37 Amendments of Sara CERDAS related to 2020/0365(COD)
Amendment 15 #
Proposal for a directive
Recital 2
Recital 2
(2) Despite existing measures at 19 Union and national level aimed at supporting the protection of critical infrastructures in the Union, the entities operating those infrastructures are not adequately equipped to address current and anticipated future risks to their operations that may result in disruptions of the provision of services that are essential for the performance of vital societal functions or economic activities. This is due to a dynamic threat landscape with an evolving terrorist threat, cyber attacks and growing interdependencies between infrastructures and sectors, as well as an increased physical risk due to natural disasters and climate change, which increases the frequency and scale of extreme weather events and brings long-term changes in average climate that can reduce the capacity and efficiency of certain infrastructure types if resilience or climate adaptation measures are not in place. Moreover, relevant sectors and types of entities are not recognised consistently as critical in all Member States. _________________ 19European Programme for Critical Infrastructure Protection (EPCIP).
Amendment 26 #
Proposal for a directive
Recital 5
Recital 5
(5) It is therefore necessary to lay down harmonised minimum rulrules for all critical entities from all Member States to ensure the provision of essential services in the internal market and enhance the resilience of critical entities.
Amendment 37 #
Proposal for a directive
Recital 19
Recital 19
(19) Member States should support critical entities in strengthening their resilience, in compliance with their obligations under this Directive, without prejudice to the entities’ own legal responsibility to ensure such compliance. Member States could in particular develop guidance materials and methodologies, support the organisation of exercises to test their resilience and provide training to personnel of critical entities. Moreover, given the interdependencies between entities and sectors, Member States should establish information sharing tools to support voluntary information sharing between critical entities, without prejudice to the application of competition rules laid down in the Treaty on the Functioning of the European Union.
Amendment 41 #
Proposal for a directive
Recital 20
Recital 20
(20) In order to be able to ensure their resilience, critical entities should have a comprehensive understanding of all relevant risks to which they are exposed and, analyse those risks and establish measures to combat them. To that aim, they should carry out risks assessments, whenever necessary in view of their particular circumstances and the evolution of those risks, yet in any event every fourthree years. The risk assessments by critical entities should be based on the risk assessment carried out by Member States.
Amendment 46 #
Proposal for a directive
Recital 28
Recital 28
(28) In order to support the Commission and facilitate strategic cooperation and the exchange of information, including best practices, on issues relating to this Directive, a Critical Entities Resilience Group, which is a Commission expert group, should be established. Member States should endeavour to ensure effective and efficient cooperation of the designated representatives of their competent authorities in the Critical Entities Resilience Group. The group should begin to perform its tasks from sixfour months after the entry into force of this Directive, so as to provide additional means for appropriate cooperation during the transposition period of this Directive.
Amendment 47 #
Proposal for a directive
Recital 30
Recital 30
(30) Member States should ensure that their competent authorities have certain specific powers, the necessary infrastructure and tools for the proper application and enforcement of this Directive in relation to critical entities, where those entities fall under their jurisdiction as specified in this Directive. Those powers should include, notably, the power to conduct inspections, supervision and audits, require critical entities to provide information and evidence relating to the measures they have taken to comply with their obligations and, where necessary, issue orders to remedy identified infringements. When issuing such orders, Member States should not require measures which go beyond what is necessary and proportionate to ensure compliance of the critical entity concerned, taking account of in particular the seriousness of the infringement and the economic capacity of the critical entity. More generally, those powers should be accompanied by appropriate and effective safeguards to be specified in national law, in accordance with the requirements resulting from Charter of Fundamental Rights of the European Union. When assessing the compliance of a critical entity with its obligations under this Directive, competent authorities designated under this Directive should be able to request the competent authorities designated under the NIS 2 Directive to assess the cybersecurity of those entities. Those competent authorities should cooperate and exchange information for that purpose.
Amendment 59 #
Proposal for a directive
Article 3 – paragraph 1
Article 3 – paragraph 1
1. Each Member State shall adopt by [threewo years after entry into force of this Directive] a strategy for reinforcing the resilience of critical entities. This strategy shall set out strategic objectives and policy measures with a view to achieving and maintaining a high level of resilience on the part of those critical entities and covering at least the sectors referred to in the Annex.
Amendment 60 #
Proposal for a directive
Article 3 – paragraph 2 – point a
Article 3 – paragraph 2 – point a
(a) strategic objectives and priorities for the purposes of enhancing the overall resilience of critical entities taking into account cross-border and cross-sectoral interdependencies and the need for the exchange of information between entities;
Amendment 63 #
Proposal for a directive
Article 3 – paragraph 2 – subparagraph 1
Article 3 – paragraph 2 – subparagraph 1
The strategy shall be updated where necessary and at least every fourthree years.
Amendment 68 #
Proposal for a directive
Article 4 – paragraph 1 – introductory part
Article 4 – paragraph 1 – introductory part
1. Competent authorities designated pursuant to Article 8 shall establish a list of essential services in the sectors referred to in the Annex. They shall carry out by [threewo years after entry into force of this Directive], and subsequently where necessary, and at least every fourthree years, an assessment of all relevant risks that may affect the provision of those essential services, with a view to identifying critical entities in accordance with Article 5(1), and assisting those critical entities to take measures pursuant to Article 11.
Amendment 72 #
Proposal for a directive
Article 4 – paragraph 1 – subparagraph 1
Article 4 – paragraph 1 – subparagraph 1
The risk assessment shall account for all relevant natural and man-made risks, including accidents, natural disasters, public health emergencies, antagonistic threats, cyber attacks including terrorist offences pursuant to Directive (EU) 2017/541 of the European Parliament and of the Council34 . _________________ 34Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA (OJ L 88, 31.3.2017, p. 6).
Amendment 77 #
Proposal for a directive
Article 4 – paragraph 5
Article 4 – paragraph 5
5. The Commission may, in cooperation with the Member States, develop a voluntary common reporting template for the purposes of complying with paragraph 4.
Amendment 80 #
Proposal for a directive
Article 5 – paragraph 1
Article 5 – paragraph 1
1. By [threewo years and three months after entry into force of this Directive] Member States shall identify for each sector and subsector referred to in the Annex, other than points 3, 4 and 8 thereof, the critical entities.
Amendment 81 #
(b) (the provision of that service depends on infrastructure located in the Member State; and the existing possibilities;
Amendment 84 #
Proposal for a directive
Article 5 – paragraph 6
Article 5 – paragraph 6
6. For the purposes of Chapter IV, Member States shall ensure that critical entities, following the notification referred in paragraph 3, provide information to their competent authorities designated pursuant to Article 8 of this Directive on whether they provide essential services to or in more than one third oftwo Member States. Where that is so, the Member State concerned shall notify, without undue delay, to the Commission the identity of those critical entities.
Amendment 85 #
Proposal for a directive
Article 5 – paragraph 7 – introductory part
Article 5 – paragraph 7 – introductory part
7. Member States shall, where necessary and in any event at least every fourthree years, review and, where appropriate, update the list of identified critical entities.
Amendment 87 #
Proposal for a directive
Article 6 – paragraph 1 – point c
Article 6 – paragraph 1 – point c
(c) the impacts that incidents could have, in terms of degree and duration, on economic and societal activities, the environment and public security and safety;
Amendment 89 #
Proposal for a directive
Article 6 – paragraph 2 – introductory part
Article 6 – paragraph 2 – introductory part
2. Member States shall submit to the Commission by [threewo years and three months after the entry into force of this Directive] the following information:
Amendment 90 #
Proposal for a directive
Article 6 – paragraph 2 – subparagraph 1
Article 6 – paragraph 2 – subparagraph 1
They shall subsequently submit that information where necessary, and at least every fourthree years.
Amendment 92 #
Proposal for a directive
Article 7 – paragraph 1
Article 7 – paragraph 1
1. As regards the sectors referred to in points 3, 4 and 8 of the Annex, Member States shall, by [threewo years and three months after entry into force of this Directive], identify the entities that shall be treated as equivalent to critical entities for the purposes of this Chapter. They shall apply the provisions of Articles 3, 4, 5(1) to (4) and (7), and 9 in respect of those entities.
Amendment 95 #
Proposal for a directive
Article 8 – paragraph 3
Article 8 – paragraph 3
3. By [threewo years and six months after entry into force of this Directive], and every year thereafter, the single points of contact shall submit a summary report to the Commission and to the Critical Entities Resilience Group on the notifications received, including the number of notifications, the nature of notified incidents and the actions taken in accordance with Article 13(3).
Amendment 96 #
5 a. In the event of exceptional situations and high-risk incidents where critical entities and responsible national authorities fail to ensure that the incident is absorbed and remedied, the Commission should intervene through the available levers to help the critical entity to resolve this issue;
Amendment 98 #
Proposal for a directive
Article 10 – paragraph 1
Article 10 – paragraph 1
Member States shall ensure that critical entities assess within six months after receiving the notification referred to in Article 5(3), and subsequently where necessary and at least every fourthree years, on the basis of Member States’ risk assessments and other relevant sources of information, all relevant risks that may disrupt their operations.
Amendment 105 #
Proposal for a directive
Article 11 – paragraph 3
Article 11 – paragraph 3
3. Upon request of the Member State that identified the critical entity and with the agreement of the critical entity concerned, the Commission shall organise advisory missions, in accordance with the arrangements set out in Article 15(4), (5), (7) and (8), to provide advice to the critical entity concerned in meeting its obligations pursuant to Chapter III. The advisory mission shall report its findings to the Commission, that Member State and the critical entity concerned.
Amendment 109 #
Proposal for a directive
Article 14 – paragraph 2
Article 14 – paragraph 2
2. An entity shall be considered a critical entity of particular European significance when it has been identified as a critical entity and it provides essential services to or in more than one third oftwo Member States and has been notified as such to the Commission pursuant to Article 5(1) and (6), respectively.
Amendment 111 #
Proposal for a directive
Article 15 – paragraph 1 – subparagraph 1
Article 15 – paragraph 1 – subparagraph 1
That Member State shall also inform, without undue thorough delay, the Commission and the Critical Entities Resilience Group of any supervisory or enforcement actions, including any assessments of compliance or orders issued, that its competent authority has undertaken pursuant to Articles 18 and 19 in respect of that entity.
Amendment 112 #
Proposal for a directive
Article 15 – paragraph 3 – introductory part
Article 15 – paragraph 3 – introductory part
3. The advisory mission shall report its findings to the Commission, the Critical Entities Resilience Group and the critical entity of particular European significance concerned within a period of three month60 days after the conclusion of the advisory mission.
Amendment 113 #
Proposal for a directive
Article 15 – paragraph 3 – subparagraph 3
Article 15 – paragraph 3 – subparagraph 3
That Member State shall take due and objectively account of those views and provide information to the Commission and the Critical Entities Resilience Group on any measures it has taken pursuant to the communication.
Amendment 114 #
Proposal for a directive
Article 16 – paragraph 1
Article 16 – paragraph 1
1. A Critical Entities Resilience Group is established with effect from [sixfour months after the entry into force of this Directive]. It shall support the Commission and facilitate strategic cooperation and the exchange of information on issues relating to this Directive.
Amendment 116 #
Proposal for a directive
Article 16 – paragraph 3 – point c
Article 16 – paragraph 3 – point c
(c) facilitating the exchange of best practices with regard to the identification of critical entities by the Member States in accordance with Article 5, including in relation to cross-border, cross-sectoral dependencies and regarding risks and incidents;
Amendment 117 #
Proposal for a directive
Article 16 – paragraph 3 – point h
Article 16 – paragraph 3 – point h
(h) exchanging information and best practices on innovation, research and development relating to the resilience of critical entities in accordance with this Directive;
Amendment 118 #
Proposal for a directive
Article 16 – paragraph 4
Article 16 – paragraph 4
4. By [2418 months after entry into force of this Directive] and every two years thereafter, the Critical Entities Resilience Group shall establish a work programme in respect of actions to be undertaken to implement its objectives and tasks, which shall be consistent with the requirements and objectives of this Directive.
Amendment 121 #
Proposal for a directive
Article 16 – paragraph 7
Article 16 – paragraph 7
7. The Commission shall provide to the Critical Entities Resilience Group a summary report of the information provided by the Member States pursuant to Articles 3(3) and 4(4) by [threewo years and six months after entry into force of this Directive] and subsequently where necessary and at least every fourthree years.
Amendment 122 #
Proposal for a directive
Article 18 – paragraph 1 – introductory part
Article 18 – paragraph 1 – introductory part
1. In order to assess the compliance of the entities that the Member States identified as critical entities pursuant to Article 5 with the obligations pursuant to this Directive, they shall ensure that the competent authorities shall have the powers and mean, means and human and financial resources to:
Amendment 123 #
Proposal for a directive
Article 18 – paragraph 2 – introductory part
Article 18 – paragraph 2 – introductory part
2. Member States shall ensure that the competent authorities have the powers and mean, means and human and financial resources to require, where necessary for the performance of their tasks under this Directive, that the entities that they identified as critical entities pursuant to paragraph 5 provide, within a reasonable time period set by those authorities:
Amendment 125 #
Proposal for a directive
Article 22 – paragraph 1
Article 22 – paragraph 1
By [5436 months after the entry into force of this Directive], the Commission shall submit a report to the European Parliament and to the Council, assessing the extent to which the Member States have taken the necessary measures to comply with this Directive.
Amendment 126 #
Proposal for a directive
Article 22 – paragraph 2
Article 22 – paragraph 2
The Commission shall periodically review the functioning of this Directive, and report to the European Parliament and to the Council. The report shall in particular assess the impact and added value of this Directive on ensuring the resilience of critical entities and whether the scope of the Directive should be extended to cover other sectors or subsectors. The first report shall be submitted by [sixfive years after the entry into force of this Directive] and shall assess in particular whether the scope of the Directive should be extended to include the food production, processing and distribution sector.