On 20 December, the Council of the EU validated its negotiating mandate with the European Parliament on the resilience of critical entities, which Member States’ national ambassadors to the EU had approved on 8 December (see EUROPE 12849/8).
The directive on the resilience of critical entities aims to reduce vulnerabilities and strengthen the resilience of critical entities to terrorist attacks, natural disasters and events such as pandemics.
The Council’s negotiating mandate covers critical entities in nine sectors: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure and space.
Member States will need to have a strategy to strengthen the resilience of critical entities, conduct a risk assessment at least every four years and identify critical entities that provide essential services. Critical entities will have to identify relevant risks that may significantly disrupt the provision of essential services, take appropriate measures to ensure their resilience and notify disruptive incidents to the competent authorities, explained the EU Council.
The proposed directive also establishes rules for the identification of critical entities of particular European importance. A critical entity will be considered of particular European importance when it provides an essential service to or in more than one third of the Member States. In such cases, the European Commission may be asked to organise an advisory mission to assess the measures that the entity concerned has put in place to fulfil its obligations.
This directive accompanies another proposal for a directive on measures for a high common level of cyber security in the EU (NIS2), which aims to address the same concerns for the digital dimension.
This mandate opens the door to negotiations with the European Parliament, which adopted its position in October (see EUROPE 12810/15). Link to the mandate: https://bit.ly/3lKU5Q9 (Original version in French by Solenn Paulic)