Making critical entities more resilient

SUMMARY OF:

Directive 2022/2557 on the resilience of critical entities

WHAT IS THE AIM OF THE DIRECTIVE?

The directive aims to:

reduce vulnerabilities and strengthen the physical resilience* of critical entities in the European Union (EU) in order to ensure the uninterrupted provision of services that are essential for the economy and society as a whole;
increasing the resilience of the critical entities that provide these services.

KEY POINTS

EU Member States must, following a risk assessment, identify critical entities that provide services that are essential for the maintenance of functions vital to society, economic activities, public health and safety or the environment, and identify cases in which an incident would have significant disruptive effects on these essential services, including when it would affect the national systems that safeguard the rule of law. This covers entities in the following sectors:

energy, including electricity, district heating, oil, gas and hydrogen operators;
transport by air, rail, water and road, including public transport;
banking, which is also subject to Regulation (EU) 2022/2554 (the Digital Operational Resilience Act – see summary);
financial market infrastructure, including trading venues, also subject to the Digital Operational Resilience Act;
health, including healthcare providers, basic pharmaceutical product and critical device manufacturers, and research and development of medicinal products;
drinking water suppliers and distributors;
waste water disposal and treatment;
digital infrastructure, including electronic communications services and data centres, which is also subject to Directive (EU) 2022/2555 (see summary);
public administration entities at the central government level, excluding national security, public security, defence and law enforcement;
space operators of ground-based infrastructure; and
food businesses engaged exclusively in logistics and wholesale distribution and in large-scale industrial production and processing.

It should be noted that certain parts of the directive do not apply to entities in the banking, financial market infrastructure and digital infrastructure sectors.

Each Member State must:

adopt a national strategy and carry out regular risk assessments;
taking into account the outcome of the risk assessments, identify entities that provide essential services to society, the economy, public health and safety or the environment;
support the identified critical entities in enhancing their resilience with, for instance, guidance material, exercises, advice and training;
ensure that national authorities have the powers, resources and means to carry out their supervisory tasks, including conducting on-site inspections of critical entities and introducing penalties for non-compliance as part of an enforcement mechanism;
specify the conditions under which a critical entity can submit requests for background checks on personnel holding sensitive roles.

Critical entities must:

carry out risk assessments of their own to identify risks that could disrupt their ability to provide essential services;
take technical, security and organisational measures to enhance their resilience;
notify significant disruptive incidents to the national authorities.

If critical entities provide essential services in six or more Member States, they could benefit from extra advice in the form of advisory missions that evaluate the risk assessment and the resilience-enhancing measures the entity has put in place.

A Critical Entities Resilience Group facilitates cooperation among Member States, including sharing information and good practices.

The European Commission provides support, including on cross-sectoral risks, best practices, methodologies, cross-border training and exercises to test the resilience of critical entities.

FROM WHEN DO THE RULES APPLY?

The directive has to be transposed into national law by 17 October 2024. These rules should apply from 18 October 2024.

BACKGROUND

The Commission’s EU security union strategy and the counter-terrorism agenda for the EU stress the importance of ensuring the resilience of critical entities in the face of physical and digital risks.

This directive is part of a package of legislative measures to improve the resilience and incident-response capacities of public and private entities in the EU in the field of cybersecurity and critical infrastructure protection.

The Council also issued a recommendation on an EU-wide coordinated approach to strengthen the resilience of critical infrastructure in January 2023.

For further information, see:

How the EU responds to crises and builds resilience (European Council, Council of the European Union)
Critical infrastructure (European Commission).

KEY TERMS

Resilience. The capacity to prevent, protect against, respond to, resist, mitigate, absorb, accommodate and recover from incidents, which may be caused, among other things, by natural disasters, such as public health emergencies, or man-made threats such as terrorism, sabotage or hybrid threats*.

Hybrid threats. Hybrid threats arise when, state or non-state, actors seek to exploit the vulnerabilities of critical infrastructures by using in a coordinated way a mixture of measures (i.e. diplomatic, military, economic, technological) while remaining below the threshold of formal warfare, for example, mass disinformation campaigns that hinder the democratic process in elections.

MAIN DOCUMENT

Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC (OJ L 333, 27.12.2022, pp. 164–198).