keyboard_tab Cyber Resilience Act 2023/2841 EN

(a)

support them with the implementation of this Regulation and contribute to the coordination of the implementation of this Regulation through the measures listed in Article 14(1) or through ad-hoc reports requested by the IICB;

(b)

offer standard CSIRT services for Union_entities by means of a package of cybersecurity services described in its service catalogue (baseline services);

(c)

maintain a network of peers and partners to support the services as outlined in Articles 17 and 18;

(d)

bring to the attention of the IICB any problems relating to the implementation of this Regulation and the implementation of guidelines, recommendations and calls for action;

(e)

on the basis of the information referred to in paragraph 2, contribute to the Union cyber situational awareness in close cooperation with ENISA;

(f)

coordinate the management of major incidents;

(g)

act on the part of Union_entities as the equivalent of the coordinator designated for the purposes of coordinated vulnerability disclosure pursuant to Article 12(1) of Directive (EU) 2022/2555;

(h)

provide, upon the request of a Union entity, proactive non-intrusive scanning of publicly accessible network_and_information_systems of that Union entity.

(a)

preparedness, incident coordination, information exchange and crisis response at the technical level on cases linked to Union_entities;

(b)

operational cooperation regarding the CSIRTs network, including with regard to mutual assistance;

(c)

cyber_threat intelligence, including situational awareness;

(d)

on any topic requiring CERT-EU’s technical cybersecurity expertise.

(a)

services that support the cybersecurity of Union_entities’ ICT environment, other than those referred to in paragraph 3, on the basis of service level agreements and subject to available resources, in particular broad-spectrum network monitoring, including first-line 24/7 monitoring for high-severity cyber_threats;

(b)

services that support cybersecurity operations or projects of Union_entities, other than those to protect their ICT environment, on the basis of written agreements and with the prior approval of the IICB;

(c)

upon request, a proactive scanning of the network_and_information_systems of the Union entity concerned to detect vulnerabilities with a potential significant impact;

(d)

services that support the security of their ICT environment to organisations other than the Union_entities that cooperate closely with Union_entities, for instance by having tasks or responsibilities conferred under Union law, on the basis of written agreements and with the prior approval of the IICB.

(a)

calls for action describing urgent security measures that Union_entities are urged to take within a set timeframe;

(b)

proposals to the IICB for guidelines addressed to all or a subset of the Union_entities;

(c)

proposals to the IICB for recommendations addressed to individual Union_entities.

(a)

common methodologies and a model for assessing the cybersecurity maturity of the Union_entities, including the corresponding scales or KPIs, serving as reference in support of continuous cybersecurity improvement across the Union_entities and facilitating the prioritisation of cybersecurity domains and measures taking into account entities’ cybersecurity posture;

(b)

arrangements for or improvements to cybersecurity risk management and the cybersecurity risk-management measures;

(c)

arrangements for cybersecurity maturity assessments and cybersecurity plans;

(d)

where appropriate, the use of common technology, architecture, open source and associated best practices with the aim of achieving interoperability and common standards, including a coordinated approach to supply chain security;

(e)

where appropriate, information to facilitate the use of common procurement instruments for the purchasing of relevant cybersecurity services and products from third-party suppliers;

(f)

information-sharing arrangements pursuant to Article 20.