CER Directive

Who it applies to

Entities that each Member State identifies as critical in sectors such as energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, public administration, space and food.

Key requirements

• Member States adopt a national resilience strategy and carry out risk assessments.
• Critical entities carry out their own risk assessments.
• Critical entities take technical, security and organisational measures to prevent, protect against, respond to and recover from incidents.
• Background checks for staff in sensitive roles where national law allows.
• Notify incidents that significantly disrupt essential services.

Breach and incident notification

Critical entities notify the competent authority of incidents that significantly disrupt, or could significantly disrupt, the provision of essential services, starting with an initial notification shortly after becoming aware and following up with a detailed report. Check the national transposition for exact deadlines.

Penalties

Set by each Member State in national law.

Go deeper