keyboard_tab Cyber Resilience Act 2023/2841 EN
BG CS DA DE EL EN ES ET FI FR GA HR HU IT LV LT MT NL PL PT RO SK SL SV print pdf
- 1 Art. 14 Guidelines, recommendations and calls for action
- 1 Art. 20 Cybersecurity information-sharing arrangements
CHAPTER I
GENERAL PROVISIONS
CHAPTER II
MEASURES FOR A HIGH COMMON LEVEL OF CYBERSECURITY
CHAPTER III
INTERINSTITUTIONAL CYBERSECURITY BOARD
CHAPTER IV
CERT-EU
CHAPTER V
COOPERATION AND REPORTING OBLIGATIONS
CHAPTER VI
FINAL PROVISIONS
- Union entities
- network and information system
- security of network and information systems
- cybersecurity
- highest level of management
- near miss
- incident
- major incident
- large-scale cybersecurity incident
- incident handling
- cyber threat
- significant cyber threat
- vulnerability
- cybersecurity risk
- cloud computing service
- cybersecurity 13
- union_entities 10
- shall 9
- information 9
- cert-eu 8
- union 6
- entity 6
- article 5
- recommendations 5
- measures 4
- arrangements 4
- action 4
- common 4
- sharing 3
- voluntary 3
- without 3
- provide 3
- iicb 3
- guidelines 3
- notifications 3
- including 3
- upon 3
- which 3
- been 3
- calls 3
- request 3
- security 3
- obligations 2
- european 2
- facilitating 2
- the 2
- plans 2
- appropriate 2
- council 2
- from 2
- parliament 2
- affected 2
- pursuant 2
- 2
- share 2
- notification 2
- incidents 2
- requested 2
- cyber_threats 2
- near_misses 2
- vulnerabilities 2
- means 2
- processing 2
- information-sharing 2
- maturity 2
Article 14
Guidelines, recommendations and calls for action
1. CERT-EU shall support the implementation of this Regulation by issuing:
| (a) | calls for action describing urgent security measures that Union_entities are urged to take within a set timeframe; |
| (b) | proposals to the IICB for guidelines addressed to all or a subset of the Union_entities; |
| (c) | proposals to the IICB for recommendations addressed to individual Union_entities. |
With regard to the first subparagraph, point (a), the Union entity concerned shall, without undue delay after receiving the call for action, inform CERT-EU of how the urgent security measures were applied.
2. Guidelines and recommendations may include:
| (a) | common methodologies and a model for assessing the cybersecurity maturity of the Union_entities, including the corresponding scales or KPIs, serving as reference in support of continuous cybersecurity improvement across the Union_entities and facilitating the prioritisation of cybersecurity domains and measures taking into account entities’ cybersecurity posture; |
| (b) | arrangements for or improvements to cybersecurity risk management and the cybersecurity risk-management measures; |
| (c) | arrangements for cybersecurity maturity assessments and cybersecurity plans; |
| (d) | where appropriate, the use of common technology, architecture, open source and associated best practices with the aim of achieving interoperability and common standards, including a coordinated approach to supply chain security; |
| (e) | where appropriate, information to facilitate the use of common procurement instruments for the purchasing of relevant cybersecurity services and products from third-party suppliers; |
| (f) | information-sharing arrangements pursuant to Article 20. |
Article 20
Cybersecurity information-sharing arrangements
1. Union_entities may, on a voluntary basis, notify CERT-EU of, and provide it with information on, incidents, cyber_threats, near_misses and vulnerabilities that affect them. CERT-EU shall ensure that efficient means of communication, with a high level of traceability, confidentiality and reliability, are available for the purpose of facilitating information sharing with the Union_entities. When processing notifications, CERT-EU may prioritise the processing of mandatory notifications over voluntary notifications. Without prejudice to Article 12, voluntary notification shall not result in the imposition of any additional obligations upon the reporting Union entity to which it would not have been subject had it not submitted the notification.
2. To perform its mission and tasks conferred pursuant to Article 13, CERT-EU may request Union_entities to provide it with information from their respective ICT system inventories, including information relating to cyber_threats, near_misses, vulnerabilities, indicators of compromise, cybersecurity alerts and recommendations regarding configuration of cybersecurity tools to detect incidents. The requested Union entity shall transmit the requested information, and any subsequent updates thereto, without undue delay.
3. CERT-EU may exchange incident-specific information with Union_entities which reveals the identity of the Union entity affected by the incident, provided that the Union entity affected consents. Where a Union entity withholds its consent, it shall provide CERT-EU with reasons substantiating that decision.
4. Union_entities shall, upon request, share information with the European Parliament and the Council on the completion of cybersecurity plans.
5. The IICB or CERT-EU, as applicable, shall, upon request, share guidelines, recommendations and calls for action with the European Parliament and the Council.
6. The sharing obligations laid down in this Article shall not extend to:
| (a) | EUCI; |
| (b) | information the further distribution of which has been excluded by means of a visible marking, unless the sharing thereof with CERT-EU has been explicitly allowed. |
whereas