dimension, the EEAS Crisis Response Mechanism is activated. The Blueprint describes how these well-established Crisis Management mechanisms should make full use of existing cybersecurity entities at EU level as well as of cooperation mechanisms between the Member States. In doing so, the Blueprint takes into account a set of guiding principles (proportionality, subsidiarity, complementarity and confidentiality of information), presents the core objectives of cooperation (effective response, shared situational awareness, public communication messages) at three levels (strategic/political, operational and technical), the mechanisms and the actors involved as well as the activities to meet said core objectives. The Blueprint does not cover the full crisis management lifecycle (prevention/mitigation, preparedness, response, recovery) but focuses on response. Nevertheless, certain activities, in particular those related to achieving a shared situational awareness, are addressed. It is also important to note that cybersecurity incidents can be at the origin or part of a broader crisis, impacting other sectors. Given that most cybersecurity crises are expected to have effects on the physical world, any appropriate response must rely upon both cyber and non-cyber mitigation activities. Cyber crisis response activities should be coordinated with other crisis management mechanisms at EU, national or sectoral levels. Finally, the Blueprint does not replace and should be without prejudice to existing sector-specific or policy-specific mechanisms, arrangements or instruments such as the one set up for the European Global Navigation Satellite System (GNSS) programme (1). Guiding principles In working towards the objectives, in identifying the necessary activities and assigning roles and responsibilities to respective actors or mechanisms, the following guiding principles have been applied and also need to be respected when preparing future implementing guidelines. Proportionality: The great majority of cybersecurity incidents affecting Member States fall well below anything that may be considered a national ‘crisis’, much less a European one. The foundation of cooperation amongst Member States in responding to such incidents is provided by the Computer Security Incident Response Teams (CSIRTs) Network established by the NIS Directive (2). The national CSIRTs cooperate and exchange information voluntarily on a daily basis including, when necessary, in response to cybersecurity incidents that affect one or more Member States in line with the CSIRTs Network's Standard Operating Procedures (SOPs). The Blueprint should therefore make full use of these SOPs and any additional cybersecurity crisis specific tasks should be reflected therein. (1) Decision 2014/496/CFSP. (2) Directive (EU) 2016/1148.