Views: 38
Critical entities provide essential services in upholding key societal functions, supporting the economy, preserving the environment, ensuring public health and safety, etc. European Commission has adopted a list of essential services in the eleven sectors covered by the Critical Entities Resilience Directive (CER), which entered into force on 16 January 2023.
The Commission has proposed a list of eleven sectors/services that are crucial for the maintenance of vital societal functions, economic activities, public health and safety, as well as climate and environmental quality. The EU member states have to identify the critical entities for the sectors set out in the CER Directive by 17 July 2026. They will use this list of essential services to identify the critical entities and carry out risk assessments; once identified, the critical entities will have to take measures to enhance their resilience.
On critical entities
Critical entities, as providers of essential services, play an indispensable role in the maintenance of vital societal functions or economic activities in the internal market in an increasingly interdependent EU-wide economy. It is therefore essential to set out in the EU-27 states a framework with the aim of both enhancing the resilience of critical entities in the internal market by laying down harmonised minimum rules and assisting them by means of coherent and dedicated support and supervision measures.
As point 13 of the Directive postulates, with a view of ensuring a comprehensive approach to the resilience of critical entities, each EU state should adopt a national strategy for enhancing the resilience of critical entities. The strategy should set out the strategic objectives and policy measures to be implemented. In the interests of coherence and efficiency, the strategy should be designed to seamlessly integrate existing policies, building, wherever possible, upon relevant existing national and sectoral strategies, plans or similar documents.
More in the CER Directive: https://eur-lex.europa.eu/eli/dir/2022/2557/oj
Background
In 2020 the Commission significantly upgraded to the EU’s rules on the resilience of critical entities and the security of network and information systems.
In January 2023, two key directives on critical and digital infrastructure entered into force with the purpose of strengthening the EU’s resilience against online and offline threats, from cyber attacks to crime, risks to public health or natural disasters – the Directive on the resilience of critical entities (CER Directive) and the Directive on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), which entered into force in mid-January 2023.
List of essential services
= Energy sector, with services such as the electricity production and energy storage;
= Transport sector, with services such as management and maintenance of airport or railways infrastructure;
= Banking sector, with essential services such as taking deposits and lending;
= Financial market infrastructure sector, with services such as the operation of trading venue and of clearing systems;
= Health sector, with distribution, manufacturing, provision of healthcare, and medical services;
= Drinking water sector, with drinking water supply and drinking water distribution;
= Waste water sector, with waste water collection, treatment and disposal services;
= Digital infrastructure sector, with services such as the provision and operation of internet exchange point service, domain name system, top-level domain, cloud computing and data centre;
= Public administration sector services;
= Space sector, with the operation of ground-based infrastructure services;
= Production, processing and distribution of food sector, with the large-scale industrial food production and processing, food supply chain services and food wholesale distribution services.
The final legal instrument in the form of a delegated act adopted by the Commission will enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of two months of its notification; that period can be extended by two months at the initiative of the European Parliament or of the Council.
General reference: https://ec.europa.eu/commission/presscorner/detail/da/ip_23_3992