L 194/4
EN
Official Journal of the European Union
19.7.2016
and decrease resources available depending on workload. The term ‘shareable’ is used to describe those
computing resources that are provided to multiple users who share a common access to the service, but where
the processing is carried out separately for each user, although the service is provided from the same electronic
equipment.
(18)
The function of an internet exchange point (IXP) is to interconnect networks. An IXP does not provide network
access or act as a transit provider or carrier. Nor does an IXP provide other services unrelated to interconnection,
although this does not preclude an IXP operator from providing unrelated services. An IXP exists to interconnect
networks that are technically and organisationally separate. The term ‘autonomous system’ is used to describe
a technically stand-alone network.
(19)
Member States should be responsible for determining which entities meet the criteria of the definition of operator
of essential services. In order to ensure a consistent approach, the definition of operator of essential services
should be coherently applied by all Member States. To that end, this Directive provides for the assessment of the
entities active in specific sectors and subsectors, the establishment of a list of essential services, the consideration
of a common list of cross-sectoral factors to determine whether a potential incident would have a significant
disruptive effect, a consultation process involving relevant Member States in the case of entities providing services
in more than one Member State, and the support of the Cooperation Group in the identification process. In order
to ensure that possible changes in the market are accurately reflected, the list of identified operators should be
reviewed regularly by Member States and updated when necessary. Finally, Member States should submit to the
Commission the information necessary to assess the extent to which this common methodology has allowed
a consistent application of the definition by Member States.
(20)
In the process of identification of operators of essential services, Member States should assess, at least for each
subsector referred to in this Directive, which services have to be considered as essential for the maintenance of
critical societal and economic activities, and whether the entities listed in the sectors and subsectors referred to in
this Directive and providing those services meet the criteria for the identification of operators. When assessing
whether an entity provides a service which is essential for the maintenance of critical societal or economic
activities, it is sufficient to examine whether that entity provides a service that is included in the list of essential
services. Furthermore, it should be demonstrated that provision of the essential service is dependent on network
and information systems. Finally, when assessing whether an incident would have a significant disruptive effect
on the provision of the service, Member States should take into account a number of cross-sectoral factors, as
well as, where appropriate, sector-specific factors.
(21)
For the purposes of identifying operators of essential services, establishment in a Member State implies the
effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether
through a branch or a subsidiary possessing legal personality, is not the determining factor in this respect.
(22)
It is possible that entities operating in the sectors and subsectors referred to in this Directive provide both
essential and non-essential services. For example, in the air transport sector, airports provide services which
might be considered by a Member State to be essential, such as the management of the runways, but also
a number of services which might be considered as non-essential, such as the provision of shopping areas.
Operators of essential services should be subject to the specific security requirements only with respect to those
services which are deemed to be essential. For the purpose of identifying operators, Member States should
therefore establish a list of the services which are considered as essential.
(23)
The list of services should contain all services provided in the territory of a given Member State that fulfil the
requirements under this Directive. Member States should be able to supplement the existing list by including new
services. The list of services should serve as a reference point for Member States, allowing for identification of
operators of essential services. Its purpose is to identify the types of essential services in any given sector referred
to in this Directive, thus distinguishing them from non-essential activities for which an entity active in any given
sector might be responsible. The list of services established by each Member State would serve as further input in
the assessment of the regulatory practice of each Member State with a view to ensuring the overall level of
consistency of the identification process amongst Member States.