L 239/44 EN Official Journal of the European Union 19.9.2017 — European Commission — The ERCC (24/7 operational service located in DG ECHO), and the designated lead service (to be chosen between DG CNECT and DG HOME depending on the particular nature of the incident), the Secretariat-General (ARGUS secretariat), DG HR (Security Directorate), DG DIGIT (IT Security Operations). — For other EU agencies (1) the respective parent DG in the Commission or the EEAS (first point of contact). — EEAS — SIAC (Single Intelligence Analysis Capacity: EU INTCEN and EUMS INT) — EU Situation Room and the nominated geographic or thematic service. — EU Hybrid Fusion Cell (part of EU INTCEN — cybersecurity in a hybrid context). Shared situational awareness: — As part of the regular cooperation at technical level to support Union situational awareness, ENISA should on a regular basis prepare the EU Cybersecurity Technical Situation Report on incidents and threats, based on publicly available information, its own analysis and reports shared with it by Member States' CSIRTs (on a voluntary basis) or NIS Directive single points of contact, European Cybercrime Centre (EC3) at Europol and CERT-EU and where appropriate the European Union Intelligence Centre (INTCEN) at the European External Action Service (EEAS). The report should be made available to the relevant instances of the Council, the Commission, the HRVP and the CSIRTs Network. — In case of major incident, the CSIRTs Network Chair, with the assistance of ENISA, prepares an EU Cybersecurity Incident Situation Report (2) which is presented to the Presidency, the Commission and the HRVP via the CSIRT of the rotating Presidency. — All other EU agencies report to their respective parent DGs who in turn report to the Commission lead service. — CERT-EU provides technical reports to the CSIRTs Network, EU institutions and agencies (as appropriate) and ARGUS (if activated). — Europol/EC3 (3) and CERT-EU provides expert forensic analysis of technical artefacts and other technical information to the CSIRTs Network. — EEAS SIAC: On behalf of INTCEN, the EU Hybrid Fusion Cell reports to relevant the EEAS departments. Response: — The CSIRTs Network exchanges technical details and analysis on the incident, such as IP addresses, indicators of compromise (4), etc. Such information should be provided without undue delay to ENISA and not later than 24 hours from when the incident is detected. — In accordance with the CSIRTs Network Standard Operating Procedures, its members cooperate in their efforts to analyse the available technical artefacts and other technical information related to the incident with a view of determining the cause and possible technical mitigation measures. — ENISA assists CSIRTs' in their technical activities relying on its expertise and in accordance with its mandate (5). (1) Depending on the nature and the impact of the incident on different sectors of activity (finance, transport, energy, healthcare, etc.) the relevant EU agencies or bodies will be involved. (2) The EU Cybersecurity Incident Situation Report is an aggregation of national reports provided by national CSIRTs. The format of the report should be described in the CSIRTs Network SOPs. (3) In accordance and under the conditions and procedures set in EC3's legal framework. (4) ‘Indicator of compromise’ (IOC) in computer forensics is an artefact observed on a network or in an operating system that with high confidence indicates a computer intrusion. Typical IOCs are virus signatures and IP addresses, MD5 hashes of malware files or URLs or domain names of botnet command and control servers. (5) Proposal for a Regulation on the ENISA, the European Cybersecurity Agency and repealing Regulation (EU) No 526/2013, and on Information and Communication Technology cybersecurity certification (‘Cybersecurity Act’), 13 September 2017.