3. Existing frameworks and measures This section aims at mapping and describing the relevant existing regulatory frameworks and instruments as well as the baseline of measures and mitigations already in place, in order to take them into account when establishing risk mitigation plans, and possibly also when introducing new measures. 3.1. EU level instruments 3.1.1 Main Union regulatory frameworks The EU uses a range of instruments to protect electronic communications networks, including the EU telecommunications framework 5, the NIS Directive (Directive on Security of Network & Information Systems) 6 and the Cybersecurity Act 78. Under the EU telecommunications framework, obligations can be imposed on telecommunication operators by the respective Member State(s) in which they are providing service. Member States are required to ensure that the integrity and security of public communications networks are maintained and have to ensure that undertakings providing public communications networks or publicly available electronic communications services take technical and organisational measures to appropriately manage the risks posed to security of networks and services 9. The framework also provides that competent national regulatory authorities have powers to issue binding instructions and ensure compliance. In addition, under Directive 2002/20/EC 10 Member States are allowed to attach to a general authorisation conditions concerning the security of public networks against unauthorised access, for the purpose of protecting the confidentiality of communications, in accordance with Directive 2002/58/EC 11. The European Electronic Communications Code (EECC), which will replace the current framework as of 21 December 2020, maintains the security provisions of the current framework (in Title V, Articles 40 and 41) and also introduces definitions on the security of networks and services 12 5 Directive 2002/21/EC as last amended by Directive 2009/140/EC of 25 November, 2009 on a common regulatory framework for electronic communications networks and services, and Directive 2018/1972 of 11 December, 2018 establishing the European Electronic Communications Code. 6 Directive (EU) 2016/1148 of 6 July, 2016 concerning measures for a high common level of security of network and information systems across the Union. 7 Regulation (EU) 2019/881 of 17 April, 2019 on ENISA (the European Agency for Cybersecurity) and on information and communications technology cybersecurity certification. 8 To support the implementation of these obligations and instruments, the Union has set up a number of cooperation bodies. The main one is the NIS Cooperation Group established by the NIS Directive which brings together competent authorities in order to support and facilitate cooperation, in particular by providing strategic guidance. The CSIRTs Network - as a network of national CSIRTs from EU Member States - facilitates operational information exchange. The European Agency for Cybersecurity (ENISA), the Commission, Member States and national regulatory authorities have developed technical guidelines for national regulatory authorities on incident reporting, security measures, threats and assets. 9 Article 13a on the security and integrity of networks and services of Directive 2002/21/EC as last amended by Directive 2009/140/EC; and Articles 40 and 41 of Directive 2018/1972. 10 Directive 2002/20/EC of 7 March, 2002 on the authorisation of electronic communications networks and services (Authorisation Directive). 11 Directive 2002/58/EC of 12 July, 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector. 12 Specifically under Article 2, (21), ‘security of networks and services’ is defined as ‘the ability of electronic communications networks and services to resist, at a given level of confidence, any action that compromises the availability, authenticity, integrity or 6