Cyber Resilience Act 2023/2841 EN

(1)	‘ Union_entities’ means the Union institutions, bodies, offices and agencies set up by or pursuant to the Treaty on European Union, the Treaty on the Functioning of European Union (tfeu) or the Treaty establishing the European Atomic Energy Community;

(2)	‘ network_and_information_system’ means a network_and_information_system as defined in Article 6, point (1), of Directive (EU) 2022/2555;

(3)	‘security of network_and_information_systems’ means security of network_and_information_systems as defined in Article 6, point (2), of Directive (EU) 2022/2555;

(4)	‘ cybersecurity’ means cybersecurity as defined in Article 2, point (1), of Regulation (EU) 2019/881;

(5)

‘ highest_level_of_management’ means a manager, management body or coordination and oversight body that is responsible for the functioning of a Union entity, at the most senior administrative level, with a mandate to adopt or authorise decisions in line with the high-level governance arrangements of that Union entity, without prejudice to the formal responsibilities of other levels of management for compliance and cybersecurity risk management in their respective areas of responsibility;

(6)	‘ near_miss’ means a near_miss as defined in Article 6, point (5), of Directive (EU) 2022/2555;

(7)	‘ incident’ means an incident as defined in Article 6, point (6), of Directive (EU) 2022/2555;

(8)	‘major incident’ means an incident which causes a level of disruption that exceeds a Union entity’s and CERT-EU’s capacity to respond to it or which has a significant impact on at least two Union_entities;

(9)	‘large-scale cybersecurity incident’ means a large-scale cybersecurity incident as defined in Article 6, point (7), of Directive (EU) 2022/2555;

(10)	‘ incident handling’ means incident handling as defined in Article 6, point (8), of Directive (EU) 2022/2555;

(11)	‘ cyber_threat’ means a cyber_threat as defined in Article 2, point (8), of Regulation (EU) 2019/881;

(12)	‘significant cyber_threat’ means a significant cyber_threat as defined in Article 6, point (11), of Directive (EU) 2022/2555;

(13)	‘ vulnerability’ means a vulnerability as defined in Article 6, point (15), of Directive (EU) 2022/2555;

(14)	‘ cybersecurity risk’ means a risk as defined in Article 6, point (9), of Directive (EU) 2022/2555;

(15)	‘ cloud_computing_service’ means a cloud_computing_service as defined in Article 6, point (30), of Directive (EU) 2022/2555.

Article 16

Financial and staffing matters

1. CERT-EU shall be integrated into the administrative structure of a directorate-general of the Commission in order to benefit from the Commission’s administrative, financial management and accounting support structures, while maintaining its status as an autonomous interinstitutional service provider for all Union_entities. The Commission shall inform the IICB of the administrative location of CERT-EU and any changes thereto. The Commission shall review the administrative arrangements related to CERT-EU on a regular basis and in any event before the establishment of any multiannual financial framework pursuant to Article 312 tfeu, in order to allow for appropriate action to be taken. The review shall include the possibility of establishing CERT-EU as a Union office.

2. For the application of administrative and financial procedures, the Head of CERT-EU shall act under the authority of the Commission and under the supervision of the IICB.

3. CERT-EU’s tasks and activities, including services provided by CERT-EU pursuant to Article 13(3), (4), (5) and (7) and Article 14(1) to Union_entities financed from the heading of the multiannual financial framework dedicated to European public administration, shall be funded by means of a distinct budget line of the Commission budget. The posts earmarked for CERT-EU shall be detailed in a footnote to the Commission establishment plan.

4. Union_entities other than those referred to in paragraph 3 of this Article shall make an annual financial contribution to CERT-EU to cover the services provided by CERT-EU pursuant to that paragraph. The contributions shall be based on orientations given by the IICB and agreed between each Union entity and CERT-EU in service level agreements. The contributions shall represent a fair and proportionate share of the total costs of services provided. They shall be received by the distinct budget line referred to in paragraph 3 of this Article, as internal assigned revenue, as provided for in Article 21(3), point (c), of Regulation (EU, Euratom) 2018/1046.

5. The costs of the services provided for in Article 13(6) shall be recovered from the Union_entities receiving CERT-EU services. The revenues shall be assigned to the budget lines supporting the costs.

Article 19

Information handling

1. Union_entities and CERT-EU shall respect the obligation of professional secrecy in accordance with Article 339 tfeu or equivalent applicable frameworks.

2. Regulation (EC) No 1049/2001 of the European Parliament and of the Council (10) shall apply with regard to requests for public access to documents held by CERT-EU, including the obligation under that Regulation to consult other Union_entities or, where relevant, Member States, whenever a request concerns their documents.

3. The handling of information by Union_entities and CERT-EU shall comply with the applicable rules on information security.

whereas

keyboard_tab Cyber Resilience Act 2023/2841 EN

Cyber Resilience Act 2023/2841 EN