keyboard_tab Cyber Resilience Act 2023/2841 EN

1.   By 8 April 2025, each Union entity shall, after carrying out an initial high_tag_cloud' title='definition'>cybersecurity review, such as an audit, establish an internal high_tag_cloud' title='definition'>cybersecurity risk-management, governance and control framework (the ‘Framework’). The establishment of the Framework shall be overseen by and under the responsibility of the Union entity’s high_tag_cloud' title='definition'>highest_level_of_management.

2.   The Framework shall cover the entirety of the unclassified ICT environment of the Union entity concerned, including any on-premises ICT environment, operational technology network, outsourced assets and services in cloud computing environments or hosted by third parties, mobile devices, corporate networks, business networks not connected to the internet and any devices connected to those environments (ICT environment). The Framework shall be based on an all-hazards approach.

3.   The Framework shall ensure a high level of high_tag_cloud' title='definition'>cybersecurity. The Framework shall establish internal high_tag_cloud' title='definition'>cybersecurity policies, including objectives and priorities, for the security of high_tag_cloud' title='definition'>network_and_information_systems, and the roles and responsibilities of the Union entity’s staff tasked with ensuring the effective implementation of this Regulation. The Framework shall also include mechanisms to measure the effectiveness of the implementation.

4.   The Framework shall be reviewed on a regular basis, in light of the changing high_tag_cloud' title='definition'>cybersecurity risks, and at least every four years. Where appropriate and following a request from the Interinstitutional Cybersecurity Board established pursuant to Article 10, a Union entity’s Framework may be updated on the basis of guidance from CERT-EU on high_tag_cloud' title='definition'>incidents identified or possible gaps observed in the implementation of this Regulation.

5.   The high_tag_cloud' title='definition'>highest_level_of_management of each Union entity shall be responsible for the implementation of this Regulation and shall oversee the compliance of its organisation with the obligations related to the Framework.

6.   Where appropriate and without prejudice to its responsibility for the implementation of this Regulation, the high_tag_cloud' title='definition'>highest_level_of_management of each Union entity may delegate specific obligations under this Regulation to senior officials within the meaning of Article 29(2) of the Staff Regulations or other officials at equivalent level, within the Union entity concerned. Regardless of any such delegation, the high_tag_cloud' title='definition'>highest_level_of_management may be held liable for infringements of this Regulation by the Union entity concerned.

7.   Each Union entity shall have effective mechanisms in place to ensure that an adequate percentage of the ICT budget is spent on high_tag_cloud' title='definition'>cybersecurity. Due account shall be taken of the Framework when establishing that percentage.

8.   Each Union entity shall appoint a local high_tag_cloud' title='definition'>cybersecurity officer or an equivalent function who shall act as its single point of contact regarding all aspects of high_tag_cloud' title='definition'>cybersecurity. The local high_tag_cloud' title='definition'>cybersecurity officer shall facilitate the implementation of this Regulation and report directly to the high_tag_cloud' title='definition'>highest_level_of_management on a regular basis on the state of the implementation. Without prejudice to the local high_tag_cloud' title='definition'>cybersecurity officer being the single point of contact in each Union entity, a Union entity may delegate certain tasks of the local high_tag_cloud' title='definition'>cybersecurity officer with regard to the implementation of this Regulation to CERT-EU on the basis of a service level agreement concluded between that Union entity and CERT-EU, or those tasks may be shared by several high_tag_cloud' title='definition'>Union_entities. Where those tasks are delegated to CERT-EU, the Interinstitutional Cybersecurity Board established pursuant to Article 10 shall decide whether the provision of that service is to be part of the baseline services of CERT-EU, taking into account the human and financial resources of the Union entity concerned. Each Union entity shall, without undue delay, notify CERT-EU of the local high_tag_cloud' title='definition'>cybersecurity officer appointed and any subsequent change thereto.

CERT-EU shall establish and keep updated a list of appointed local high_tag_cloud' title='definition'>cybersecurity officers.

9.   The senior officials within the meaning of Article 29(2) of the Staff Regulations or other officials at equivalent level of each Union entity, as well as all relevant members of staff tasked with implementing the high_tag_cloud' title='definition'>cybersecurity risk-management measures and with fulfilling obligations laid down in this Regulation, shall follow specific training on a regular basis with a view to gaining sufficient knowledge and skills in order to apprehend and assess high_tag_cloud' title='definition'>cybersecurity risk- and management practices and their impact on the operations of the Union entity.

1.   Without undue delay and in any event by 8 September 2025, each Union entity shall, under the oversight of its high_tag_cloud' title='definition'>highest_level_of_management, take appropriate and proportionate technical, operational and organisational measures to manage the high_tag_cloud' title='definition'>cybersecurity risks identified under the Framework, and to prevent or minimise the impact of high_tag_cloud' title='definition'>incidents. Taking into account the state of the art and, where applicable, relevant European and international standards, those measures shall ensure a level of security of high_tag_cloud' title='definition'>network_and_information_systems across the entirety of the ICT environment commensurate to the high_tag_cloud' title='definition'>cybersecurity risks posed. When assessing the proportionality of those measures, due account shall be taken of the degree of the Union entity’s exposure to high_tag_cloud' title='definition'>cybersecurity risks, its size and the likelihood of occurrence of high_tag_cloud' title='definition'>incidents and their severity, including their societal, economic and interinstitutional impact.

2.    high_tag_cloud' title='definition'>Union_entities shall address at least the following domains in the implementation of the high_tag_cloud' title='definition'>cybersecurity risk-management measures:

(a)	high_tag_cloud' title='definition'>cybersecurity policy, including measures needed to reach objectives and priorities referred to in Article 6 and paragraph 3 of this Article;

(b)	policies on high_tag_cloud' title='definition'>cybersecurity risk analysis and information system security;

(c)	policy objectives regarding the use of high_tag_cloud' title='definition'>cloud_computing_services;

(d)

high_tag_cloud' title='definition'>cybersecurity audit, where appropriate, which may include a high_tag_cloud' title='definition'>cybersecurity risk, high_tag_cloud' title='definition'>vulnerability and high_tag_cloud' title='definition'>cyber_threat assessment, and penetration testing carried out by a trusted private provider on a regular basis;

(e)	implementation of recommendations resulting from high_tag_cloud' title='definition'>cybersecurity audits referred to in point (d) through high_tag_cloud' title='definition'>cybersecurity and policy updates;

(f)	organisation of high_tag_cloud' title='definition'>cybersecurity, including establishment of roles and responsibilities;

(g)	asset management, including ICT asset inventory and ICT network cartography;

(h)	human resources security and access control;

(i)	operations security;

(j)	communications security;

(k)	system acquisition, development and maintenance, including policies on high_tag_cloud' title='definition'>vulnerability handling and disclosure;

(l)	where possible, policies on the transparency of the source code;

(m)	supply chain security, including security-related aspects concerning the relationships between each Union entity and its direct suppliers or service providers;

(n)	high_tag_cloud' title='definition'>incident handling and cooperation with CERT-EU, such as the maintenance of security monitoring and logging;

(o)	business continuity management, such as backup management and disaster recovery, and crisis management; and

(p)	promotion and development of high_tag_cloud' title='definition'>cybersecurity education, skills, awareness-raising, exercise and training programmes.

For the purposes of the first subparagraph, point (m), high_tag_cloud' title='definition'>Union_entities shall take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and high_tag_cloud' title='definition'>cybersecurity practices of their suppliers and service providers, including their secure development procedures.

3.    high_tag_cloud' title='definition'>Union_entities shall take at least the following specific high_tag_cloud' title='definition'>cybersecurity risk-management measures:

(a)	technical arrangements to enable and sustain teleworking;

(b)	concrete steps for moving towards zero-trust principles;

(c)	the use of multifactor authentication as a norm across high_tag_cloud' title='definition'>network_and_information_systems;

(d)	the use of cryptography and encryption, in particular end-to-end encryption, as well as secure digital signing;

(e)	where appropriate, secured voice, video and text communications, and secured emergency communications systems within the Union entity;

(f)	proactive measures for detection and removal of malware and spyware;

(g)	the establishment of software supply chain security through criteria for secure software development and evaluation;

(h)

the establishment and adoption of training programmes on high_tag_cloud' title='definition'>cybersecurity commensurate to the prescribed tasks and expected capabilities for the high_tag_cloud' title='definition'>highest_level_of_management and members of staff of the Union entity tasked with ensuring the effective implementation of this Regulation;

(i)	regular high_tag_cloud' title='definition'>cybersecurity training of staff members;

(j)	where relevant, participation in interconnectivity risk analyses between the high_tag_cloud' title='definition'>Union_entities;

(k)

the enhancement of procurement rules to facilitate a high common level of high_tag_cloud' title='definition'>cybersecurity through: (i) the removal of contractual barriers that limit information sharing from ICT service providers about high_tag_cloud' title='definition'>incidents, vulnerabilities and high_tag_cloud' title='definition'>cyber_threats with CERT-EU; (ii) contractual obligations to report high_tag_cloud' title='definition'>incidents, vulnerabilities and high_tag_cloud' title='definition'>cyber_threats as well as to have appropriate high_tag_cloud' title='definition'>incident response and monitoring mechanisms in place.

1.   Following the conclusion of the high_tag_cloud' title='definition'>cybersecurity maturity assessment carried out pursuant to Article 7 and taking into account the assets and high_tag_cloud' title='definition'>cybersecurity risks identified in the Framework as well as the high_tag_cloud' title='definition'>cybersecurity risk-management measures taken pursuant to Article 8, the high_tag_cloud' title='definition'>highest_level_of_management of each Union entity shall approve a high_tag_cloud' title='definition'>cybersecurity plan without undue delay and in any event by 8 January 2026. The high_tag_cloud' title='definition'>cybersecurity plan shall aim at increasing the overall high_tag_cloud' title='definition'>cybersecurity of the Union entity and shall thereby contribute to the enhancement of a high common level of high_tag_cloud' title='definition'>cybersecurity within the high_tag_cloud' title='definition'>Union_entities. The high_tag_cloud' title='definition'>cybersecurity plan shall include at least the high_tag_cloud' title='definition'>cybersecurity risk-management measures taken pursuant to Article 8. The high_tag_cloud' title='definition'>cybersecurity plan shall be revised every two years, or more frequently where necessary, following the high_tag_cloud' title='definition'>cybersecurity maturity assessments carried out pursuant to Article 7 or any substantial review of the Framework.

2.   The high_tag_cloud' title='definition'>cybersecurity plan shall include the Union entity’s cyber crisis management plan for major high_tag_cloud' title='definition'>incidents.

3.   The Union entity shall submit the completed high_tag_cloud' title='definition'>cybersecurity plan to the Interinstitutional Cybersecurity Board established pursuant to Article 10.

1.   The IICB shall, pursuant to Article 10(2) and Article 11, effectively monitor the implementation of this Regulation and of adopted guidelines, recommendations and calls for action by the high_tag_cloud' title='definition'>Union_entities. The IICB may request information or documentation necessary for that purpose from the high_tag_cloud' title='definition'>Union_entities. For the purpose of adopting compliance measures under this Article, where the Union entity concerned is directly represented on the IICB, that Union entity shall not have voting rights.

2.   Where the IICB finds that a Union entity has not effectively implemented this Regulation or guidelines, recommendations or calls for action issued pursuant thereto, it may, without prejudice to the internal procedures of the Union entity concerned, and after giving an opportunity to the Union entity concerned to present its observations:

(a)	communicate a reasoned opinion to the Union entity concerned with observed gaps in the implementation of this Regulation;

(b)

provide, after consulting CERT-EU, guidelines to the Union entity concerned to ensure that its Framework, high_tag_cloud' title='definition'>cybersecurity risk-management measures, high_tag_cloud' title='definition'>cybersecurity plan and reporting comply with this Regulation within a specified period;

(c)	issue a warning to address identified shortcomings within a specified period, including recommendations to amend measures adopted by the Union entity concerned pursuant to this Regulation;

(d)	issue a reasoned notification to the Union entity concerned, in the event that shortcomings identified in a warning issued pursuant to point (c) were not sufficiently addressed within the specified period;

(e)	issue: (i) a recommendation for an audit to be carried out; or (ii) a request that an audit be performed by a third-party audit service;

(f)	if applicable, inform the Court of Auditors, within the remit of its mandate, of the alleged non-compliance;

(g)	issue a recommendation that all Member States and high_tag_cloud' title='definition'>Union_entities implement a temporary suspension of data flows to the Union entity concerned.

For the purposes of the first subparagraph, point (c), the audience of a warning shall be restricted appropriately, where necessary in view of the high_tag_cloud' title='definition'>cybersecurity risk.

Warnings and recommendations issued pursuant to the first subparagraph shall be directed to the high_tag_cloud' title='definition'>highest_level_of_management of the Union entity concerned.

3.   Where the IICB has adopted measures under paragraph 2, first subparagraph, points (a) to (g), the Union entity concerned shall provide details of the measures and actions taken to address the alleged shortcomings identified by the IICB. The Union entity shall submit those details within a reasonable period to be agreed with the IICB.

4.   Where the IICB considers that there is persistent infringement of this Regulation by a Union entity resulting directly from actions or omissions of an official or other servant of the Union, including at the high_tag_cloud' title='definition'>highest_level_of_management, the IICB shall request that the Union entity concerned take appropriate action, including requesting it to consider taking action of a disciplinary nature, in accordance with the rules and procedures laid down in the Staff Regulations and any other applicable rules and procedures. To that end, the IICB shall transfer the necessary information to the Union entity concerned.

5.   Where high_tag_cloud' title='definition'>Union_entities notify that they are unable to meet the deadlines set out in Article 6(1) and Article 8(1), the IICB may, in duly substantiated cases, taking into account the size of the Union entity, authorise the extension of those deadlines.

1.   CERT-EU’s mission shall be to contribute to the security of the unclassified ICT environment of high_tag_cloud' title='definition'>Union_entities by advising them on high_tag_cloud' title='definition'>cybersecurity, by helping them to prevent, detect, handle, mitigate, respond to and recover from high_tag_cloud' title='definition'>incidents and by acting as their high_tag_cloud' title='definition'>cybersecurity information exchange and high_tag_cloud' title='definition'>incident response coordination hub.

2.   CERT-EU shall collect, manage, analyse and share information with the high_tag_cloud' title='definition'>Union_entities on high_tag_cloud' title='definition'>cyber_threats, vulnerabilities and high_tag_cloud' title='definition'>incidents in unclassified ICT infrastructure. It shall coordinate responses to high_tag_cloud' title='definition'>incidents at interinstitutional and Union entity level, including by providing or coordinating the provision of specialised operational assistance.

3.   CERT-EU shall carry out the following tasks to assist the high_tag_cloud' title='definition'>Union_entities:

(a)	support them with the implementation of this Regulation and contribute to the coordination of the implementation of this Regulation through the measures listed in Article 14(1) or through ad-hoc reports requested by the IICB;

(b)	offer standard CSIRT services for high_tag_cloud' title='definition'>Union_entities by means of a package of high_tag_cloud' title='definition'>cybersecurity services described in its service catalogue (baseline services);

(c)	maintain a network of peers and partners to support the services as outlined in Articles 17 and 18;

(d)	bring to the attention of the IICB any problems relating to the implementation of this Regulation and the implementation of guidelines, recommendations and calls for action;

(e)	on the basis of the information referred to in paragraph 2, contribute to the Union cyber situational awareness in close cooperation with ENISA;

(f)	coordinate the management of major high_tag_cloud' title='definition'>incidents;

(g)	act on the part of high_tag_cloud' title='definition'>Union_entities as the equivalent of the coordinator designated for the purposes of coordinated high_tag_cloud' title='definition'>vulnerability disclosure pursuant to Article 12(1) of Directive (EU) 2022/2555;

(h)	provide, upon the request of a Union entity, proactive non-intrusive scanning of publicly accessible high_tag_cloud' title='definition'>network_and_information_systems of that Union entity.

The information referred to in the first subparagraph, point (e), shall be shared with the IICB, the CSIRTs network and the European Union Intelligence and Situation Centre (EU INTCEN), where applicable and appropriate, and subject to appropriate confidentiality conditions.

4.   CERT-EU may, in accordance with Article 17 or 18 as appropriate, cooperate with relevant high_tag_cloud' title='definition'>cybersecurity communities within the Union and its Member States, including in the following areas:

(a)	preparedness, high_tag_cloud' title='definition'>incident coordination, information exchange and crisis response at the technical level on cases linked to high_tag_cloud' title='definition'>Union_entities;

(b)	operational cooperation regarding the CSIRTs network, including with regard to mutual assistance;

(c)	high_tag_cloud' title='definition'>cyber_threat intelligence, including situational awareness;

(d)	on any topic requiring CERT-EU’s technical high_tag_cloud' title='definition'>cybersecurity expertise.

5.   Within its competence, CERT-EU shall engage in structured cooperation with ENISA on capacity building, operational cooperation and long-term strategic analyses of high_tag_cloud' title='definition'>cyber_threats in accordance with Regulation (EU) 2019/881. CERT-EU may cooperate and exchange information with Europol’s European Cybercrime Centre.

6.   CERT-EU may provide the following services not described in its service catalogue (chargeable services):

(a)

services that support the high_tag_cloud' title='definition'>cybersecurity of high_tag_cloud' title='definition'>Union_entities’ ICT environment, other than those referred to in paragraph 3, on the basis of service level agreements and subject to available resources, in particular broad-spectrum network monitoring, including first-line 24/7 monitoring for high-severity high_tag_cloud' title='definition'>cyber_threats;

(b)	services that support high_tag_cloud' title='definition'>cybersecurity operations or projects of high_tag_cloud' title='definition'>Union_entities, other than those to protect their ICT environment, on the basis of written agreements and with the prior approval of the IICB;

(c)	upon request, a proactive scanning of the high_tag_cloud' title='definition'>network_and_information_systems of the Union entity concerned to detect vulnerabilities with a potential significant impact;

(d)

services that support the security of their ICT environment to organisations other than the high_tag_cloud' title='definition'>Union_entities that cooperate closely with high_tag_cloud' title='definition'>Union_entities, for instance by having tasks or responsibilities conferred under Union law, on the basis of written agreements and with the prior approval of the IICB.

With regard to the first subparagraph, point (d), CERT-EU may, on an exceptional basis, enter into service level agreements with entities other than the high_tag_cloud' title='definition'>Union_entities with the prior approval of the IICB.

7.   CERT-EU shall organise and may participate in high_tag_cloud' title='definition'>cybersecurity exercises or recommend participation in existing exercises, where applicable in close cooperation with ENISA, to test the level of high_tag_cloud' title='definition'>cybersecurity of the high_tag_cloud' title='definition'>Union_entities.

8.   CERT-EU may provide assistance to high_tag_cloud' title='definition'>Union_entities regarding high_tag_cloud' title='definition'>incidents in high_tag_cloud' title='definition'>network_and_information_systems handling EUCI where it is explicitly requested to do so by the high_tag_cloud' title='definition'>Union_entities concerned in accordance with their respective procedures. The provision of assistance by CERT-EU under this paragraph shall be without prejudice to applicable rules concerning the protection of classified information.

9.   CERT-EU shall inform high_tag_cloud' title='definition'>Union_entities about its high_tag_cloud' title='definition'>incident handling procedures and processes.

10.   CERT-EU shall contribute, with a high level of confidentiality and reliability, via the appropriate cooperation mechanisms and reporting lines, relevant and anonymised information about major high_tag_cloud' title='definition'>incidents and the manner in which they were handled. That information shall be included in the report referred to in Article 10(14).

11.   CERT-EU shall, in cooperation with the EDPS, support the high_tag_cloud' title='definition'>Union_entities concerned when addressing high_tag_cloud' title='definition'>incidents resulting in personal data breaches, without prejudice to the competence and tasks of the EDPS as a supervisory authority under Regulation (EU) 2018/1725.

12.   CERT-EU may, if expressly requested by high_tag_cloud' title='definition'>Union_entities’ policy departments, provide technical advice or input on relevant policy matters.

1.    high_tag_cloud' title='definition'>Union_entities may, on a voluntary basis, notify CERT-EU of, and provide it with information on, high_tag_cloud' title='definition'>incidents, high_tag_cloud' title='definition'>cyber_threats, high_tag_cloud' title='definition'>near_misses and vulnerabilities that affect them. CERT-EU shall ensure that efficient means of communication, with a high level of traceability, confidentiality and reliability, are available for the purpose of facilitating information sharing with the high_tag_cloud' title='definition'>Union_entities. When processing notifications, CERT-EU may prioritise the processing of mandatory notifications over voluntary notifications. Without prejudice to Article 12, voluntary notification shall not result in the imposition of any additional obligations upon the reporting Union entity to which it would not have been subject had it not submitted the notification.

2.   To perform its mission and tasks conferred pursuant to Article 13, CERT-EU may request high_tag_cloud' title='definition'>Union_entities to provide it with information from their respective ICT system inventories, including information relating to high_tag_cloud' title='definition'>cyber_threats, high_tag_cloud' title='definition'>near_misses, vulnerabilities, indicators of compromise, high_tag_cloud' title='definition'>cybersecurity alerts and recommendations regarding configuration of high_tag_cloud' title='definition'>cybersecurity tools to detect high_tag_cloud' title='definition'>incidents. The requested Union entity shall transmit the requested information, and any subsequent updates thereto, without undue delay.

3.   CERT-EU may exchange high_tag_cloud' title='definition'>incident-specific information with high_tag_cloud' title='definition'>Union_entities which reveals the identity of the Union entity affected by the high_tag_cloud' title='definition'>incident, provided that the Union entity affected consents. Where a Union entity withholds its consent, it shall provide CERT-EU with reasons substantiating that decision.

4.    high_tag_cloud' title='definition'>Union_entities shall, upon request, share information with the European Parliament and the Council on the completion of high_tag_cloud' title='definition'>cybersecurity plans.

5.   The IICB or CERT-EU, as applicable, shall, upon request, share guidelines, recommendations and calls for action with the European Parliament and the Council.

6.   The sharing obligations laid down in this Article shall not extend to:

(a)

EUCI;

(b)	information the further distribution of which has been excluded by means of a visible marking, unless the sharing thereof with CERT-EU has been explicitly allowed.