Progress: Procedure completed
Role | Committee | Rapporteur | Shadows |
---|---|---|---|
Lead | IMCO | SCHWAB Andreas ( PPE) | DANTI Nicola ( S&D), FORD Vicky ( ECR), GUOGA Antanas ( ALDE), ALBRECHT Jan Philipp ( Verts/ALE) |
Former Responsible Committee | IMCO | SCHWAB Andreas ( PPE) | |
Former Committee Opinion | ITRE | DEL CASTILLO VERA Pilar ( PPE) | Vicky FORD ( ECR) |
Former Committee Opinion | LIBE | SCHLYTER Carl ( Verts/ALE) | Marie-Christine VERGIAT ( GUE/NGL) |
Former Committee Opinion | ENVI | ||
Former Committee Opinion | BUDG | ||
Former Committee Opinion | JURI | ||
Former Committee Opinion | TRAN | ||
Former Committee Opinion | INTA | ||
Former Committee Opinion | AFET | GOMES Ana ( S&D) | Tunne KELAM ( PPE), Sabine LÖSING ( GUE/NGL), Norica NICOLAI ( ALDE), Indrek TARAND ( Verts/ALE) |
Former Committee Opinion | ECON |
Lead committee dossier:
Legal Basis:
TFEU 114-p1
Legal Basis:
TFEU 114-p1Subjects
Events
PURPOSE: ensure a high common level of security of network and information systems across the Union.
LEGISLATIVE ACT: Directive (EU) 2016/1148 of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union.
CONTENT: the Directive lays down measures with a view to achieving a high common level of security of network and information systems within the Union so as to improve the functioning of the internal market. Network and information systems and services play a vital role in society. Their reliability and security are essential to economic and societal activities, and in particular to the functioning of the internal market.
However, the existing capabilities are not sufficient to ensure a high level of security of network and information systems within the Union. Member States have very different levels of preparedness, which has led to fragmented approaches across the Union.
Obligations with regard to their national cybersecurity capabilities : the Directive requires Members States to:
adopt an national strategy and designate a national authority on security of network and information systems (NIS) with adequate resources to prevent, handle and respond to NIS risks and incidents; establish a network of the national Computer Security Incident Response Teams (CSIRTs) responsible for handling incidents and risks.
Cooperation : in order to support strategic cooperation among Member States, to develop trust and confidence and with a view to achieving a high common level of security of networks and information systems in the Union, the Directive provides for the establishment of a Cooperation Group which will be composed of representatives from the Member States, the Commission and the European Union Agency for Network and Information Security ('ENISA'). This Group will have specific tasks, such as exchanging best practices and information on a number of issues or discussing capabilities and preparedness of Member States.
In order to contribute to developing confidence and trust between the Member States and to promote swift and effective operational cooperation, the Directive establishes a network of the national CSIRTs.
Security and notification requirements: the Directive aims to promote a culture of risk management and encourage the sharing of information between the public and private sectors.
Companies operating in certain critical sectors as well as public administrations must evaluate the risks they run and adopt appropriate and proportionate measures to ensure NIS. These companies must notify competent authorities of all incidents that seriously compromise their networks and information systems and have a significant disruptive effect on the continuity of critical services and supply of goods.
The requirement to notify security incidents affects:
operators of essential services in sectors such as financial services, transport, energy and health; providers of digital services providing three types of services: (i) online market places, (ii) online search engines and (iii) cloud computing services; public administrations which are identified as operators of essential services.
Taking a differentiated approach with regard to the two categories of players, the Directive provides that the security and notification requirements are lighter for digital service providers than for operators of essential services.
ENTRY INTO FORCE: 8.8.2016.
TRANSPOSITION: by 9.5.2018.
APPLICATION: from 10.5.2016.
The European Parliament adopted, at second reading of the ordinary legislative procedure, a legislative resolution on the Council position at first reading with a view to the adoption of a directive of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union.
In line with the recommendation made by the Committee on the Internal Market and Consumer Protection, Parliament adopted the Council position at first reading without amendment .
To recall, the proposed Directive seeks to achieve a high common level of security of networks and information systems within the European Union.
The Committee on the Internal Market and Consumer Protection adopted the recommendation for a second reading contained in the report by Andreas SCHWAB (EPP, DE) on the Council position at first reading with a view to the adoption of a directive of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union.
The committee recommended the European Parliament to adopt the Council position at first reading without amendment.
To recall, the proposal aims to lay down measures with a view to achieving a high common level of security of networks and information systems within the European Union so as to improve the functioning of the internal market.
The Commission supports the results of the inter-institutional negotiations and can therefore accept the Council's position at first reading on the adoption of a Directive of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union.
The Commission noted that overall the Council’s position endorses the core objectives of the Commission proposal , namely to ensure a high common level of security of network and information systems. However, the Council makes a number of changes regarding how to achieve this goal.
National cybersecurity capabilities : under the Council position, Member States will be required to adopt a national NIS strategy setting out the strategic objectives and appropriate policy and regulatory measures for cybersecurity. Member States will also be required to designate a national competent authority for the implementation and enforcement of the Directive, as well as Computer Security Incident Response Teams (CSIRTs) responsible for handling incidents and risks. Although the Council position does not require Member States to adopt a national NIS cooperation plan, as envisaged in the original proposal, the position can be supported as some aspects of the cooperation plan are retained in the provision on the NIS strategy.
Cooperation between Member States : under the Council position, the Directive will: (i) create a ‘Cooperation Group’ to support and facilitate strategic cooperation and the exchange of information between the Member States; (ii) create a network of Computer Security Incident Response Teams, known as the CSIRTs Network, to promote swift and effective operational cooperation on specific cybersecurity incidents and the sharing of information about risks.
Though substantively different from the approach taken in the original proposal, the Council position can be supported as it corresponds overall to the objective of improving cooperation between Member States.
Security and notification requirements for operators of essential services : the Commission noted that the Council did not support an obligation for national competent authorities to notify incidents of a criminal nature to law enforcement authorities.
As per the original proposal, the Council position covers such operators in the energy, transport, banking, financial market infrastructures and health sectors. However, the Council position includes additionally the water and digital infrastructure sectors.
Member States will be required to identify these operators on the basis of certain criteria, such as whether the service is essential for the maintenance of critical societal or economic activities. Although this identification process was not part of the original proposal, it can be accepted given the Member States’ obligation to submit to the Commission the information it needs to assess whether Member States are using consistent approaches to identify operators of essential services.
Security and notification requirements for digital service providers : the Council position covers online marketplaces (equivalent to e-commerce platforms in the original proposal), cloud computing services and search engines.
Compared with the original proposal, the Council position does not include: (i) internet payment gateways – these are now covered by the revised Payment Services Directive; (ii) application stores – these are to be understood as being a type of online marketplace; (iii) social networks – as per the Council’s political agreement with the European Parliament.
The Commission has been granted implementing powers for laying down procedural arrangements necessary for the functioning of the Cooperation Group as well as to specify further certain elements concerning DSPs, including the formats and procedures applicable to DSPs notification requirements.
The Council adopted its position at first reading with a view to the adoption of a Directive of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union.
The proposed Directive lays down measures with a view to achieving a high common level of security of networks and information systems within the European Union so as to improve the functioning of the internal market.
The main elements of the compromise reached with the European Parliament are outlined below:
Obligations with regard to their national cybersecurity capabilities : under the Council position, Member States are required to:
adopt a national strategy defining the strategic objectives and appropriate policy and regulatory measures with a view to achieving and maintaining a high level of security of networks and information system;
designate one or more national competent authorities on the security of network and information systems to monitor the application of the Directive at national level; designate a national single point of contact on the security of networks and information systems that will exercise a liaison function to ensure cross-border cooperation of Member State authorities and with the relevant authorities in other Member States and with the cooperation group and the CSIRTs network. The single point of contact will also submit a yearly report on notifications received to the Cooperation Group; designate one or more Computer Security Incident Response Teams ("CSIRTs ") responsible for handling incidents and risks. The compromise text provides for requirements and tasks of CSIRTs in its Annex I.
Cooperation : in order to support and facilitate strategic cooperation among Member States, to develop trust and confidence and with a view to achieving a high common level of security of networks and information systems in the Union, the Council position:
establishes a Cooperation Group which will be composed of representatives from the Member States, the Commission and the European Union Agency for Network and Information Security ('ENISA') and will have specific tasks listed in the text, such as exchanging best practices and information on a number of issues or discussing capabilities and preparedness of Member States; establishes a network of the national CSIRTs in order to contribute to developing confidence and trust between the Member States and to promote swift and effective operational cooperation. The text provides for a list of tasks to be carried out by the network, such as exchanging information on CSIRTs services, operations and cooperation capabilities, supporting Member States in addressing cross border incidents or, under certain conditions, exchanging and discussing information related to incidents and associated risks.
Security and notification requirements : under the Council position, the Directive shall lay down certain obligations for two sets of market players: (i) operators of essential services and (ii) digital service providers .
The Directive takes a differentiated approach with regard to the two categories of players. The security and notification requirements are lighter for digital service providers than for operators of essential services, which reflects the degree of risk that disruption to their services may pose to society and economy.
Member States should be adequately equipped, in terms of both technical and organisational capabilities , to prevent, detect, respond to and mitigate network and information systems' incidents and risks.
Member States shall ensure that operators of essential services notify, without undue delay, the competent authority or the CSIRT of incidents having a significant impact on the continuity of the essential services they provide.
Essential services (Annex II) of the Directive lists a number of sectors important for society and economy, namely energy, transport, banking, financial market infrastructures, health, drinking water supply and distribution and digital infrastructure. Within these sectors Member States will identify the operators of essential services, based on precise criteria provided for in the Directive.
Digital services (Annex III) of the Directive lists three types of digital services , the providers of which will have to comply with the requirements of the Directive: online market places, online search engines and cloud computing services. All digital service providers providing the listed services will have to comply with the requirements of the Directive with the exclusion of micro and small enterprises.
Entities which have not been identified as operators of essential services and are not digital service providers may notify, on a voluntary basis, incidents having a significant impact on the continuity of the services which they provide.
Transposition : Member States will be required to transpose the Directive by 21 months after the date of its entry into force and will have 6 additional months to identify their operators of essential services.
The Council adopted its position at first reading with a view to the adoption of a Directive of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union.
The proposed Directive lays down measures with a view to achieving a high common level of security of networks and information systems within the European Union so as to improve the functioning of the internal market.
The main elements of the compromise reached with the European Parliament are outlined below:
Obligations with regard to their national cybersecurity capabilities : under the Council position, Member States are required to:
adopt a national strategy defining the strategic objectives and appropriate policy and regulatory measures with a view to achieving and maintaining a high level of security of networks and information system;
designate one or more national competent authorities on the security of network and information systems to monitor the application of the Directive at national level; designate a national single point of contact on the security of networks and information systems that will exercise a liaison function to ensure cross-border cooperation of Member State authorities and with the relevant authorities in other Member States and with the cooperation group and the CSIRTs network. The single point of contact will also submit a yearly report on notifications received to the Cooperation Group; designate one or more Computer Security Incident Response Teams ("CSIRTs ") responsible for handling incidents and risks. The compromise text provides for requirements and tasks of CSIRTs in its Annex I.
Cooperation : in order to support and facilitate strategic cooperation among Member States, to develop trust and confidence and with a view to achieving a high common level of security of networks and information systems in the Union, the Council position:
establishes a Cooperation Group which will be composed of representatives from the Member States, the Commission and the European Union Agency for Network and Information Security ('ENISA') and will have specific tasks listed in the text, such as exchanging best practices and information on a number of issues or discussing capabilities and preparedness of Member States; establishes a network of the national CSIRTs in order to contribute to developing confidence and trust between the Member States and to promote swift and effective operational cooperation. The text provides for a list of tasks to be carried out by the network, such as exchanging information on CSIRTs services, operations and cooperation capabilities, supporting Member States in addressing cross border incidents or, under certain conditions, exchanging and discussing information related to incidents and associated risks.
Security and notification requirements : under the Council position, the Directive shall lay down certain obligations for two sets of market players: (i) operators of essential services and (ii) digital service providers .
The Directive takes a differentiated approach with regard to the two categories of players. The security and notification requirements are lighter for digital service providers than for operators of essential services, which reflects the degree of risk that disruption to their services may pose to society and economy.
Member States should be adequately equipped, in terms of both technical and organisational capabilities , to prevent, detect, respond to and mitigate network and information systems' incidents and risks.
Member States shall ensure that operators of essential services notify, without undue delay, the competent authority or the CSIRT of incidents having a significant impact on the continuity of the essential services they provide.
Essential services (Annex II) of the Directive lists a number of sectors important for society and economy, namely energy, transport, banking, financial market infrastructures, health, drinking water supply and distribution and digital infrastructure. Within these sectors Member States will identify the operators of essential services, based on precise criteria provided for in the Directive.
Digital services (Annex III) of the Directive lists three types of digital services , the providers of which will have to comply with the requirements of the Directive: online market places, online search engines and cloud computing services. All digital service providers providing the listed services will have to comply with the requirements of the Directive with the exclusion of micro and small enterprises.
Entities which have not been identified as operators of essential services and are not digital service providers may notify, on a voluntary basis, incidents having a significant impact on the continuity of the services which they provide.
Transposition : Member States will be required to transpose the Directive by 21 months after the date of its entry into force and will have 6 additional months to identify their operators of essential services.
OPINION OF THE EUROPEAN CENTRAL BANK (ECB) on a proposal for a directive of the European Parliament and of the Council concerning measures to ensure a high common level of network and information security (NIS) across the Union.
The ECB decided to deliver an own initiative opinion on the proposed directive, since it was not formally consulted by the legislators.
The ECB supports the aim of the proposed directive to ensure a high common level of NIS across the Union and to achieve a consistency of approach in this area across business sectors and Member States.
However, the ECB considers that the proposed directive should be without prejudice to the existing regime for the Eurosystem's oversight of payment and settlement systems , which includes appropriate arrangements, inter alia, in the area of NIS. It is for this reason that the ECB suggests amending the proposed directive to properly reflect the Eurosystem's responsibilities in this area.
The ECB notes that the existing oversight arrangements in respect of payment systems and payment service providers (PSPs) already contain procedures for early warnings and coordinated responses within and beyond the Eurosystem to deal with possible cyber-security threats, which are equivalent to those laid down in the proposed directive.
The ESCB has set standards regarding reporting and risk management obligations for payment systems. Furthermore, the ECB regularly assesses securities settlement systems in order to determine their eligibility for use in the Eurosystem credit operations.
Therefore, the ECB considers it necessary that the requirements in the proposed directive affecting critical market infrastructures and their operators do not prejudice the standards in the draft regulation on oversight requirements for systemically important payment systems (SIPS Regulation), the Eurosystem's oversight policy framework or other Union regulations , and in particular the European Market Infrastructure Regulation (EMIR) and the future Regulation on improving securities settlement in the European Union and on central securities depositories (CSDs).
Moreover, they should not interfere with the tasks of the European Banking Authority or the European Securities and Markets Authority and other prudential supervisors.
Notwithstanding the above, the ECB considers that there is a strong case for the Eurosystem to share relevant information with the NIS Committee to be set up pursuant to Article 19 of the proposed directive.
The European Parliament adopted by 521 votes to 22 with 25 abstentions, a legislative resolution on the proposal for a directive of the European Parliament and of the Council concerning measures to ensure a high common level of network and information security (NIS) across the Union.
Parliament’s position in first reading following the ordinary legislative procedure amended the Commission proposal as follows:
Scope: the draft Directive aims at imposing obligations on public administrations and market operators, including critical infrastructures and information society services.
In order to achieve proportionality and swift results of the Directive, Members consider that the compulsory measures laid down in Chapter IV should be limited to infrastructures that are critical in a stricter sense. They took the view that information society services should therefore not be included in the list of market operators in Annex II of the draft directive (such as internet payment gateways, social networks, search engines, cloud computing services).
The Directive should focus on critical infrastructure essential for the maintenance of vital economic and societal activities in the fields of energy, transport, banking, financial market infrastructures and health. Software developers and hardware manufacturers should be excluded from the scope of this Directive.
Protection and processing of personal data : Members stressed that any processing of personal data in the Member States pursuant to this Directive shall be carried out in accordance with Directive 95/46/EC and Directive 2002/58/EC. Any use of personal data should be limited only to what is necessary and should be as anonymous as possible, or even totally anonymous.
National NIS strategies : Parliament proposed that Member States may request the assistance of the European Union Agency for Network and Information Security (ENISA) in developing their national NIS strategies and national NIS cooperation plans, based on a common minimum NIS strategy.
National competent authorities and single points of contact on the security of network and information systems : Members proposed amending the directive to authorise the designation of one or more competent authorities by Member States.
However, in order to ensure a coherent application within the Member State and in order to allow for an effective and streamlined cooperation at Union level, each Member State should appoint one single point of contact . The single point of contact shall ensure, among other things, cross-border cooperation with other single points of contact.
Computer Emergency Response Teams (CERTs) : each Member State shall set up at least one Response Team for each of the sectors established in Annex II, responsible for handling incidents and risks according to a well-defined process.
CERTs should have adequate human and financial resources to actively participate in international, and in particular Union, cooperation networks.
CERTs will be encouraged to initiate and to participate in joint exercises with other CERTs, with all Member States-CERTs, and with appropriate institutions of non-Member States as well as with CERTs of multi- and international institutions such as NATO and the United Nations.
Cooperation network: with the aim of strengthening the activities of the cooperation network, Members consider that the latter should envisage inviting market operators and suppliers of cyber security solutions to participate where appropriate. The cooperation network shall publish a report once a year on the activities of the network.
Member States may determine the level of criticality of market operators , taking into account the specificities of sectors, and different parameters.
The Commission shall adopt, by means of delegated acts, a common set of interconnection and security standards that single points of contact are to meet before exchanging sensitive and confidential information across the cooperation network.
Security requirements and incident notification : the proposal provides that the Commission shall be empowered to adopt delegated acts concerning the definition of circumstances in which public administrations and market operators are required to notify incidents.
For the purpose of clarifying the scope of obligations and enshrining them in the basic act, it is proposed to replace the delegated acts with clear criteria to determine the significance of incidents to be reported. To determine the significance of the impact of an incident, the following parameters shall inter alia be taken into account: i) the number of users whose core service is affected; ii) the duration of the incident; iii) the geographic spread with regard to the area affected by the incident.
After consultation with the notified competent authority and the market operator concerned, the single point of contact may inform the public about individual incidents, where it determines that public awareness is necessary to prevent an incident or deal with an ongoing incident. Member States shall encourage market operators to make public incidents involving their business in their financial reports on a voluntary basis.
Implementation and enforcement : the proposal provides that market operators provide an audit carried out by a qualified independent body or national authority, and make the evidence available to the competent authority. Parliament suggested allowing for flexibility regarding the evidence for compliance with the security requirements imposed on market operators by admitting proof of compliance provided in a form other than security audits.
The single points of contact and the data protection authorities shall develop, in cooperation with ENISA, information exchange mechanisms and a single template to be used both for notifications.
Sanctions : Members proposed clarifying that where the market operator has failed to comply with the obligations in relation to the directive, but has not acted with intent or gross negligence, no sanction should be imposed.
The Committee on the Internal Market and Consumer Protection adopted the report by Andreas SCHWAB (EPP, DE) on the proposal for a directive of the European Parliament and of the Council concerning measures to ensure a high common level of network and information security across the Union.
The Committee on Industry, Research and Energy and the Committee on Civil Liberties, Justice and Home Affairs, exercised the prerogatives of associated committees in line with Article 50 of the Parliament's Rules of Procedure, were also consulted to give an opinion on this report.
The parliamentary committee recommended that the position of the European Parliament adopted at first reading under the ordinary legislative procedure modify the Commission proposal as follows.
Scope : the Directive aims at imposing obligations on public administrations and market operators, including critical infrastructures and information society services.
In order to achieve proportionality and swift results of the Directive, Members consider that the compulsory measures laid down in Chapter IV should be limited to infrastructures that are critical in a stricter sense. They took the view that information society services should therefore not be included in Annex II of this Directive (list of market operators). Instead,
this Directive should focus on critical infrastructure essential for the maintenance of vital economic and societal activities in the fields of energy, transport, banking, financial market infrastructures and health. Software developers and hardware manufacturers should be excluded from the scope of this Directive.
Protection and processing of personal data : Members stressed that any processing of personal data in the Member States pursuant to this Directive shall be carried out in accordance with Directive 95/46/EC and Directive 2002/58/EC. Any use of personal data should be limited only to what is necessary and should be as anonymous as possible, or even totally anonymous.
National competent authorities and single points of contact on the security of network and information systems : Members proposed amending the directive to authorise the designation of one or more competent authorities by Member States.
However, in order to ensure a coherent application within the Member State and in order to allow for an effective and streamlined cooperation at Union level, each Member State should appoint one single point of contact . The single point of contact shall ensure, among other things, cross-border cooperation with other single points of contact.
Computer Emergency Response Teams (CERTs) : each Member State shall set up at least one Response Team for each of the sectors established in Annex II, responsible for handling incidents and risks according to a well-defined process.
CERTs should have adequate human and financial resources to actively participate in international, and in particular Union, cooperation networks.
CERTs shall be enabled and encouraged to initiate and to participate in joint exercises with other CERTs, with all Member States-CERTs, and with appropriate institutions of non-Member States as well as with CERTs of multi- and international institutions such as NATO and the United Nations.
Cooperation network : with the aim of strengthening the activities of the cooperation network, the Members consider that the latter should envisage inviting market operators and suppliers of cyber security solutions to participate where appropriate.
Security requirements and incident notification : the proposal foresees that the Commission shall be empowered to adopt delegated acts concerning the definition of circumstances in which public administrations and market operators are required to notify incidents.
For the purpose of clarifying the scope of obligations and enshrining them in the basic act, it is proposed to replace the delegated acts with clear criteria to determine the significance of incidents to be reported. To determine the significance of the impact of an incident, the following parameters shall inter alia be taken into account: i) the number of users whose core service is affected; ii) the duration of the incident; iii) the geographic spread with regard to the area affected by the incident.
After consultation with the notified competent authority and the market operator concerned, the single point of contact may inform the public about individual incidents, where it determines that public awareness is necessary to prevent an incident or deal with an ongoing incident. Member States shall encourage market operators to make public incidents involving their business in their financial reports on a voluntary basis.
Implementation and enforcement : the proposal foresees that market operators provide an audit carried out by a qualified independent body or national authority, and make the evidence available to the competent authority. For their part Members recognise it is necessary to allow for flexibility regarding the evidence for compliance with the security requirements imposed on market operators by admitting proof of compliance provided in a form other than security audits.
The single points of contact and the data protection authorities shall develop, in cooperation with the European Union Agency for Network and Information Security (ENISA), information exchange mechanisms and a single template to be used both for notifications.
Sanctions : Members proposed clarifying that where the market operator has failed to comply with the obligations in relation to the directive, but has not acted with intent or gross negligence, no sanction should be imposed.
The Council took note of the state of play regarding a draft directive aimed at ensuring a high common level of security of electronic communication networks and information systems across the EU.
Although all delegations fully acknowledge the need for action to combat cyber attacks, views differ on the best way to ensure network security throughout the EU:
some delegations prefer a flexible approach , with EU-wide binding rules limited to critical infrastructure and basic requirements, complemented by voluntary measures; other delegations, as well as the Commission, consider that only legally binding measures would bring about the necessary security at EU level.
As regards more detailed provisions , further discussion is needed on a number of questions, such as:
NIS strategy and NIS competent body : delegations acknowledge that a substantial disruption in one Member State can also affect other Member States and could support the principle of a coordinating entity at national level. However, in particular those Member States, which already adopted NIS strategies, designated competent bodies and set up a national computer emergency response teams (CERT), seem to critically look at chapter II of the proposal, which deals with the national framework on NIS: they wish to make sure that the requirements that will have to be met by Member States are consistent with and do not go beyond the current national practice.
Other delegations seek further clarification about the terminology used in this chapter, such as 'risks' and 'threats' and wonder what the exact requirements are and also question whether these requirements should only concern the private sector or also the public sector.
Competent authority and its task description : many issues require further clarification, such as whether the authority should assume operational tasks, which is something many Member States object to, and what should be the division of responsibilities with the national CERT.
Risk management and incident notification : many delegations:
doubt whether in addition to 'operators of critical infrastructures', also 'information society service providers' should be covered by the proposal; called for more clarity on the definition and for more flexibility for Member States to define which sectors constitute national critical infrastructures. Some delegations wish to limit the proposed requirements to the private sector only and others call for the security breach reporting requirements in this chapter to be voluntary; questioned whether or how Member States could actually "ensure" that parties secure their networks and notify incidents.
There are also concerns with regard to the implications of notifications on matters of privacy and confidentiality of information.
Cooperation network : further discussion will be needed on the tasks of the cooperation network although many delegations are of the opinion that it should not assume any operational tasks; some argue in this respect that it would be better to refer to a mechanism rather than to a network.
A number of organisational issues also require further clarification, such as:
who will chair the cooperation network, what its costs would be, and what the relationship and division of responsibilities would be with the cooperation of national CERTs with ENISA and with Europol; the sharing of information in the network should be done on a voluntary basis; the question of the need for the proposed and dedicated 'secure information-sharing system'; the proposed early warning mechanism raises many queries and concerns, e.g. which information shall be shared at what point in time and with what possible consequences for the incident or risk; the question of the scope of the proposed coordinated response mechanism and when and under what conditions a coordinated response would be required requires further discussion.
According to the Presidency, the main challenge will be to agree on an approach, which strikes the right balance between EU-wide binding rules and optional, voluntary measures , all of which should lead to similar levels of NIS preparedness among the Member States and allow the EU to respond effectively to NIS challenges.
Opinion of the European Data Protection Supervisor on (i) the Joint Communication of the Commission and of the High Representative of the European Union for Foreign Affairs and Security Policy on a ‘Cyber Security Strategy of the European Union: An open, safe and secure cyberspace’, and (ii) on the Commission proposal for a directive concerning measures to ensure a high common level of network and information security across the Union.
The EDPS welcomes the comprehensive Cyber Security Strategy and that the Strategy goes beyond the traditional approach of opposing security to privacy by providing for the explicit recognition of privacy and data protection as core values.
However, the EDPS notes that due to the lack of consideration and taking full account of other parallel Commission initiatives and ongoing legislative procedures, such as the data protection reform and the proposed regulation on electronic identification and trust services, the Cyber Security Strategy fails to provide a really comprehensive and holistic view of cyber security in the EU and risks to perpetuate a fragmented and compartmentalised approach.
The EDPS formulates the following recommendations:
The Cyber Security Strategy:
· it would be advisable to have a clear and restrictive definition of ‘cybercrime’ rather than an overreaching one;
· data protection law should apply to all actions of the Strategy whenever they concern measures that entail the processing of personal data; he also notes that many actions consist in the setting up of coordination mechanisms;
· as guardians of the privacy and data protection rights of individuals, data protection authorities (DPAs) should be appropriately involved in their capacity of supervisory bodies with respect to implementing measures that involve the processing of personal data (such as the launch of the EU pilot project on fighting botnets and malware).
Proposed directive on network and information security (NIS):
· provide more clarity and certainty on the definition of the market operators that fall within the scope of the proposal, and to set up an exhaustive list that includes all relevant stakeholders, with a view to ensuring a fully harmonised and integrated approach to security within the EU;
· explicitly provide that the directive should apply without prejudice to existing or future more detailed rules in specific areas (such as those to be set forth upon trust service providers in the proposed regulation on electronic identification),
· add a recital to explain the need to embed data protection by design and by default from the early stage of the design of the mechanisms established in the proposal;
· specify that the processing of personal data would be justified under insofar as it is necessary to meet the objectives of public interest pursued by the proposed directive;
· lay down the circumstances when a notification is required and whether or not, and to which extent, the notification and its supporting documents will include details of personal data affected by a specific security incident (such as IP addresses);
· ensure that the exclusion of microenterprises from the scope of the notification does not apply to those operators that play a crucial role in the provision of information society services, for instance in view of the nature of the information they process (e.g. biometric data or sensitive data);
· add provisions in the proposal governing the further exchange of personal data by NIS competent authorities with other recipients, to ensure that (i) personal data are only disclosed to recipients whose processing is necessary for the performance of their tasks;
· specify the time limit for the retention of personal data;
· remind NIS competent authorities of their duty to provide appropriate information to data subjects on the processing of personal data, for example by posting a privacy policy on their website;
· add a provision regarding the level of security to be complied with by NIS competent authorities as regards the information collected, processed, and exchanged;
· clarify that the criteria for the participation of Member States in the secure information-sharing system should ensure that a high level of security and resilience is guaranteed by all the participants in the information-sharing systems at all steps of the processing;
· add a description of the roles and responsibilities of the Commission and of the Member States in the setup, operation and maintenance of the secure information-sharing system;
· add that any transfer of personal data to recipients located in countries outside the EU should take place in accordance with Directive 95/46/EC and Regulation (EC) No 45/2001.
The Council discussed the proposal for a Directive aimed at ensuring a high common level of security of electronic communication networks and information systems across the EU. The discussion was based on a progress report by the Irish Presidency on the work done so far in the Council's preparatory bodies.
The Presidency has identified the following main issues, which it believes are matters delegations would like to discuss further:
Impact assessment (IA): with regard to the IA which accompanies the proposal, a number of Member States pointed out that there appears to be a number of discrepancies between the two documents and that, in particular, the IA does not sufficiently justify why specific sectors have been included in the proposal , such as enablers of information society services, and others not, such as hardware/software manufacturers. Member States were also looking for more substance in the IA with regard to the impact of the proposal on employment, competitiveness and innovation, data protection, operations of multinational companies, investment climate, etc. Most Member States also raised the issue of the perceived significant costs involved in the implementation of the proposed Directive and regretted that the IA fails to sufficiently assess the possible benefits.
At a more fundamental level, Member States requested further justification from the Commission why a legislative, rather than a voluntary approach, would be the preferred option to tackle the uneven level of security capabilities across the EU and the insufficient sharing of information on incidents, risks and threats, which the Commission perceives as being the root causes of the situation. Delegations asked for more information about which companies and other stakeholders had replied to which questions in the Commission's public consultation, as this would help them to better assess where urgent problems exist .
Scope: detailed discussions will be necessary on which "market operators" would fall within the scope of the proposed Directive. In this regard, doubts were expressed about putting providers of information society services under the same obligations as operators of critical infrastructures and questions were raised with the proposed non exhaustive list of market operators, which would need to be agreed upon and which would cover those entities to which obligations with regard to incidents' notifications would apply.
Organisational framework: with regard to the organisational framework for the implementation of the proposed Directive, delegations have not yet expressed firm positions on the proposed governance structure as they are carrying out national consultations with stakeholders and are analysing the details of the proposal in the context of existing or planned national cyber strategies.
PURPOSE: ensure a high common level of network and information security (NIS) across the Union.
PROPOSED ACT: Directive of the European Parliament and of the Council.
PARLIAMENT’S ROLE: Parliament decides in accordance with the ordinary legislative procedure and on an equal footing with the Council.
BACKGROUND: network and information systems and services play a vital role in in facilitating the cross-border movement of goods, services and people. Substantial disruption of these systems in one Member State can affect other Member States and the EU as a whole.
The resilience and stability of network and information systems is therefore essential to the smooth functioning of the internal market.
The extent and frequency of security incidents, caused by human error or malicious attacks is increasing : the Commission’s public consultation found that 57 % of respondents had experienced NIS incidents over the previous year that had a serious impact on their activities. A 2012 Eurobarometer survey found that 38% of EU internet users are concerned about the safety of online payments.
There is currently no effective mechanism at EU level for effective cooperation and collaboration and for secure information sharing on NIS incidents and risks among the Member States.
However, the Digital Agenda for Europe and the related Council conclusions highlighted the shared understanding that trust and security are fundamental pre-conditions for the wide uptake of information and communication technologies (ICT).
This proposal is presented in connection with the joint Communication of the Commission and High Representative of the Union for Foreign Affairs and Security Policy on a European Cybersecurity Strategy.
IMPACT ASSESSMENT: the Commission analysed three different options.
· Option 1 : status quo : maintain the current approach.
· Option 2: regulatory approach , consisting of a legislative proposal establishing a common EU legal framework for NIS regarding Member State capabilities, mechanisms for EU-level cooperation, and requirements for key private players and public administrations.
· Option 3: mixed approach , combining voluntary initiatives for Member State NIS capabilities and mechanisms for EU-level cooperation with regulatory requirements for key private players and public administrations.
The Commission concluded that Option 2 would have the strongest positive impacts. The quantitative assessment showed that this option would not impose a disproportionate burden on Member States. The costs for the private sector would also be limited since many of the entities concerned are already supposed to comply with existing security requirements.
LEGAL BASIS: Article 114 of the Treaty on the Functioning of the European Union (TFEU).
CONTENT: the proposal aims to effect a fundamental change in the way NIS is dealt with in the EU. It provides for regulatory obligations to create a level playing field and close existing legislative loopholes. The objectives of the proposed Directive are as follows:
(1) To require all Member States to have in place a minimum level of national capabilities by establishing competent authorities for NIS, setting up Computer Emergency Response Teams (CERTs), and adopting national NIS strategies and national NIS cooperation plans .
(2) To ensure that the national competent authorities cooperate within a network enabling secure and effective coordination, including coordinated information exchange as well as detection and response at EU level. Through this network, Member States will exchange information and cooperate, through the European Network and Information Security Agency (ENISA) to counter NIS threats and incidents and facilitate a uniform application of the directive throughout the EU.
(3) To ensure that a culture of risk management develops and that information is shared between the private and public sectors. Companies in the specific critical sectors – banking, stock exchanges, energy generation, transmission and distribution, transport (air, rail, maritime), health, internet services as well as public administrations will be required to:
· assess the risks they face and adopt appropriate and proportionate measures to ensure NIS;
· report to the competent authorities any incidents seriously compromising their networks and information systems and significantly affecting the continuity of critical services and supply of goods.
BUDGETARY IMPLICATIONS: cooperation and exchange of information between Member States should be supported by a secure infrastructure . The proposal will have EU budgetary implications only if Member States choose to adapt an existing infrastructure (e.g. sTESTA) and task the Commission to implement this under the Multiannual Financial Framework 2014-2020. The one-off cost is estimated to be EUR 1 250 000 on condition that sufficient funds are available under the Connecting Europe Facility (CEF) .
Alternatively, Member States can either share the one-off cost of adapting an existing infrastructure or decide to set up a new infrastructure and bear the costs, which are estimated to be approximately EUR 10 million per year .
DELEGATED ACTS: the proposal contains provisions empowering the Commission to adopt delegated acts in accordance with Article 290 of the Treaty on the Functioning of the EU.
PURPOSE: ensure a high common level of network and information security (NIS) across the Union.
PROPOSED ACT: Directive of the European Parliament and of the Council.
PARLIAMENT’S ROLE: Parliament decides in accordance with the ordinary legislative procedure and on an equal footing with the Council.
BACKGROUND: network and information systems and services play a vital role in in facilitating the cross-border movement of goods, services and people. Substantial disruption of these systems in one Member State can affect other Member States and the EU as a whole.
The resilience and stability of network and information systems is therefore essential to the smooth functioning of the internal market.
The extent and frequency of security incidents, caused by human error or malicious attacks is increasing : the Commission’s public consultation found that 57 % of respondents had experienced NIS incidents over the previous year that had a serious impact on their activities. A 2012 Eurobarometer survey found that 38% of EU internet users are concerned about the safety of online payments.
There is currently no effective mechanism at EU level for effective cooperation and collaboration and for secure information sharing on NIS incidents and risks among the Member States.
However, the Digital Agenda for Europe and the related Council conclusions highlighted the shared understanding that trust and security are fundamental pre-conditions for the wide uptake of information and communication technologies (ICT).
This proposal is presented in connection with the joint Communication of the Commission and High Representative of the Union for Foreign Affairs and Security Policy on a European Cybersecurity Strategy.
IMPACT ASSESSMENT: the Commission analysed three different options.
· Option 1 : status quo : maintain the current approach.
· Option 2: regulatory approach , consisting of a legislative proposal establishing a common EU legal framework for NIS regarding Member State capabilities, mechanisms for EU-level cooperation, and requirements for key private players and public administrations.
· Option 3: mixed approach , combining voluntary initiatives for Member State NIS capabilities and mechanisms for EU-level cooperation with regulatory requirements for key private players and public administrations.
The Commission concluded that Option 2 would have the strongest positive impacts. The quantitative assessment showed that this option would not impose a disproportionate burden on Member States. The costs for the private sector would also be limited since many of the entities concerned are already supposed to comply with existing security requirements.
LEGAL BASIS: Article 114 of the Treaty on the Functioning of the European Union (TFEU).
CONTENT: the proposal aims to effect a fundamental change in the way NIS is dealt with in the EU. It provides for regulatory obligations to create a level playing field and close existing legislative loopholes. The objectives of the proposed Directive are as follows:
(1) To require all Member States to have in place a minimum level of national capabilities by establishing competent authorities for NIS, setting up Computer Emergency Response Teams (CERTs), and adopting national NIS strategies and national NIS cooperation plans .
(2) To ensure that the national competent authorities cooperate within a network enabling secure and effective coordination, including coordinated information exchange as well as detection and response at EU level. Through this network, Member States will exchange information and cooperate, through the European Network and Information Security Agency (ENISA) to counter NIS threats and incidents and facilitate a uniform application of the directive throughout the EU.
(3) To ensure that a culture of risk management develops and that information is shared between the private and public sectors. Companies in the specific critical sectors – banking, stock exchanges, energy generation, transmission and distribution, transport (air, rail, maritime), health, internet services as well as public administrations will be required to:
· assess the risks they face and adopt appropriate and proportionate measures to ensure NIS;
· report to the competent authorities any incidents seriously compromising their networks and information systems and significantly affecting the continuity of critical services and supply of goods.
BUDGETARY IMPLICATIONS: cooperation and exchange of information between Member States should be supported by a secure infrastructure . The proposal will have EU budgetary implications only if Member States choose to adapt an existing infrastructure (e.g. sTESTA) and task the Commission to implement this under the Multiannual Financial Framework 2014-2020. The one-off cost is estimated to be EUR 1 250 000 on condition that sufficient funds are available under the Connecting Europe Facility (CEF) .
Alternatively, Member States can either share the one-off cost of adapting an existing infrastructure or decide to set up a new infrastructure and bear the costs, which are estimated to be approximately EUR 10 million per year .
DELEGATED ACTS: the proposal contains provisions empowering the Commission to adopt delegated acts in accordance with Article 290 of the Treaty on the Functioning of the EU.
Documents
- Follow-up document: COM(2019)0546
- Follow-up document: EUR-Lex
- Committee letter confirming interinstitutional agreement: PE612.045
- Text agreed during interinstitutional negotiations: PE612.044
- Final act published in Official Journal: Directive 2016/1148
- Final act published in Official Journal: OJ L 194 19.07.2016, p. 0001
- Draft final act: 00026/2016/LEX
- Decision by Parliament, 2nd reading: T8-0303/2016
- Debate in Parliament: Debate in Parliament
- Committee recommendation tabled for plenary, 2nd reading: A8-0211/2016
- Committee draft report: PE584.110
- Commission communication on Council's position: COM(2016)0363
- Commission communication on Council's position: EUR-Lex
- Council position: 05581/1/2016
- Council position published: 05581/1/2016
- Council statement on its position: 08300/2016
- Approval in committee of the text agreed at 2nd reading interinstitutional negotiations: PE612.044
- Approval in committee of the text agreed at 2nd reading interinstitutional negotiations: PE612.045
- European Central Bank: opinion, guideline, report: CON/2014/0058
- European Central Bank: opinion, guideline, report: OJ C 352 07.10.2014, p. 0004
- Commission response to text adopted in plenary: SP(2014)455
- Debate in Council: 3318
- Results of vote in Parliament: Results of vote in Parliament
- Decision by Parliament, 1st reading: T7-0244/2014
- Debate in Parliament: Debate in Parliament
- Committee report tabled for plenary, 1st reading: A7-0103/2014
- Committee opinion: PE514.755
- Committee opinion: PE519.596
- Committee opinion: PE516.830
- Debate in Council: 3278
- Amendments tabled in committee: PE519.685
- Committee draft report: PE514.882
- Document attached to the procedure: N7-0072/2014
- Document attached to the procedure: OJ C 032 04.02.2014, p. 0019
- Debate in Council: 3243
- Contribution: COM(2013)0048
- Economic and Social Committee: opinion, report: CES1414/2013
- Contribution: COM(2013)0048
- Contribution: COM(2013)0048
- Contribution: COM(2013)0048
- Contribution: COM(2013)0048
- Legislative proposal: EUR-Lex
- Legislative proposal: COM(2013)0048
- Document attached to the procedure: EUR-Lex
- Document attached to the procedure: SWD(2013)0031
- Document attached to the procedure: EUR-Lex
- Document attached to the procedure: SWD(2013)0032
- Legislative proposal published: COM(2013)0048
- Legislative proposal published: EUR-Lex
- Legislative proposal: EUR-Lex COM(2013)0048
- Document attached to the procedure: EUR-Lex SWD(2013)0031
- Document attached to the procedure: EUR-Lex SWD(2013)0032
- Economic and Social Committee: opinion, report: CES1414/2013
- Document attached to the procedure: N7-0072/2014 OJ C 032 04.02.2014, p. 0019
- Committee draft report: PE514.882
- Amendments tabled in committee: PE519.685
- Committee opinion: PE516.830
- Committee opinion: PE519.596
- Committee opinion: PE514.755
- Commission response to text adopted in plenary: SP(2014)455
- European Central Bank: opinion, guideline, report: CON/2014/0058 OJ C 352 07.10.2014, p. 0004
- Council statement on its position: 08300/2016
- Council position: 05581/1/2016
- Commission communication on Council's position: COM(2016)0363 EUR-Lex
- Committee draft report: PE584.110
- Draft final act: 00026/2016/LEX
- Committee letter confirming interinstitutional agreement: PE612.045
- Text agreed during interinstitutional negotiations: PE612.044
- Follow-up document: COM(2019)0546 EUR-Lex
- Contribution: COM(2013)0048
- Contribution: COM(2013)0048
- Contribution: COM(2013)0048
- Contribution: COM(2013)0048
- Contribution: COM(2013)0048
Activities
- Ulrike LUNACEK
Plenary Speeches (3)
- 2016/11/22 High common level of security of network and information systems across the Union (debate) DE
- 2016/11/22 High common level of security of network and information systems across the Union (debate) DE
- 2016/11/22 High common level of security of network and information systems across the Union (debate) DE
- Vicky FORD
Plenary Speeches (2)
- Antanas GUOGA
- Ivan JAKOVČIĆ
- Notis MARIAS
- Norica NICOLAI
- Dubravka ŠUICA
- Oldřich VLASÁK
Plenary Speeches (2)
- Louis ALIOT
Plenary Speeches (1)
- Marina ALBIOL GUZMÁN
Plenary Speeches (1)
- Marie-Christine ARNAUTU
Plenary Speeches (1)
- Jonathan ARNOTT
Plenary Speeches (1)
- Erik BÁNKI
Plenary Speeches (1)
- Zigmantas BALČYTIS
Plenary Speeches (1)
- Beatriz BECERRA BASTERRECHEA
Plenary Speeches (1)
- Hugues BAYET
Plenary Speeches (1)
- Xabier BENITO ZILUAGA
Plenary Speeches (1)
- José BLANCO LÓPEZ
Plenary Speeches (1)
- Michał BONI
Plenary Speeches (1)
- Alain CADEC
Plenary Speeches (1)
- Nicola CAPUTO
Plenary Speeches (1)
- Salvatore CICU
Plenary Speeches (1)
- Alberto CIRIO
Plenary Speeches (1)
- Birgit COLLIN-LANGEN
Plenary Speeches (1)
- Therese COMODINI CACHIA
Plenary Speeches (1)
- Javier COUSO PERMUY
Plenary Speeches (1)
- Edward CZESAK
Plenary Speeches (1)
- Daniel DALTON
Plenary Speeches (1)
- Michel DANTIN
Plenary Speeches (1)
- Rachida DATI
Plenary Speeches (1)
- Isabella DE MONTE
Plenary Speeches (1)
- Gérard DEPREZ
Plenary Speeches (1)
- Mireille D'ORNANO
Plenary Speeches (1)
- Christian ENGSTRÖM
Plenary Speeches (1)
- Georgios EPITIDEIOS
Plenary Speeches (1)
- Vicente Miguel GARCÉS RAMÓN
Plenary Speeches (1)
- Doru-Claudian FRUNZULICĂ
Plenary Speeches (1)
- Ildikó GÁLL-PELCZ
Plenary Speeches (1)
- Elisabetta GARDINI
Plenary Speeches (1)
- Enrico GASBARRA
Plenary Speeches (1)
- Ana GOMES
Plenary Speeches (1)
- Tania GONZÁLEZ PEÑAS
Plenary Speeches (1)
- Ágnes HANKISS
Plenary Speeches (1)
- Takis HADJIGEORGIOU
Plenary Speeches (1)
- Malcolm HARBOUR
Plenary Speeches (1)
- Brian HAYES
Plenary Speeches (1)
- Marian HARKIN
Plenary Speeches (1)
- Marc JOULAUD
Plenary Speeches (1)
- Ivailo KALFIN
Plenary Speeches (1)
- Krišjānis KARIŅŠ
Plenary Speeches (1)
- Philippe JUVIN
Plenary Speeches (1)
- Barbara KAPPEL
Plenary Speeches (1)
- Tunne KELAM
Plenary Speeches (1)
- Afzal KHAN
Plenary Speeches (1)
- Giovanni LA VIA
Plenary Speeches (1)
- Paloma LÓPEZ BERMEJO
Plenary Speeches (1)
- Monica MACOVEI
Plenary Speeches (1)
- Louis-Joseph MANSCOUR
Plenary Speeches (1)
- Vladimír MAŇKA
Plenary Speeches (1)
- Ivana MALETIĆ
Plenary Speeches (1)
- Andrejs MAMIKINS
Plenary Speeches (1)
- Jiří MAŠTÁLKA
Plenary Speeches (1)
- Dominique MARTIN
Plenary Speeches (1)
- Barbara MATERA
Plenary Speeches (1)
- Jean-Luc MÉLENCHON
Plenary Speeches (1)
- Miroslav MIKOLÁŠIK
Plenary Speeches (1)
- Louis MICHEL
Plenary Speeches (1)
- Marlene MIZZI
Plenary Speeches (1)
- József NAGY
Plenary Speeches (1)
- Liadh NÍ RIADA
Plenary Speeches (1)
- Franz OBERMAYR
Plenary Speeches (1)
- Rolandas PAKSAS
Plenary Speeches (1)
- Alojz PETERLE
Plenary Speeches (1)
- Florian PHILIPPOT
Plenary Speeches (1)
- Marijana PETIR
Plenary Speeches (1)
- Franck PROUST
Plenary Speeches (1)
- Robert ROCHEFORT
Plenary Speeches (1)
- Liliana RODRIGUES
Plenary Speeches (1)
- Claude ROLIN
Plenary Speeches (1)
- Virginie ROZIÈRE
Plenary Speeches (1)
- Fernando RUAS
Plenary Speeches (1)
- Tokia SAÏFI
Plenary Speeches (1)
- Lola SÁNCHEZ CALDENTEY
Plenary Speeches (1)
- Carl SCHLYTER
Plenary Speeches (1)
- Olga SEHNALOVÁ
Plenary Speeches (1)
- Ricardo SERRÃO SANTOS
Plenary Speeches (1)
- Remo SERNAGIOTTO
Plenary Speeches (1)
- Maria Lidia SENRA RODRÍGUEZ
Plenary Speeches (1)
- Siôn SIMON
Plenary Speeches (1)
- Branislav ŠKRIPEK
Plenary Speeches (1)
- Monika SMOLKOVÁ
Plenary Speeches (1)
- Igor ŠOLTES
Plenary Speeches (1)
- Jaromír ŠTĚTINA
Plenary Speeches (1)
- Beatrix von STORCH
Plenary Speeches (1)
- Patricija ŠULIN
Plenary Speeches (1)
- Eleftherios SYNADINOS
Plenary Speeches (1)
- Tibor SZANYI
Plenary Speeches (1)
- Claudia ȚAPARDEL
Plenary Speeches (1)
- Pavel TELIČKA
Plenary Speeches (1)
- Silvia-Adriana ȚICĂU
Plenary Speeches (1)
- Mihai ŢURCANU
Plenary Speeches (1)
- Mylène TROSZCZYNSKI
Plenary Speeches (1)
- Kazimierz Michał UJAZDOWSKI
Plenary Speeches (1)
- Ramon TREMOSA i BALCELLS
Plenary Speeches (1)
- Ángela VALLINA
Plenary Speeches (1)
- Miguel VIEGAS
Plenary Speeches (1)
- Pablo ZALBA BIDEGAIN
Plenary Speeches (1)
- Anna ZÁBORSKÁ
Plenary Speeches (1)
Votes
A7-0103/2014 - Andreas Schwab - Am 141 #
A7-0103/2014 - Andreas Schwab - Am 142 #
A7-0103/2014 - Andreas Schwab - Résolution législative #
Amendments | Dossier |
510 |
2013/0027(COD)
2013/09/30
AFET
20 amendments...
Amendment 21 #
Proposal for a directive Recital 2 a (new) (2a) A large number of cyber incidents occur due to lack of resilience and robustness of private and public network infrastructure, poorly protected or secured databases and other flaws in the critical information infrastructure; whereas only few Member States consider the protection of their network and information systems and associated data as part of their respective duty of care which explains the lack of investment in state-of-the art security technology, training and the development of appropriate guidelines.
Amendment 22 #
Proposal for a directive Recital 3 a (new) (3a) Raising awareness and educating users of information and communication technologies on best practises on the securing personal data as well as sustainable maintenance of communication services should constitute the basis of any comprehensive cyber security strategy.
Amendment 23 #
Proposal for a directive Recital 4 a (new) (4a) Member States shall commit sufficient resources to domestic counter- radicalisation and counter-terrorism as it extends quickly to critical infrastructure protection; they shall commit for closer cooperation between the EU and NATO in counter-terrorism policy. HR/VP and EU Counter-terrorism Coordinator shall be actively engaged in discussions with NATO.
Amendment 24 #
Proposal for a directive Recital 8 a (new) (8a) Security measures have to respect and fundamental rights incumbent upon the EU and its Member States in accordance with articles 2, 6 and 21 TFEU, such as the freedom of expression, data protection and privacy; whereas the rights to privacy and data protection are laid down in the EU Charter and Article 16 TFEU.
Amendment 25 #
Proposal for a directive Recital 11 a (new) (11a) All Member States shall focus national cyber security strategies on the protection of information systems and associated data and shall consider the protection this critical infrastructure as part of their respective duty of care. All Member States shall adopt and implement strategies, guidelines and instruments that provide reasonable levels of protection against reasonably identifiable levels of threats, with costs and burdens of the protection proportionate to the probable damage to the parties concerned. Also all Member States shall take appropriate steps to oblige legal persons under their jurisdictions to protect personal data under their care.
Amendment 26 #
Proposal for a directive Recital 16 (16) To ensure transparency and properly inform EU citizens and market operators, the competent authorities should set up a common website to publish non confidential information on the incidents and risks. Any personal data published on this website should be limited to only what is necessary and as anonymous as possible.
Amendment 27 #
Proposal for a directive Recital 30 a (new) (30a) This Directive is without prejudice to the Union acquis relating to data protection. Any personal data used according to the provisions of this Directive should be kept to the minimum set of personal data strictly necessary and only transmitted to the actors strictly necessary, and as be as anonymous as possible, if not completely anonymous.
Amendment 28 #
Proposal for a directive Recital 32 a (new) (32a) Adopting at EU level general data protection legislation should precede the adoption of cyber security legislation at EU level. Therefore, the NIS directive should be adopted only after the General Data Protection Regulation has been adopted.
Amendment 29 #
Proposal for a directive Recital 34 a (new) (34a) There is need to regulate on EU level the sale, supply, transfer or export to third countries of equipment or software intended primarily for monitoring or interception of the Internet and of telephone communications on mobile or fixed networks and the provision of assistance to install, operate or update such equipment or software. As soon as possible the Commission must prepare legislation which prevents European companies from exporting such dual-use items to non-democratic, authoritarian and repressive regimes.
Amendment 30 #
Proposal for a directive Article 3 – paragraph 2 a (new) a) "cyber resilience" means the ability of a network and information system to resist and recover to full operational capacity after incidents, including but not limited to; technical malfunction, power failure or security incidents;
Amendment 31 #
Proposal for a directive Article 5 – paragraph 1 – point a (a) The
Amendment 32 #
Proposal for a directive Article 6 – paragraph 1 1. Each Member State shall designate a civil national competent authority on the security of network and information systems (the
Amendment 33 #
Proposal for a directive Article 7 – paragraph 1 1. Each Member State shall set up at least one Computer Emergency Response Team (hereinafter: ‘CERT’) responsible for handling incidents and risks according to a well-defined process, which shall comply with the requirements set out in point (1) of Annex I. A CERT may be established within the competent authority.
Amendment 34 #
Proposal for a directive Article 9 – paragraph 1 a (new) 1a. Personal data shall be only disclosed to recipients who need to process these data for the performance of their tasks in accordance with an appropriate legal basis. The disclosed data shall be limited to what is necessary for the performance of their tasks. Compliance with the purpose limitation principle shall be ensured. The time limit for the retention of these data shall be specified for the purposes set out in this Directive.
Amendment 35 #
Proposal for a directive Article 10 – paragraph 2 2. In the early warnings, the competent authorities and the Commission shall communicate any relevant information in their possession that may be useful for assessing the risk or incident, in accordance with the provisions of the General Data Protection Regulation.
Amendment 36 #
Proposal for a directive Article 10 – paragraph 3 3. At the request of a Member State, or on its own initiative, the Commission may request a Member State to provide any relevant information on a specific risk or incident, in accordance with the provisions of the General Data Protection Regulation.
Amendment 37 #
Proposal for a directive Article 10 – paragraph 4 4. Where the risk or incident subject to an early warning is of a suspected criminal nature, the competent authorities or the
Amendment 38 #
Proposal for a directive Article 14 – paragraph 2 a (new) 2a. Software producers shall be responsible for correcting security breaches, within 24 hours of being informed for serious cases, and 72 hours for cases were the effects are unlikely to result in any significant financial loss or serious breach of privacy.
Amendment 39 #
Proposal for a directive Article 14 – paragraph 2 b (new) 2b. Commercial software producers shall not be protected from "no-liability" clauses when it can be demonstrated that their products are not properly designed to handle foreseeable security threats.
Amendment 40 #
Proposal for a directive Annex 1 – paragraph 1 – point b (b) The CERT shall implement and manage security measures to ensure the confidentiality, integrity, availability and authenticity of information it receives and treats, complying with data protection requirements.
source: PE-519.524
2013/10/02
IMCO
127 amendments...
Amendment 106 #
Proposal for a directive Citation 4 a (new) having regard to the European Parliament resolution of 12 September 2013 on a Cybersecurity Strategy of the European Union: An Open, Safe and Secure Cyberspace’,
Amendment 107 #
Proposal for a directive Recital -1 (new) (-1) In today’s world, information and communication technologies (ICTs) should address the needs of society, including the needs of persons at risk of social exclusion. All ICT users should be able to depend on minimum standards guaranteeing ICT reliability, security, transparency, simplicity, interoperability and risk reduction.
Amendment 108 #
Proposal for a directive Recital 2 (2) The magnitude and frequency of deliberate or accidental security incidents is increasing drastically and represents a major threat to the functioning of networks and information systems. Such incidents can impede the pursuit of economic activities, generate substantial financial losses, undermine user confidence and impinge on their private lives, result in a violation of the fundamental rights and freedoms of EU citizens and cause major damage to the economy of the Union.
Amendment 109 #
Proposal for a directive Recital 3 (3) As a communication instrument without frontiers, digital information systems, and primarily the Internet play an essential role in facilitating the cross- border movement of goods, services
Amendment 110 #
Proposal for a directive Recital 3 a (new) (3a) Since the more common causes of system failure, such as natural causes or human error, continue to be unintentional, infrastructure should be resilient both to intentional and unintentional disruptions, and operators of critical infrastructure should design resilience based systems that remain operational even when other systems beyond their control fail.
Amendment 111 #
Proposal for a directive Recital 3 a (new) (3a) NIS in the EU should provide a secure and reliable digital environment, ensure net neutrality and guarantee the universal right to access technologies and all related services. Cybersecurity should be regulated in such a way that no discretionality can be applied.
Amendment 112 #
Proposal for a directive Recital 5 (5) To cover all relevant incidents and risks, this Directive should apply to all network and information systems.
Amendment 113 #
Proposal for a directive Recital 5 a (new) (5a) Several Member States are yet to publish their national cybersecurity strategies, and are still to draw up their contingency plans for cyber incidents. At the same time, some Member States have not established a computer emergency and response team (CERT) or ratified the Council of Europe’s Convention on Cybercrime.
Amendment 114 #
Proposal for a directive Recital 6 (6) The existing capabilities are not sufficient enough to ensure a high level of NIS within the Union. Member States have very different levels of preparedness leading to fragmented approaches across the Union. This leads to an unequal level of protection of consumers and businesses, and undermines the overall level of NIS within the Union. Lack of common minimum requirements on public administrations and market operators in turn makes it impossible to set up a global and effective mechanism for cooperation at Union level. There is a need effectively to spur R&D&i in these areas and provide it with adequate funding. Universities and research centres have a decisive role to play in this regard.
Amendment 115 #
Proposal for a directive Recital 8 (8) The provisions of this Directive should be without prejudice to the possibility for each Member State to take the necessary measures to ensure the protection of its essential security interests, to safeguard public policy and public security, and to permit the investigation, detection and prosecution of criminal offences. In accordance with Article 346 TFEU, no
Amendment 116 #
Proposal for a directive Recital 10 a (new) (10 a) In view of the differences in national governance structures and in order to safeguard already existing sectoral arrangements or Union supervisory and regulatory bodies, and to avoid duplication, Member States should be able to designate more than one national competent authority in charge of fulfilling the tasks linked to the security of the networks and information systems of market operators under this Directive. However, in order to ensure smooth cross- border cooperation and communication, it is necessary that each Member State, without prejudice to sectoral regulatory arrangements, designate only one national single point of contact in charge of cross-border cooperation at Union level. Where its constitutional structure or other arrangements so require, a Member State should be able to designate only one authority to carry out the tasks of the competent authority and the single point of contact.
Amendment 117 #
Proposal for a directive Recital 13 a (new) (13a) Where possible, Member States may use or adapt existing organisational structures when applying the provisions of this Directive. An inventory and assessment should be made of existing plans and processes by Member States when elaborating the national NIS strategies.
Amendment 118 #
Proposal for a directive Recital 14 (14) A secure information-sharing infrastructure should be put in place to allow for the exchange of sensitive and confidential information within the cooperation network. The Secure Trans European Services for Telematics between Administrations (STESTA) could be used for this purpose. Without prejudice to their obligation to notify incidents and risks of Union dimension to the cooperation network, access to confidential information from other Member States should only be granted to Members States upon demonstration that their technical, financial and human resources and processes, as well as their communication infrastructure, guarantee their effective, efficient and secure participation in the network.
Amendment 119 #
Proposal for a directive Recital 14 (14) A secure information-sharing infrastructure should be put in place to allow for the exchange of sensitive and confidential information within the cooperation network. Without prejudice to their obligation to notify incidents and risks of Union dimension to the cooperation network, access to confidential information from other Member States should only be granted to Members States upon demonstration that their technical,
Amendment 120 #
Proposal for a directive Recital 16 (16) To ensure transparency and properly inform EU citizens and market operators, the competent authorities should set up a common website to publish non confidential information on the incidents and risks. Any personal data published on this website should be limited to only what is necessary and as anonymous as possible.
Amendment 121 #
Proposal for a directive Recital 16 (16) To ensure transparency and properly inform EU citizens and market operators, the competent authorities should
Amendment 122 #
Proposal for a directive Recital 16 a (new) (16a) Special consideration should be given, as regards these environments, to the most vulnerable members of society, such as people on the wrong side of the digital divide and minorities with social network exposure. Special efforts should also be made to increase public awareness and education. Member States shall ensure that SMEs are able to further their understanding in the field NIS and bolster their capacities in the field of cybersecurity.
Amendment 123 #
Proposal for a directive Recital 18 a (new) (18a) In order to facilitate cooperation between the Member States and the Commission in their cross-border endeavours to prevent, detect and respond to network and data security incidents, ENISA must devise and operate at European level an early warning and response mechanism to function alongside the mechanisms being used by the Member States;
Amendment 124 #
Proposal for a directive Recital 21 (21) Given the global nature of NIS problems, there is a need for closer international cooperation to improve security standards and information exchange, and promote a common global approach to NIS issues. Any framework for such international cooperation should be subject to the provisions of Directive 95/46/EC and Regulation (EC) No 45/2001.
Amendment 125 #
Proposal for a directive Recital 27 (27) To avoid imposing a disproportionate financial and administrative burden on small operators and users, the requirements should be proportionate to the risk presented by the network or information system concerned, taking into account the state of the art of such measures. These requirements should not apply to micro enterprises, which should be able to call on a suitable financial support mechanism to enable them to meet the requirements specified.
Amendment 126 #
Proposal for a directive Recital 28 (28) Competent authorities should pay due attention to preserving informal and trusted channels of information-sharing between market operators and between the public and the private sectors. Publicity of incidents reported to the competent authorities should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the public administrations and market operators reporting incidents. In the implementation of the notification obligations, competent authorities should pay particular attention to the need to maintain information about product vulnerabilities strictly confidential prior to the release of appropriate security fixes. Under no circumstances must the fundamental rights to information and communication inherent to the rule of law be limited or nullified.
Amendment 127 #
Proposal for a directive Recital 29 (29) Competent authorities should have the necessary means to perform their duties, including powers to obtain sufficient information from market operators and public administrations in order to assess the level of security of network and information systems as well as reliable and comprehensive data about actual incidents that have had an impact on the operation of network and information systems. The competent authorities should be able to hold liable the suppliers of defective computer programs or hardware or services that lead directly to an NIS incident.
Amendment 128 #
Proposal for a directive Recital 29 (29
Amendment 129 #
Proposal for a directive Recital 30 (30) Criminal activities are in many cases underlying an incident. The criminal nature of incidents can be suspected even if the evidence to support it may not be sufficiently clear from the start. In this context, appropriate co-operation between competent authorities, the single points of contact, ENISA and law enforcement authorities
Amendment 130 #
Proposal for a directive Recital 30 a (new) (30a) This Directive is without prejudice to the Union acquis relating to data protection. Any personal data used according to the provisions of this Directive should be limited to what is strictly necessary and only transmitted to the actors strictly necessary, and be as anonymous as possible, if not completely anonymous.
Amendment 131 #
Proposal for a directive Recital 30 b (new) (30b) Adopting at EU level general data protection legislation should precede the adoption of cybersecurity legislation at EU level. Therefore, this Directive should be adopted only after the General Data Protection Regulation has been adopted.
Amendment 132 #
Proposal for a directive Recital 31 (31) Personal data are in many cases compromised as a result of incidents. In this context, competent authorities
Amendment 133 #
Proposal for a directive Recital 34 (34) In order to allow for the proper functioning of the cooperation network, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission in respect
Amendment 134 #
Proposal for a directive Recital 36 (36) In order to ensure uniform conditions for the implementation of this Directive, implementing powers should be conferred on the Commission as regards the cooperation between
Amendment 135 #
Proposal for a directive Recital 37 (37) In the application of this Directive, the Commission should liaise as appropriate with relevant sectoral committees and relevant bodies set up at EU level in particular in the field of energy, transport, health and the
Amendment 136 #
Proposal for a directive Recital 40 a (new) (40a) The combating of cybercrime should be flanked with the combating of international espionage, which undermines the sovereignty of the EU and its Member States. This Directive should protect the public, enterprises, public and private institutions and states and their governments from common crime, organised crime and espionage, including cybercrime.
Amendment 137 #
Proposal for a directive Recital 41 (41) This Directive
Amendment 138 #
Proposal for a directive Article 1 – paragraph 1 1. This Directive lays down measures to ensure a high common level of network and information security (hereinafter referred to as "NIS") within the Union, providing a secure and reliable digital environment, ensure net neutrality and guarantee the universal right to access technologies and all related services.
Amendment 139 #
Proposal for a directive Article 1 – paragraph 2 – point c c) establishes security requirements for market operators and public administrations which ensure that no discretionality can be applied.
Amendment 140 #
Proposal for a directive Article 1 – paragraph 2 – point c (c) establishes security requirements for market operators
Amendment 141 #
Proposal for a directive Article 1 – paragraph 3 Amendment 142 #
Proposal for a directive Article 1 – paragraph 5 5. This Directive shall also be without prejudice to Directive 95/46/CE of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data
Amendment 143 #
Proposal for a directive Article 1 – paragraph 6 6. The sharing of information within the cooperation network under Chapter III and the notifications of NIS incidents under Article 14 may require the processing of personal data. Such processing, which is necessary to meet the objectives of public interest pursued by this Directive, shall be authorised by the Member State pursuant to Article 7 of Directive 95/46/EC and Directive 2002/58/EC, as implemented in national law. Member States shall ensure that market operators and competent authorities are not held liable for using personal data which is required for the sharing of information within the cooperation network.
Amendment 144 #
Proposal for a directive Article 2 Member States shall
Amendment 145 #
Proposal for a directive Article 3 – point 2 a (new) (2a) "cyber resilience" means the ability of a network and information system to resist and recover to full operational capacity after incidents, including but not limited to, technical malfunction, power failure or security incidents;
Amendment 146 #
Proposal for a directive Article 3 – point 3 (3) ‘risk’ means any reasonably identifiable circumstance or event having a potential adverse effect on security;
Amendment 147 #
Proposal for a directive Article 3 – point 5 Amendment 148 #
Proposal for a directive Article 3 – point 8 – point a Amendment 149 #
Proposal for a directive Article 3 – point 8 – point b (b) operator of critical infrastructure that are essential for the maintenance of
Amendment 150 #
Proposal for a directive Article 3 – point 8 – point b (b) operator of critical infrastructure that are essential for the maintenance of vital economic and societal activities in the fields of energy, transport, banking, stock exchanges and health, a non exhaustive list of which is set out in Annex II
Amendment 151 #
Proposal for a directive Article 3 – paragraph 1 a (new) 1a. A "microenterprise" as defined in Article 2(3) of Commission Recommendation 2003/361/EC of 6 May 20031 concerning the definition of micro, small and medium-sized enterprises, is not a "market operator" within the scope of this definition, unless it functions as subsidiary for an operator of critical infrastructure as defined within the meaning of point (b) of the first paragraph of this point. _____________ 1 OJ L 124, 20.5.2003, p. 36.
Amendment 152 #
Proposal for a directive Article 4 Amendment 153 #
Proposal for a directive Article 4 Member States shall ensure a high level of security of the network and information systems in their territories in accordance with this Directive. The combating of cybercrime shall be flanked with the combating of international espionage aimed at undermining the sovereignty of the EU and its Member States.
Amendment 154 #
Proposal for a directive Article 5 – paragraph 1 – point e e) Research and development plans and a description of how these plans reflect the identified priorities, and in which universities and research centres shall have a decisive role.
Amendment 155 #
Proposal for a directive Article 5 – paragraph 1 – point e a (new) ea) Quality programmes drawn up with the utmost diligence and the measures needed to implement and extend this Directive. All applications must be built using reusable code and, insofar as this is possible, using open source software.
Amendment 156 #
Proposal for a directive Article 5 – paragraph 2 – point a (a) A risk
Amendment 157 #
Proposal for a directive Article 5 – paragraph 2 – point a (a) A risk assessment plan to identify risks and assess the impacts of potential
Amendment 158 #
Proposal for a directive Article 5 – paragraph 2 – point d a (new) da) Publication of an online directory of all the entities meeting the risk management and information requirements under the Directive, in a way that does not limit the right to information of any citizen of any Member State and which requires that a transparency plan be drawn up on NIS management and procedures.
Amendment 159 #
Proposal for a directive Article 5 – paragraph 2 – point d a (new) (da) improve the storage and use of passwords, like increasing the use of hash function or password management utilities.
Amendment 160 #
Proposal for a directive Article 5 – paragraph 2 – point d b (new) db) (16a) Special consideration of the most vulnerable members of society, such as people on the wrong side of the digital divide and minorities with social network exposure.
Amendment 161 #
Proposal for a directive Article 5 – paragraph 3 3. The national NIS strategy and the national NIS cooperation plan shall be communicated to the Commission within
Amendment 162 #
Proposal for a directive Article 6 – paragraph 1 1. Each Member State shall designate
Amendment 163 #
Proposal for a directive Article 6 – paragraph 2 2. The competent authorities shall monitor the application of this Directive at national level and contribute to its consistent application throughout the Union. They shall also monitor the application of NIS measures within their spheres of responsibility.
Amendment 164 #
Proposal for a directive Article 6 – paragraph 2 a (new) 2a. Where a Member State designates more than one competent authority, it shall designate a civilian national authority, for instance a competent authority, as national single point of contact on the security of network and information systems (hereinafter referred to as "single point of contact"). Where a Member State designates only one competent authority, that competent authority shall also be the single point of contact.
Amendment 165 #
Proposal for a directive Article 6 – paragraph 4 4. Member States shall ensure that the competent authorities and single points of contact, where applicable according to paragraph 2a of this Article, receive the notifications of incidents from
Amendment 166 #
Proposal for a directive Article 6 – paragraph 4 a (new) 4a. Where Union legislation provides for a sector-specific Union supervisory or regulatory body, inter alia on the security of network and information systems, this body shall receive the notifications of incidents according to Article 14(2) from the market operators concerned in this sector and be granted the implementation and enforcement powers referred to under Article 15. This Union body shall cooperate closely with the competent authorities and the single point of contact of the host Member State with regard to these obligations. The single point of contact of the host Member State shall represent the Union body with regard to the obligations of Chapter III.
Amendment 167 #
Proposal for a directive Article 8 – paragraph 1 1. The
Amendment 168 #
Proposal for a directive Article 8 – paragraph 2 2. The cooperation network shall bring into permanent communication the Commission and the
Amendment 169 #
Proposal for a directive Article 8 – paragraph 3 – point c c) publish on a regular basis non- confidential information on on-going early warnings and coordinated response on
Amendment 170 #
Proposal for a directive Article 8 – paragraph 3 – point d (d) jointly discuss and assess
Amendment 171 #
Proposal for a directive Article 8 – paragraph 3 – point e (e) jointly discuss and assess
Amendment 172 #
Proposal for a directive Article 8 – paragraph 3 – point f (f) cooperate and exchange
Amendment 173 #
Proposal for a directive Article 8 – paragraph 3 – point h Amendment 174 #
Proposal for a directive Article 8 – paragraph 3 – point i a (new) (ia) develop, in cooperation with ENISA, guidelines for sector-specific criteria for the notification of significant incidents, in addition to the parameters laid down in Article 14(2).
Amendment 175 #
Proposal for a directive Article 8 – paragraph 3 a (new) 3a. Competent authorities shall consult the public administrations and market operators concerned before any exchange, within the cooperation network, of sensitive and confidential information regarding the risks and incidents affecting their network and information systems.
Amendment 176 #
Proposal for a directive Article 8 – paragraph 4 4. The Commission shall establish, by means of implementing acts, the necessary modalities to facilitate the cooperation between competent authorities and the Commission referred to in paragraphs 2 and 3. Those implementing acts shall be adopted in accordance with the
Amendment 177 #
Proposal for a directive Article 9 – paragraph 1 a (new) 1a. Personal data shall be only disclosed to recipients who need to process these data for the performance of their tasks in accordance with an appropriate legal basis. The disclosed data shall be limited to what is necessary for the performance of their tasks. Compliance with the purpose limitation principle shall be ensured. The time limit for the retention of these data shall be specified for the purposes set out in this Directive.
Amendment 178 #
Proposal for a directive Article 9 – paragraph 1 b (new) 1b. the criteria for the participation of Member States in the secure information sharing system to ensure that a high level of security and resilience is guaranteed by all participants at all steps of the processing, including by appropriate confidentiality and security measures in accordance with Articles 16 and 17 of Directive 95/46/EC and Articles 21 and 22 of Regulation (EC) No 45/2001.
Amendment 179 #
Proposal for a directive Article 9 – paragraph 2 Amendment 180 #
Proposal for a directive Article 9 – paragraph 2 – introductory part 2. The Commission shall be empowered to
Amendment 181 #
Proposal for a directive Article 9 – paragraph 3 3. The Commission shall adopt, by means of implementing acts,
Amendment 182 #
Proposal for a directive Article 10 – paragraph 1 – introductory part 1. The
Amendment 183 #
Proposal for a directive Article 10 – paragraph 1 – point a Amendment 184 #
Proposal for a directive Article 10 – paragraph 1 – point b (b) the
Amendment 185 #
Proposal for a directive Article 10 – paragraph 1 – point c (c) the
Amendment 186 #
Proposal for a directive Article 10 – paragraph 1 a (new) 1a. Members of the cooperation network shall only make public the information received on the risks or incidents once they have received approval from the notifying national competent authority.
Amendment 187 #
Proposal for a directive Article 10 – paragraph 2 – subparagraph 1a (new) ENISA shall, in cooperation with the Commission devise and operate at European level an early warning and response mechanism to function alongside the mechanisms being used by the Member States;
Amendment 188 #
Proposal for a directive Article 10 – paragraph 3 Amendment 189 #
Proposal for a directive Article 10 – paragraph 4 4. Where the risk or incident subject to an early warning is of a suspected serious criminal nature
Amendment 190 #
Proposal for a directive Article 10 – paragraph 4 a (new) 4a. Members of the cooperation network shall not make public any information received on risks and incidents according to paragraph 1 without having received the prior approval of the notifying single point of contact.
Amendment 191 #
Proposal for a directive Article 10 – paragraph 4 a (new) 4a. Members of the cooperation network, as well as the Commission, shall not make public any information received relating to risks or incidents according to paragraph 1, without having received the prior approval of the notifying single point of contact; furthermore, prior to sharing information in the cooperation network, the notifying single point of contact shall inform the market operator to which the information relates of its intention, and where it considers this appropriate, it shall make the information concerned anonymous.
Amendment 192 #
Proposal for a directive Article 11 – paragraph 2 a (new) 2a. Sufficient redundancy shall be built into a coordinated response plan
Amendment 193 #
Proposal for a directive Article 12 – title Amendment 194 #
Proposal for a directive Article 12 – paragraph 3 a (new) 3a. The Union NIS cooperation plan shall be designed to be coherent with national NIS strategies and cooperation plans as provided by Article 5 of this Directive, including where appropriate, the inventory referred to in Recital 13a.
Amendment 195 #
Proposal for a directive Article 13 Without prejudice to the possibility for the
Amendment 196 #
Proposal for a directive Article 13 Without prejudice to the possibility for the cooperation network to have informal international cooperation, the Union may conclude international agreements with third countries or international organisations allowing and organizing their participation in some activities of the cooperation network. Such agreement shall take into account the need to ensure adequate protection of the personal data circulating on the cooperation network. Such agreements should also safeguard EU sovereignty and the independence of the EU’s institutions and Member States.
Amendment 197 #
Proposal for a directive Article 13 a (new) Article 13a Level of criticality of market operators Member States may determine the level of criticality of market operators, taking into account the specificities of sectors, parameters including the importance of the particular market operator for maintaining a sufficient level of the sectoral service, the number of parties supplied by the market operator, and the time period until the discontinuity of the core services of the market operator has a negative impact on the maintenance of vital economic and societal activities.
Amendment 198 #
Proposal for a directive Chapter 4 – title SECURITY OF THE NETWORKS AND INFORMATION SYSTEMS OF
Amendment 199 #
Proposal for a directive Article 14 – paragraph 1 1. Member States shall ensure that public administrations and market operators take appropriate technical and organisational measures to manage the risks posed to the security of the networks and information systems which they control and use in their operations.
Amendment 200 #
Proposal for a directive Article 14 – paragraph 1 1. Member States shall ensure that
Amendment 201 #
Proposal for a directive Article 14 – paragraph 2 – subparagraph 1 a (new) Amendment 202 #
Proposal for a directive Article 14 – paragraph 2 – subparagraph 1 a (new) Those parameters shall be further specified in accordance with point (ib) of Article 8(3).
Amendment 203 #
Proposal for a directive Article 14 – paragraph 2 a (new) 2a. Software producers shall be responsible for correcting security breaches, within 24 hours of being informed for serious cases, and 72 hours for cases were the effects are unlikely to result in any significant financial loss or serious breach of privacy.
Amendment 204 #
Proposal for a directive Article 14 – paragraph 2 a (new) 2a. To evaluate whether an incident has a significant impact on the security of the core services public administrations and market operators provide, the following criteria shall especially be taken into account: (a) the number of users dependent on this core service that are affected by the incident; (b) the intensity of the damage caused to those users; (c) the duration of the incident; (d) the economic and social impact of the incident; (e) the impact on users' personal data, if concerned.
Amendment 205 #
Proposal for a directive Article 14 – paragraph 2 b (new) 2b. Commercial software producers shall not be protected from "no-liability" clauses when it can be demonstrated that their products are not properly designed to handle foreseeable security threats.
Amendment 206 #
Proposal for a directive Article 14 – paragraph 2 c (new) 2c. The supervisory body concerned shall also inform the public or require the trust service provider to do so. Notification and publication shall normally occur without undue delay; however the trust service provider may request a delay in notification and publication so that vulnerabilities can be fixed. If the supervisory body grants such a delay, it shall not exceed 45 days and the responsible entity shall agree to indemnify all relying parties, wherever in the world they are located, against losses directly arising from the delay in notification.
Amendment 207 #
Proposal for a directive Article 14 – paragraph 4 4. The competent authority may inform the public, or require the public administrations and market operators to do so, where it determines that disclosure of the incident is in the public interest. Once a year, the competent authority shall submit a summary report to the cooperation network on the notifications received and the action taken in accordance with this paragraph. In the case of incidents notified to the cooperation network referred to in Article 8, other national competent authorities shall only make public any information received on risks or incidents once they have been approved by the notifying national competent authority.
Amendment 208 #
Proposal for a directive Article 14 – paragraph 4 4. The competent authority may inform the public, or require the public administrations and market operators to do so, where it determines that disclosure of the incident is in the public interest. Once a year, the competent authority shall submit a summary report to the cooperation network on the notifications received and the action taken in accordance with this paragraph. That annual report should contain, as a minimum, both the number of alerts issued and a breakdown of these by type. It shall be made available to the public in a compatible format enabling its publication on any open data portal wishing to publish it.
Amendment 209 #
Proposal for a directive Article 14 – paragraph 4 4.
Amendment 210 #
Proposal for a directive Article 14 – paragraph 4 a (new) 4a. The competent authority shall ensure that any information provided to it through incident reporting obligations is made anonymous wherever such information is transmitted to third parties.
Amendment 211 #
Proposal for a directive Article 14 – paragraph 4 a (new) 4a. Member States shall provide the Commission and the cooperation network annually with a list of those public administrations and operators, which do not indicate incidents accurately. This list may be made publically available.
Amendment 212 #
Proposal for a directive Article 14 – paragraph 6 a (new) 6a. The competent authorities or the single points of contact shall define a plan which clearly states the purpose of incident reporting, how reported information will be used, and the formats and procedures required for implementing the provisions of paragraph 2, in particular regarding the confidentiality and anonymity of information.
Amendment 213 #
Proposal for a directive Article 14 – paragraph 8 a (new) 8a. Member States may decide to apply this Article and Article 15 to public administrations mutatis mutandis.
Amendment 214 #
Proposal for a directive Article 15 – paragraph 1 a (new) 1a. Member States shall ensure that the competent authorities have the power to evaluate the accuracy of the evidence and reporting by public administrations or market operators.
Amendment 215 #
Proposal for a directive Article 15 – paragraph 2 – point b (b)
Amendment 216 #
Proposal for a directive Article 15 – paragraph 2 – point b a (new) (ba) Member States are encouraged to reduce the number and intensity of audits for this market operator or public administration if its security audit indicates good results in a consistent manner.
Amendment 217 #
Proposal for a directive Article 15 – paragraph 3 a (new) 3a. Member States shall ensure that the competent authorities undergo an annual security audit. The results of these audits shall be made public.
Amendment 218 #
Proposal for a directive Article 15 – paragraph 3 a (new) 3a. By way of derogation from point (b) of paragraph 2 of this Article, Member States may decide that the competent authorities or the single points of contact, as applicable, are to apply a different procedure to particular market operators, based on their level of criticality determined in accordance with Article 13a. In the event that Member States so decide: (a) competent authorities or the single points of contact, as applicable, shall have the power to submit a sufficiently specific request to market operators requiring them to provide evidence of effective implementation of security policies, such as the results of a security audit carried out by a qualified internal auditor, and make the evidence available to the competent authority or to the single point of contact; (b) where necessary, following the submission by the market operator of the request referred to in point (a), the competent authority or the single point of contact may require additional evidence or an additional audit to be carried out by a qualified independent body or national authority.
Amendment 219 #
Proposal for a directive Article 15 – paragraph 4 4. The competent authorities
Amendment 220 #
Proposal for a directive Article 15 – paragraph 5 5. The competent authorities and the single points of contact shall work in close cooperation with
Amendment 221 #
Proposal for a directive Article 15 – paragraph 5 5. The competent authorities and single points of contact shall work in close cooperation with personal data protection authorities when addressing incidents resulting in personal data breaches. The single points of contact and personal data protection authorities shall cooperate through ENISA to develop information exchange mechanisms and a single model for notifications under Article 14(2) of this Directive and under Regulation (xxx) of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data.
Amendment 222 #
Proposal for a directive Article 15 – paragraph 6 a (new) 6a. Member States may decide to apply Article 14 and this Article to public administrations mutatis mutandis.
Amendment 223 #
Proposal for a directive Article 16 – paragraph 1 1. To ensure convergent implementation of Article 14(1), Member States shall encourage the use of international or European standards and/or specifications relevant to networks and information security. Market operators shall remain free to use additional measures to achieve a higher level of security.
Amendment 224 #
Proposal for a directive Article 16 – paragraph 1 1. To ensure convergent implementation of Article 14(1), Member States shall encourage the use of open standards and/or specifications relevant to networks and information security.
Amendment 225 #
Proposal for a directive Article 17 – paragraph 1 a (new) 1a. Member States shall ensure that the penalties referred to in paragraph 1 of this Article only apply where the market operator has failed to fulfil its obligations under Chapter IV with intent or as a result of gross negligence.
Amendment 226 #
Proposal for a directive Article 17 – paragraph 2 a (new) 2a. The competent authorities shall hold liable the suppliers of defective computer programs or hardware or services that lead directly to an NIS incident.
Amendment 227 #
Proposal for a directive Article 18 – paragraph 2 2. The power to adopt delegated acts referred to in Article
Amendment 228 #
Proposal for a directive Annex 2 – paragraph 1 – point 6 a (new) 6a. Multiplatform messaging services.
Amendment 230 #
Proposal for a directive Annex 2 – paragraph 1 – point 2 – indent 1 a (new) (d) Maritime transport (i) Maritime carriers (inland, sea and coastal passenger water transport companies and inland, sea and coastal freight water transport companies) (ii) Ports (iii) Traffic management control operators (iv) Auxiliary logistics services: - warehousing and storage, - cargo handling, and - other transportation support activities
Amendment 232 #
Proposal for a directive Annex 2 – paragraph 1 – point 5 5. Health sector: health care settings (including hospitals and private clinics) and other entities involved in health care provisions, with the exception of private healthcare practices and pharmacies with an annual turnover of less than €2 million.
source: PE-519.685
2013/11/19
ITRE
235 amendments...
Amendment 128 #
Proposal for a directive Recital 1 (1) Network and information systems and services play a vital role in the society. Their reliability and security are essential to the freedom and overall security for the citizens of the EU as well as to economic activities and social welfare, and in particular to the functioning of the internal market.
Amendment 129 #
Proposal for a directive Recital 2 (2) The magnitude and frequency of
Amendment 130 #
Proposal for a directive Recital 2 (2) The magnitude and frequency of deliberate or accidental security incidents is increasing and represents a major threat to the functioning of networks and information systems. Such incidents can impede the pursuit of economic activities, generate substantial financial losses, undermine user and investor confidence and cause major damage to the economy of the Union.
Amendment 131 #
Proposal for a directive Recital 2 (2) The magnitude
Amendment 132 #
Proposal for a directive Recital 3 (3) As a communication instrument without traditional frontiers, digital information systems, and primarily the Internet play an essential role in facilitating the cross-
Amendment 133 #
Proposal for a directive Recital 4 (4) A cooperation mechanism should be established at Union level to allow for information exchange and coordinated detection and response regarding network and information security (‘NIS’). For that mechanism to be effective and inclusive, it is essential that all Member States have minimum capabilities and a strategy ensuring a high level of NIS in their territory. Minimum security requirements should also apply to public administrations and operators of critical information infrastructure to promote a culture of risk management and ensure that the most serious incidents are reported. The legal framework must be based upon the need to safeguard the privacy and integrity of citizens
Amendment 134 #
Proposal for a directive Recital 4 (4) A cooperation mechanism should be established at Union level to allow for information exchange and coordinated detection and response regarding network and information security (‘NIS’). For that mechanism to be effective and inclusive, it is essential that all Member States have minimum capabilities and a strategy ensuring a high level of NIS in their territory. Minimum security requirements should also apply to public administrations and public and private operators of critical information infrastructure to promote a culture of risk management and ensure that the most
Amendment 135 #
Proposal for a directive Recital 4 (4) A cooperation mechanism should be established at Union level to allow for information exchange and coordinated prevention, detection and response regarding network and information security (‘NIS’). For that mechanism to be effective and inclusive, it is essential that all Member States have minimum capabilities and a strategy ensuring a high level of NIS in their territory. Minimum security requirements should also apply to public administrations and operators of critical information infrastructure to promote a culture of risk management and ensure that the most serious incidents are reported.
Amendment 136 #
Proposal for a directive Recital 4 (4) A cooperation mechanism should be established at Union level to allow for information exchange and coordinated
Amendment 137 #
Proposal for a directive Recital 4 (4) A cooperation mechanism should be established at Union level to allow for information exchange and coordinated detection and response regarding network and information security (‘NIS’). For that mechanism to be effective and inclusive, it is essential that all Member States have minimum capabilities and a strategy ensuring a high level of NIS in their territory. Minimum security requirements should also apply to public administrations and market operators
Amendment 138 #
Proposal for a directive Recital 4 a (new) (4a) To secure that governments do not exceed or misuse their powers, it is of vital importance that information and security systems of public authorities are transparent, legitimate, well-defined and adopted in a transparent manner through a democratic process.
Amendment 139 #
Proposal for a directive Recital 5 (5) To cover all relevant incidents and risks, this Directive should apply to all network and information systems.
Amendment 140 #
Proposal for a directive Recital 5 (5) To cover all relevant incidents and risks, this Directive should apply to
Amendment 141 #
Proposal for a directive Recital 5 (5) T
Amendment 142 #
Proposal for a directive Recital 5 (5) To cover all relevant incidents and risks, this Directive should apply to all network and information systems. The obligations on public administrations and market operators should however not apply to undertakings providing public communication networks or publicly available electronic communication services within the meaning of Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (Framework Directive)25 , which are subject to the specific security and integrity requirements laid down in Article 13a of that Directive
Amendment 143 #
Proposal for a directive Recital 6 (6) The existing capabilities are not sufficient enough to ensure a high level of NIS within the Union. Member States have very different levels of preparedness leading to fragmented approaches across
Amendment 144 #
Proposal for a directive Recital 7 (7) Responding effectively to the challenges of the security of network and information systems therefore requires a global approach at Union level covering common minimum capacity building and planning requirements, exchange of information and coordination of actions, and common minimum security requirements for all market operators
Amendment 145 #
Proposal for a directive Recital 7 (7) Responding effectively to the challenges of the security of network and information systems therefore requires a global approach at Union level covering common minimum capacity building and planning requirements, developing sufficient cybersecurity skills, exchange of information and coordination of actions, and common minimum security requirements for all market operators concerned and public administrations.
Amendment 146 #
Proposal for a directive Recital 7 (7) Responding effectively to the challenges of the security of network and information systems therefore requires a global approach at Union level covering common minimum capacity building and planning requirements, exchange of information and coordination of actions, and common minimum security requirements
Amendment 147 #
Proposal for a directive Recital 7 (7) Responding effectively to the challenges of the security of network and information systems therefore requires a global approach at Union level covering common minimum capacity building and planning requirements, exchange of information and coordination of actions, and common minimum security requirements for all market operators concerned and public administrations. Minimal common standards should be applied in accordance with appropriate recommendations by the Cyber Security Co-Ordination Groups (CSGC).
Amendment 148 #
Proposal for a directive Recital 8 Amendment 149 #
Proposal for a directive Recital 9 (9) To achieve and maintain a common high level of security of network and information systems, each Member State should have a national NIS strategy defining the strategic objectives and concrete policy actions to be implemented. NIS cooperation plans complying with essential requirements need to be developed at national level in order to reach capacity response levels allowing for effective and efficient cooperation at national and Union level in case of incidents. Member States may ask for the assistance of the European Network and Information Security Agency ('ENISA') in developing their national NIS strategies, based on a common minimum NIS strategy blueprint.
Amendment 150 #
Proposal for a directive Recital 9 (9) To achieve and maintain a common high level of security of network and information systems, each Member State should have a national NIS strategy defining the strategic objectives and concrete policy actions to be implemented. NIS cooperation plans complying with essential requirements need to be developed at national level in order to reach capacity response levels allowing for effective and efficient cooperation at national and Union level in case of incidents. Each Member State should therefore be obliged to meet common standards regarding data format and the exchangeability of data to be shared and evaluated.
Amendment 151 #
Proposal for a directive Recital 9 (9) To achieve and maintain a common high level of security of network and information systems, each Member State should have a national NIS strategy defining the strategic objectives and concrete policy actions to be implemented. NIS cooperation plans complying with essential requirements need to be developed at national level, on the basis of minimum requirements set in this Directive, in order to reach capacity response levels allowing for
Amendment 152 #
Proposal for a directive Recital 10 (10) To allow for the effective implementation of the provisions adopted pursuant to this Directive, a body responsible for coordinating NIS issues and acting as a single focal point for both internal coordination and cross-border cooperation at Union level should be established or identified in each Member State. These single national points of contact should be designated without prejudice for each Member State to designate more than one national competent authority in charge of network information security, according to their constitutional, jurisdictional or administrative requirements, but should nonetheless be assigned with a coordinating mandate at national and Union level. These bodies should be given the adequate technical, financial and human resources to ensure that they can carry out in a
Amendment 153 #
Proposal for a directive Recital 10 (10) To allow for the effective implementation of the provisions adopted pursuant to this Directive, a civilian body responsible for coordinating NIS issues and acting as a focal point for cross-border cooperation at Union level should be established or identified in each Member State in the form of an Industrial Control System Computer Emergency Response Team (ICS-CERT). These bodies should be given the adequate technical, financial and human resources to ensure that they can carry out in an effective and efficient manner the tasks assigned to them and thus achieve the objectives of this Directive.
Amendment 154 #
Proposal for a directive Recital 11 (11) All Member States should be adequately equipped, both in terms of technical and organisational capabilities, to prevent, detect, respond to and mitigate network and information systems' incidents and risks. Well-functioning Computer Emergency Response Teams complying with essential requirements and continuous (24/7) mitigation and response capabilities should therefore be established in all Member States to guarantee effective and compatible capabilities to deal with incidents and risks and ensure efficient
Amendment 155 #
Proposal for a directive Recital 11 (11) All Member States and market operators should be adequately equipped
Amendment 156 #
Proposal for a directive Recital 11 (11) All Member States should be adequately equipped, both in terms of technical and organisational capabilities, to prevent, detect, respond to and mitigate network and information systems' incidents and risks. Well-functioning Computer Emergency Response Teams complying with essential requirements should therefore be established in all Member States to guarantee effective and compatible capabilities to deal with incidents and risks and ensure efficient cooperation at Union level. Security systems of public administrations must be safe and subject to democratic control and scrutiny.
Amendment 157 #
Proposal for a directive Recital 11 (11) All Member States should be adequately equipped, both in terms of technical and organisational capabilities, to
Amendment 158 #
Proposal for a directive Recital 12 (12) Building upon the significant progress within the European Forum of Member States (‘EFMS’) in fostering discussions and exchanges on good policy practices including the development of principles for European
Amendment 159 #
Proposal for a directive Recital 12 (12) Building upon the significant progress within the European Forum of Member States (‘EFMS’) in fostering discussions and exchanges on good policy practices including the development of principles for European cyber crisis cooperation, the Member States and the Commission should form a network, under the coordination of ENISA, to bring them into permanent communication and support their cooperation. This secure and effective cooperation mechanism should enable structured and coordinated information exchange, detection and response at Union level.
Amendment 160 #
Proposal for a directive Recital 13 (13) The European Network and Information Security Agency (‘ENISA’) should assist the Member States and the Commission by providing its expertise and advice and by facilitating exchange of best practices. In particular, in the application of this Directive, the Commission and Member States should consult ENISA. To ensure effective and timely information to the Member States and the Commission, early warnings on incidents and risks should be notified within the cooperation network. To build capacity and knowledge among Member States, the cooperation network should also serve as an instrument for the exchange of best practices, assisting its members in building capacity, steering the organisation
Amendment 161 #
Proposal for a directive Recital 13 (13) The European Network and Information Security Agency (‘ENISA’) should assist the Member States and the Commission by providing its expertise and advice and by facilitating exchange of best practices. In particular, in the application of this Directive, the Commission should consult ENISA. To ensure effective and timely information to the Member States and the Commission, early warnings on incidents and risks should be notified within the cooperation network. To build capacity and knowledge among Member States, the cooperation network should also serve as an instrument for the exchange of best practices, assisting its members in building capacity, steering the organisation of peer reviews and NIS exercises.
Amendment 162 #
Proposal for a directive Recital 14 Amendment 163 #
Proposal for a directive Recital 14 (14) A secure information-sharing infrastructure should be put in place to allow for the exchange of sensitive and confidential information within the cooperation network
Amendment 164 #
Proposal for a directive Recital 14 (14) A secure information-sharing infrastructure should be put in place, under the supervision of ENISA, to allow for the exchange of sensitive and confidential information within the cooperation network. Without prejudice to their obligation to notify incidents and risks of Union dimension to the cooperation network, access to confidential information from other Member States should only be granted to Members States upon demonstration that their technical, financial and human resources and processes, as well as their communication infrastructure, guarantee their effective, efficient and secure participation in the network.
Amendment 165 #
Proposal for a directive Recital 15 (15) As most network and information systems are privately operated, cooperation between the public and private sector is essential. Market operators should be encouraged to pursue their own informal cooperation mechanisms to ensure NIS. They should also cooperate with the public sector and mutually share information and best practices
Amendment 166 #
Proposal for a directive Recital 15 (15) As most network and information systems are privately operated, cooperation between the public and private sector is essential. Market operators should be encouraged to pursue their own informal cooperation mechanisms to ensure NIS. They should also cooperate with the public sector and share information and best practices in exchange of operational support and relevant information in case of incidents.
Amendment 167 #
Proposal for a directive Recital 15 (15) As most network and information systems are privately operated, cooperation between the public and private sector is essential. Market operators should be encouraged to pursue their own informal cooperation mechanisms to ensure NIS. They should also cooperate with the public sector and share information and best practices in exchange of operational support and information in case of incidents.
Amendment 168 #
Proposal for a directive Recital 16 (16) To ensure transparency and properly inform EU citizens and market operators,
Amendment 169 #
Proposal for a directive Recital 16 (16) To ensure transparency and properly inform EU citizens and market operators,
Amendment 170 #
Proposal for a directive Recital 16 (16) To ensure transparency and properly inform EU citizens and market operators, the competent authorities should set up a common website to publish non confidential information on the incidents and risks and to eventually advise on appropriate maintenance measures.
Amendment 171 #
Proposal for a directive Recital 16 (16) To ensure transparency and properly inform EU citizens and market operators, the competent authorities should set up a common website to publish non confidential information on the incidents
Amendment 172 #
Proposal for a directive Recital 17 (17) The information classification policy referred to in Recital 14 should follow the ENISA recommended Information Sharing Traffic Light Protocol. Any information exchanged shall be classified and handled according to its level of sensitivity as determined by the source of the information. Where information is considered confidential in accordance with Union and national rules on business confidentiality, such confidentiality shall be ensured when carrying out the activities and fulfilling the objectives set by this Directive.
Amendment 173 #
Proposal for a directive Recital 18 (18) On the basis in particular of national crisis management experiences and in cooperation with ENISA, the Commission and the Member States should develop a Union NIS cooperation plan defining cooperation mechanisms to prevent, detect, report, and counter risks and incidents. That plan should be duly taken into account in the operation of early warnings within the cooperation network.
Amendment 174 #
Proposal for a directive Recital 18 (18) On the basis in particular of national crisis management experiences and in cooperation with ENISA, the Commission and the Member States should develop a Union NIS cooperation plan defining cooperation mechanisms, best practices and operation patterns to counter risks and incidents. That plan should be duly taken into account in the operation of early warnings within the cooperation network.
Amendment 175 #
Proposal for a directive Recital 19 Amendment 176 #
Proposal for a directive Recital 20 Amendment 177 #
Proposal for a directive Recital 20 (20) Upon receipt of an early warning and its assessment, the competent authorities should agree on a coordinated response under the Union NIS cooperation plan. Competent authorities, ENISA, as well as the Commission should be informed about the measures adopted at national level as a result of the coordinated response.
Amendment 178 #
Proposal for a directive Recital 22 (22) Responsibilities in ensuring NIS lie to a great extent on public administrations and market operators. A culture of risk management and close cooperation, involving risk assessment, and the implementation of security measures appropriate to the risks faced should be promoted and developed through appropriate regulatory requirements and voluntary industry practices. Establishing a level playing field is also essential to the effective functioning of the cooperation network to ensure effective cooperation from all Member States.
Amendment 179 #
Proposal for a directive Recital 24 (24) Those obligations should be extended beyond the electronic communications sector to key providers of information society services, as defined in Directive 98/34/EC of the European Parliament and of the Council of 22 June 1998 laying down a procedure for the provision of information in the field of technical standards and regulations and of rules on Information Society services27 , which underpin downstream information society services or on-line activities, such as e- commerce platforms, Internet payment
Amendment 180 #
Proposal for a directive Recital 24 (24) Those obligations should be extended beyond the electronic communications sector to
Amendment 181 #
Proposal for a directive Recital 24 (24) Those obligations should be extended beyond the electronic communications sector to key providers of information society services, as defined in Directive 98/34/EC of the European Parliament and of the Council of 22 June 1998 laying down a procedure for the provision of information in the field of technical standards and regulations and of rules on
Amendment 182 #
Proposal for a directive Recital 25 Amendment 183 #
Proposal for a directive Recital 25 (25) Technical and organisational measures imposed to public administrations and market operators should not require that a particular commercial information and communications technology product be designed, developed or manufactured in a particular manner. On the other hand, the use of international standards pertaining to cybersecurity should be required.
Amendment 184 #
Proposal for a directive Recital 27 Amendment 185 #
Proposal for a directive Recital 27 (27) To avoid imposing a disproportionate financial and administrative burden on small operators and users, the requirements should be proportionate to the risk presented by the network or information system concerned, taking into account the state of the art of such measures.
Amendment 186 #
Proposal for a directive Recital 28 (28) Competent authorities should pay due attention to preserving informal and trusted channels of information-sharing between market operators and between the public and the private sectors.
Amendment 187 #
Proposal for a directive Recital 28 (28) Competent authorities, including the single points of contact, should pay due attention to preserving informal and trusted channels of information-sharing between market operators and between the public and the private sectors and should handle all information exchanged in accordance with the security classification, as indicated by its source. Publicity of incidents reported to the competent authorities should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the public administrations and market operators
Amendment 188 #
Proposal for a directive Recital 28 (28) Competent authorities should pay due attention to preserving informal and trusted channels of information-sharing between market operators and between the public and the private sectors. Previously unknown vulnerabilities or incidents reported to competent authorities should be notified to the manufacturers and service providers of affected ICT products and services. Publicity of incidents reported to the competent authorities should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the public administrations and market operators reporting incidents. In the implementation of the notification obligations, competent authorities should pay particular attention to the need to maintain information about product vulnerabilities strictly confidential prior to the release of appropriate security fixes.
Amendment 189 #
Proposal for a directive Recital 28 (28) Competent authorities should pay due attention to preserving informal and trusted channels of information-sharing between market operators and between the public and the private sectors. Publicity of incidents reported to the competent authorities should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the public administrations and market operators reporting incidents. In the implementation of the notification obligations, competent authorities should pay particular attention to the need to maintain information about product vulnerabilities strictly confidential prior to the release of appropriate security fixes though not delay any notification more than compulsorily required.
Amendment 190 #
Proposal for a directive Recital 29 (29) Competent authorities should have the necessary means to perform their duties, including powers to obtain sufficient information from market operators and public administrations in order to assess the level of security of network and information systems, measure the number, scale and scope of incidents, as well as reliable and comprehensive data about actual incidents that have had an impact on the operation of network and information systems.
Amendment 191 #
Proposal for a directive Recital 30 Amendment 192 #
Proposal for a directive Recital 30 (30) Criminal activities
Amendment 193 #
Proposal for a directive Recital 30 (30) Criminal activities are in many cases underlying an incident. The criminal nature of incidents can be suspected even if the
Amendment 194 #
Proposal for a directive Recital 30 (30) Criminal or cyberwar activities are in many cases underlying an incident. The criminal nature of incidents can be suspected even if the evidence to support it may not be sufficiently clear from the start. In this context, appropriate co-operation between competent authorities
Amendment 195 #
Proposal for a directive Recital 31 (31) Personal data are in many cases compromised as a result of incidents. Member States and market operators should protect personal data stored, processed or transmitted against accidental or unlawful destruction, accidental loss or alteration, and unauthorised or unlawful storage, access or disclosure, dissemination, or access; and ensure the implementation of a security policy with respect to the processing of personal data. In this context, competent authorities and data protection authorities should cooperate and exchange information on all relevant matters to tackle the personal data breaches resulting from incidents. Member states shall implement the obligation to notify security incidents in a way that minimises the administrative burden in case the security incident is also a personal data breach in line with the Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data28 . Liaising with the competent authorities and the data protection authorities, ENISA could assist by developing information exchange mechanisms and templates avoiding the need for two notification templates. This single notification template would facilitate the reporting of incidents compromising personal data thereby easing the administrative burden on businesses and public administrations.
Amendment 196 #
Proposal for a directive Recital 32 (32) Standardisation of security requirements is a market-driven process. To ensure a convergent application of security standards, Member States should encourage compliance or conformity with specified standards to ensure a high level of security at Union level. To this end, it might be necessary to draft harmonised standards, which should be done in accordance with Regulation (EU) No 1025/2012 of the European Parliament and of the Council of 25 October 2012 on European standardisation, amending Council Directives 89/686/EEC and 93/15/EEC and Directives 94/9/EC, 94/25/EC, 95/16/EC, 97/23/EC, 98/34/EC, 2004/22/EC, 2007/23/EC, 2009/23/EC and 2009/105/EC of the European Parliament and of the Council and repealing Council Decision 87/95/EEC and Decision No 1673/2006/EC of the European Parliament and of the Council29 .
Amendment 197 #
Proposal for a directive Recital 32 (32) Standardisation of security requirements is a market-driven process. To ensure a convergent application of security standards, Member States should encourage compliance or conformity with specified standards to ensure a high level of security at Union level. To this end,
Amendment 198 #
Proposal for a directive Recital 33 (33) The Commission should periodically review this Directive, in consultation with all interested stakeholders, in particular with a view to determining the need for modification in the light of changing technological or market conditions
Amendment 199 #
Proposal for a directive Recital 33 (33) The Commission should periodically review this Directive, in particular with a view to determining the need for modification in the light of changing societal, political, technological or market conditions.
Amendment 200 #
Proposal for a directive Recital 36 (36) In order to ensure uniform conditions for the implementation of this Directive, implementing powers should be conferred on the Commission as regards the cooperation between competent authorities and the Commission within the cooperation network,
Amendment 201 #
Proposal for a directive Recital 37 (37) In the application of this Directive, the Commission should liaise as appropriate with relevant sectorial committees and relevant bodies set up at EU level in particular in the field of e-Government, energy, transport and health.
Amendment 202 #
Proposal for a directive Recital 38 (38) Information that is considered confidential by a competent authority
Amendment 203 #
Proposal for a directive Article 1 – paragraph 2 – point b (b) creates an institutional cooperation mechanism between Member States in order to ensure a uniform application of this Directive within the Union and, where necessary, a coordinated and efficient handling of and response to risks and incidents affecting network and information systems;
Amendment 204 #
Proposal for a directive Article 1 – paragraph 3 Amendment 205 #
Proposal for a directive Article 1 – paragraph 3 3. The security requirements provided for in Article 14 shall apply neither to undertakings providing public communication networks or publicly available electronic communication services within the meaning of Directive 2002/21/EC, which shall comply with the specific security and integrity requirements laid down in Articles 13a and 13b of that Directive, n
Amendment 206 #
Proposal for a directive Article 1 – paragraph 4 4. This Directive shall be without prejudice to EU laws on cybercrime and Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection32
Amendment 207 #
Proposal for a directive Article 1 – paragraph 4 4. This Directive shall be without prejudice to
Amendment 208 #
Proposal for a directive Article 1 – paragraph 6 6. The sharing of information within the cooperation network under Chapter III and the notifications of NIS incidents under Article 14 may require the communication to trusted third parties and the processing of personal data. Such processing, which is necessary to meet the objectives of public interest pursued by this Directive, shall be authorised by the Member State pursuant
Amendment 209 #
Proposal for a directive Article 1 – paragraph 6 6. The sharing of information within the cooperation network under Chapter III and the notifications of NIS incidents under Article 14 may require the processing of personal data. Such processing, which is necessary to meet the objectives of public interest pursued by this Directive, shall be authorised by the Member State pursuant to Article 7 of Directive 95/46/EC and Directive 2002/58/EC, as implemented in national law, after taking all measures to ensure that the data is anonymised.
Amendment 210 #
Proposal for a directive Article 2 – paragraph 1 Member States shall not be prevented from adopting or maintaining provisions ensuring a higher level of security that conform to the Charter of Fundamental Rights of the European Union, without prejudice to their obligations under Union law.
Amendment 211 #
Proposal for a directive Article 3 – paragraph 1 – point 1 – point b (b) any device or group of inter-connected or related devices, one or more of which, pursuant to a program, perform automatic processing of
Amendment 212 #
Proposal for a directive Article 3 – paragraph 1 – point 1 – point c (c)
Amendment 213 #
Proposal for a directive Article 3 – paragraph 1 – point 2 (2) ‘security’ means the ability of a network and information system to resist, at a given level of confidence, accident or malicious action that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted data or the related services offered by or accessible via that network and information system; "security" as defined here includes appropriate technical devices, solutions and operating procedures ensuring the security requirements set forth in this Directive.
Amendment 214 #
Proposal for a directive Article 3 – paragraph 1 – point 2 a (new) (2a) "high common level of network information security" means a network and information system across the Union where incidents are corrected and unrepeated.
Amendment 215 #
Proposal for a directive Article 3 – paragraph 1 – point 4 (4) ‘incident’ means any reasonably identifiable circumstance or event having an actual adverse effect on security;
Amendment 216 #
Proposal for a directive Article 3 – paragraph 1 – point 5 Amendment 217 #
Proposal for a directive Article 3 – paragraph 1 – point 7 (7) ‘incident handling’ means all procedures supporting the detection, prevention, analysis, containment and response to an incident;
Amendment 218 #
Proposal for a directive Article 3 – paragraph 1 – point 8 – introductory part (8) ‘
Amendment 219 #
Proposal for a directive Article 3 – paragraph 1 – point 8 – point a Amendment 220 #
Proposal for a directive Article 3 – paragraph 1 – point 8 – point a a) provider of information society services which enable the provision of other information society services, a
Amendment 221 #
Proposal for a directive Article 3 – paragraph 1 – point 8 – point b (b) public or private operator of critical infrastructure that are essential for the maintenance of vital economic and societal activities in the fields of energy, transport, banking
Amendment 222 #
Proposal for a directive Article 3 – paragraph 1 – point 8 – point b (b) operator of
Amendment 223 #
Proposal for a directive Article 3 – paragraph 1 – point 8 – point b (b) operator of
Amendment 224 #
Proposal for a directive Article 3 – paragraph 1 – point 8 a (new) (8a) "incident having a significant impact" means an incident affecting the security and continuity of an information network or system that leads to the major disruption of vital economic or societal functions;
Amendment 225 #
Proposal for a directive Article 3 – paragraph 1 – point 8 b (new) (8b) "service" means the service provided by a public administration or market operator, to the exclusion of any other services of the same entity.
Amendment 228 #
Proposal for a directive Article 4 – paragraph 1 Amendment 229 #
Proposal for a directive Article 4 – paragraph 1 Amendment 230 #
Proposal for a directive Article 4 – paragraph 1 Member States shall ensure a high level of security of the network and information systems in their territories in accordance
Amendment 231 #
Proposal for a directive Article 4 – paragraph 1 Member States shall ensure a sustained continuous high level of security of the network and information systems in their territories in accordance with this Directive.
Amendment 232 #
Proposal for a directive Article 4 a (new) Article 4 a Liability of market operators A market operator under Article 3 shall be liable for any direct damage caused to any natural or legal person due to failure to comply with the obligations of this Directive if that damage is due to fault or neglect on its part.
Amendment 233 #
Proposal for a directive Article 5 – paragraph 1 – point e a (new) (ea) Member States may ask for the assistance of the European Network and Information Security Agency ('ENISA') in developing their national NIS strategies and national NIS cooperation plans, based on a common minimum NIS strategy and cooperation blueprint.
Amendment 234 #
Proposal for a directive Article 6 – paragraph 1 1) Each Member State shall designate a national competent authority on the security of network and information systems (the "competent authority"), which is not part of a secret service and not fully or partially identical with a secret service in terms of staffing or infrastructure.
Amendment 235 #
Proposal for a directive Article 6 – paragraph 1 1. Each Member State shall designate a national competent authority on the security of network and information systems used on the internal market (the ‘competent authority’).
Amendment 236 #
Proposal for a directive Article 6 – paragraph 5 5. The competent authorities shall consult
Amendment 237 #
Proposal for a directive Article 7 – paragraph 1 1. Each Member State shall set up a Computer Emergency Response Team (hereinafter: ‘CERT’) responsible for handling incidents and risks according to a well-defined process, which shall comply with the requirements set out in point (1) of Annex I. A CERT may be established within
Amendment 238 #
Proposal for a directive Article 7 – paragraph 1 1. Each Member State shall set up at least one Computer Emergency Response Team (hereinafter: ‘CERT’) or system of multiple CERTs, covering the sectors in Annex II, responsible for handling incidents and risks according to a well- defined process, which shall comply with the requirements set out in point (1) of Annex I. A CERT may be established within the competent authority.
Amendment 239 #
Proposal for a directive Article 7 – paragraph 1 1. Each Member State shall set up
Amendment 240 #
Proposal for a directive Article 7 – paragraph 1 1. Each Member State shall set up an Industrial Control System Computer Emergency Response Team (hereinafter: ‘CERT’) responsible for handling incidents and risks according to a well-defined process, which shall comply with the requirements set out in point (1) of Annex I. A CERT may be established within the competent authority.
Amendment 241 #
Proposal for a directive Article 7 – paragraph 5 5. The CERT or CERTs shall act under the supervision of the competent authority, which shall regularly review the adequacy of
Amendment 242 #
Proposal for a directive Article 7 – paragraph 5 – point 1 (new) (1) The CERT shall be enabled and encouraged to initiate and to participate in joint exercises with certain CERT, with all Member States-CERT, and with appropriate institutions of non-Member States as well as with CERT of multi- and international institutions such as NATO and the UN.
Amendment 243 #
Proposal for a directive Article 7 – paragraph 5 a (new) 5 a. Member States may ask for the assistance of the European Network and Information Security Agency ('ENISA') or of other Member States in developing their national CERT.
Amendment 244 #
Proposal for a directive Article 8 – paragraph 1 1
Amendment 245 #
Proposal for a directive Article 8 – paragraph 1 1. The competent authorities and the Commission shall form a network (‘cooperation network’), under the coordination of ENISA, to cooperate against risks and incidents affecting network and information systems.
Amendment 246 #
Proposal for a directive Article 8 – paragraph 1 1. The competent authorities and the Commission shall form an institutional network (‘cooperation network’) to cooperate against risks and incidents affecting network and information systems.
Amendment 247 #
Proposal for a directive Article 8 – paragraph 2 2. The cooperation network shall bring into permanent communication the Commission, ENISA and the competent authorities.
Amendment 248 #
Proposal for a directive Article 8 – paragraph 2 2. The cooperation network shall bring into permanent communication the Commission and the competent authorities and, as appropriate, relevant public administrations and market operators. When requested, the European Network and Information Security Agency (‘ENISA’) shall assist the cooperation network by providing its expertise and advice.
Amendment 249 #
Proposal for a directive Article 8 – paragraph 2 2. The cooperation network shall bring into permanent communication the Commission and the competent authorities.
Amendment 250 #
Proposal for a directive Article 8 – paragraph 2 2. The cooperation network shall bring into permanent communication the Commission and the competent authorities.
Amendment 251 #
Proposal for a directive Article 8 – paragraph 3 – point a a (new) (aa) Where information, early warnings or best practices originating from market operators or public administrations are shared within, or disclosed by the cooperation network, such sharing or disclosure shall be in accordance with the information classification as determined by the original source in accordance with Article 9(1). It shall be ensured that the original source is informed of the sharing or disclosure, including which relevant authorities or operators are to be informed of the incident, and that and that such sharing or disclosure does not harm the legitimate interests of the source.
Amendment 252 #
Proposal for a directive Article 8 – paragraph 3 – point c c) publish on a regular basis non- confidential information on on-going early warnings and coordinated response on a common website, in machine-readable form also;
Amendment 253 #
Proposal for a directive Article 8 – paragraph 3 – point c (c) publish on a regular basis non- confidential information on on-going early warnings and coordinated response on a common website and on the ENISA website;
Amendment 254 #
Proposal for a directive Article 8 – paragraph 3 – point c a (new) (c a) jointly discuss and coordinate their measures regarding security requirements and incident notification referred to in article 14 and regarding implementation and enforcement referred to in article 15;
Amendment 255 #
Proposal for a directive Article 8 – paragraph 3 – point e (e) jointly discuss and assess, at the request of a Member State or the Commission, the effectiveness of the CERTs, in particular when NIS exercises are performed at Union level and implement measures to resolve identified weaknesses without measurable delay;
Amendment 256 #
Proposal for a directive Article 8 – paragraph 3 – point f (f) cooperate and exchange information on all relevant matters with
Amendment 257 #
Proposal for a directive Article 8 – paragraph 3 – point f (f) cooperate and exchange information on
Amendment 258 #
Proposal for a directive Article 8 – paragraph 3 – point f (f) cooperate and exchange information on all relevant matters with the European Cybercrime Centre within Europol, and with other relevant European bodies in particular in the fields of criminal investigation, data protection, energy, transport, banking, stock exchanges and health;
Amendment 259 #
Proposal for a directive Article 8 – paragraph 3 – point f f) cooperate and exchange information on all relevant matters with the European Cybercrime Center within Europol, and with other relevant European bodies in particular in the fields of
Amendment 260 #
Proposal for a directive Article 8 – paragraph 3 – point f a (new) (fa) jointly discuss and agree on the common interpretation, consistent application and harmonious implementation within the Union of the provisions of Chapter IV;
Amendment 261 #
Proposal for a directive Article 8 – paragraph 3 – point f a (new) fa) cooperate as a matter of course with the national data protection authorities and the European Data Protection Supervisor;
Amendment 262 #
Proposal for a directive Article 8 – paragraph 3 – point i – point 1 (new) 1) NIS-authorities shall be encouraged to engage in security research and other appropriate programmes of Horizon2020.
Amendment 263 #
Proposal for a directive Article 8 – paragraph 3 a (new) 3a. Where appropriate market operators may be invited to participate in the activities of the cooperation network referred to in points (a), (g), (h) and (i) of paragraph 3.
Amendment 264 #
Proposal for a directive Article 8 – paragraph 4 4. The Commission shall establish, by means of implementing acts, the necessary modalities to facilitate the cooperation between competent authorities, ENISA and the Commission referred to in paragraphs 2 and 3. Those implementing acts shall be adopted in accordance with the
Amendment 266 #
Proposal for a directive Article 9 – paragraph 1 1) The exchange of sensitive and confidential information within the cooperation network shall take place through a secure infrastructure. Member States shall ensure that shared sensitive or secret information from other States or the Commission will not be shared with third States or improper purposes, for example covert operations or financial decision making.
Amendment 267 #
Proposal for a directive Article 9 – paragraph 1 1. The exchange of sensitive and confidential information within the cooperation network shall take place through a secure infrastructure operated under the supervision of ENISA.
Amendment 268 #
Proposal for a directive Article 9 – paragraph 1 a (new) 1a. Within five years from the entry into force of this directive, Member States shall ensure that the criteria referred to in of paragraph 2 are fulfilled.
Amendment 269 #
Proposal for a directive Article 10 – paragraph 1 – introductory part 1. The competent authorities or the Commission, under the coordination of ENISA, shall provide early warnings within the cooperation network on those risks and incidents that fulfil at least one of the following conditions:
Amendment 270 #
Proposal for a directive Article 10 – paragraph 1 – introductory part 1. The competent authorities or the Commission shall provide early warnings within the institutional cooperation network on those risks and incidents that fulfil at least one of the following conditions:
Amendment 271 #
Proposal for a directive Article 10 – paragraph 1 – point a (a) they grow rapidly or may grow rapidly in scale and affect or may affect more than one Member State;
Amendment 272 #
Proposal for a directive Article 10 – paragraph 1 – point c Amendment 273 #
Proposal for a directive Article 10 – paragraph 2 2. In the early warnings, the competent authorities and the Commission shall communicate any relevant information in their possession that may be useful for assessing the risk or incident where required by the gravity of the situation. The Commission shall be responsible for assessing the gravity of the situation for the purposes of implementing this provision.
Amendment 274 #
Proposal for a directive Article 10 – paragraph 2 2. In the early warnings, the competent authorities and the Commission shall communicate any relevant information in their possession that may be useful for assessing the risk or incident. Information deemed classified or confidential by the concerned public administration or market operator respectively and the identity of the latter shall only be provided to the degree necessary to assess the risk or incident.
Amendment 275 #
Proposal for a directive Article 10 – paragraph 4 Amendment 276 #
Proposal for a directive Article 10 – paragraph 4 4. Where the risk or incident subject to an early warning is of a suspected criminal nature, the national competent authorities
Amendment 277 #
Proposal for a directive Article 10 – paragraph 4 4. Where the risk or incident subject to an early warning is of a suspected serious criminal nature, the competent authorities or the Commission shall inform the European Cybercrime Centre within Europol where appropriate.
Amendment 278 #
Proposal for a directive Article 10 – paragraph 4 4. Where the risk or incident subject to an early warning is of a suspected criminal nature, the competent authorities or the Commission shall inform the European Cybercrime Centre within Europol without measurable delay.
Amendment 279 #
Proposal for a directive Article 10 – paragraph 4 a (new) 4a. Where the risk or incident subject to an early warning is of a suspected severe cross-border technical nature, the competent authorities or the Commission shall inform the European Network Information Security Agency;
Amendment 280 #
Proposal for a directive Article 10 – paragraph 5 Amendment 281 #
Proposal for a directive Article 10 – paragraph 5 Amendment 282 #
Proposal for a directive Article 12 – paragraph 1 1. The Commission shall be empowered to adopt, by means of implementing acts, a
Amendment 283 #
Proposal for a directive Article 12 – paragraph 1 1. The Commission shall be empowered to adopt, by means of
Amendment 284 #
Proposal for a directive Article 12 – paragraph 2 – introductory part 2. The Union NIS cooperation
Amendment 285 #
Proposal for a directive Article 12 – paragraph 3 3. The Union NIS cooperation plan shall be adopted no later than one year following the entry into force of this Directive and shall be revised regularly. Results of each revision shall be reported to the European Parliament.
Amendment 286 #
Proposal for a directive Article 13 – paragraph 1 Without prejudice to the possibility for the cooperation network to have informal international cooperation, the Union may conclude international agreements with third countries or international organisations allowing and organizing their participation in some activities of the cooperation network.
Amendment 287 #
Proposal for a directive Article 13 – paragraph 1 Without prejudice to the possibility for the cooperation network to have informal international cooperation, the Union may conclude international agreements with third countries or international organisations allowing and organizing their participation in some activities of the cooperation network. Such agreement shall take into account the need to ensure adequate protection of the personal data circulating on the cooperation network, without disclosing EU citizens' personal data to third parties.
Amendment 288 #
Proposal for a directive Article 13 – paragraph 1 Without prejudice to the possibility for the cooperation network to have informal international cooperation, the Union may conclude international agreements with third countries or international organisations allowing and organizing their
Amendment 289 #
Proposal for a directive Article 13 – paragraph 1 a (new) When the Union has concluded international agreements with third countries or international organizations, it shall provide for their participation in certain cooperation network activities, including cybersecurity, without prejudice to informal international cooperation network activities. Such agreement shall take into account the need to ensure adequate protection of the personal data circulating on the cooperation network.
Amendment 290 #
Proposal for a directive Article 14 – paragraph 1 1. Member States shall ensure that public administrations and market operators, providing or operating services, referred to in Article (3)(8)(b) of this Directive, take appropriate technical and organisational measures to manage the risks posed to the security of the networks and information systems which they control and use in their operations. Having regard to the state of the art, these measures shall guarantee a level of security appropriate to the risk presented. In particular, measures shall be taken to prevent and minimise the impact of incidents affecting their network and information system on the core services they provide and thus ensure the continuity of the services underpinned by those networks and information systems
Amendment 291 #
Proposal for a directive Article 14 – paragraph 1 1.
Amendment 292 #
Proposal for a directive Article 14 – paragraph 1 1. Member States shall ensure that
Amendment 293 #
Proposal for a directive Article 14 – paragraph 1 1. Member States shall ensure that public administrations and market operators take appropriate technical and organisational measures to manage the risks posed to the security of the networks and information systems which they control and use in their operations. Having regard to the
Amendment 294 #
Proposal for a directive Article 14 – paragraph 1 1. Member States shall ensure that public administrations and market operators take appropriate technical and organisational measures to detect and effectively manage the risks posed to the security of the networks and information systems which they control and use in their operations. Having regard to the state of the art, these measures shall guarantee a level of security appropriate to the risk presented. In particular, measures shall be taken to prevent and minimise the impact of incidents affecting their network and information system on the core services they provide and thus ensure the continuity of the services underpinned by those
Amendment 295 #
Proposal for a directive Article 14 – paragraph 2 2. Member States shall ensure that public administrations and market operators, providing or operating services, referred to in Article (3)(8)(b) of this Directive, notify to the competent authority incidents having a significant impact on the security and continuity of the core services they provide. Member States shall ensure that compliance with this requirement does not alter the provisions of Article 9(1) of this Directive, nor that it exposes the notifying party to increased liability or unnecessary operational or security risk.
Amendment 296 #
Proposal for a directive Article 14 – paragraph 2 2. Member States shall ensure
Amendment 297 #
Proposal for a directive Article 14 – paragraph 2 2. Member States shall ensure that public administrations and market operators notify to the competent authority, in the Member State where the core services are affected, incidents having a significant impact on the security and/or continuity of the core services they provide.
Amendment 298 #
Proposal for a directive Article 14 – paragraph 2 2. Member States shall ensure that public administrations and market operators notify to the competent authority incidents having a significant impact on the security of the core services they provide
Amendment 299 #
Proposal for a directive Article 14 – paragraph 2 2. Member States shall ensure that public administrations and market operators notify to the competent authority incidents having a
Amendment 300 #
Proposal for a directive Article 14 – paragraph 2 a (new) 2a. Public administrations and market operators, referred to in Article (3)(8)(a) of this Directive, should report incidents on a voluntary basis and in the event of severe incident, disruption or threat within their network or system.
Amendment 301 #
Proposal for a directive Article 14 – paragraph 2 b (new) 2b. The single points of contact or national competent authorities shall, as soon as possible, report back to the relevant public administration or market operator which has reported an incident the undertaken actions, decisions or recommendations, as well as of any third party informed, and the security and confidentiality protocols governing the information sharing.
Amendment 302 #
Proposal for a directive Article 14 – paragraph 3 3. The requirements under paragraphs 1 and 2 apply to all public and market operators
Amendment 303 #
Proposal for a directive Article 14 – paragraph 3 3. The requirements under paragraphs 1 and 2 apply to all market operators providing services within the European Union. Public authorities and market operators should provide disclosure tailored to their particular circumstances.
Amendment 304 #
Proposal for a directive Article 14 – paragraph 4 4. The competent authority may inform the public, or require the public administrations and market operators to do so, where it determines that public interest in the disclosure of the incident
Amendment 305 #
Proposal for a directive Article 14 – paragraph 4 4. The competent authority may inform the public, or require the public administrations and market operators to do so, where it determines that disclosure of the incident is in the public interest. Once a year, the competent authority shall submit a summary report to the cooperation network on the notifications received and the action taken in accordance with this paragraph. In case of incidents notified to the cooperation network referred to in Article 8, other national competent authorities shall not make public any information received on risks or incidents without approval of the notifying competent authority.
Amendment 306 #
Proposal for a directive Article 14 – paragraph 4 4. The competent authority may inform the
Amendment 307 #
Proposal for a directive Article 14 – paragraph 4 4. The competent authority, after consultation with the concerned public administration or market operator, may inform the public, or require the public administrations and market operators to do so, where it determines that disclosure of the incident is in the public interest and where the latter outweighs any conflicting interests of the public administration or market operator concerned. Once a year, the competent authority shall submit a summary report to the cooperation network on the notifications received and the action taken in accordance with this paragraph.
Amendment 308 #
Proposal for a directive Article 14 – paragraph 4 4. The competent authority may inform the public, or require the public administrations and market operators to do so, where it determines that disclosure of the incident is in the public interest.
Amendment 309 #
Proposal for a directive Article 14 – paragraph 4 4. The competent authority m
Amendment 310 #
Proposal for a directive Article 14 – paragraph 4 – subparagraph 1 (new) Besides reporting to the competent authority market operators shall be encouraged to announce incidents involving their corporation in their financial reports (on a voluntary basis).
Amendment 311 #
Proposal for a directive Article 14 – paragraph 5 Amendment 312 #
Proposal for a directive Article 14 – paragraph 5 Amendment 313 #
Proposal for a directive Article 14 – paragraph 6 Amendment 314 #
Proposal for a directive Article 14 – paragraph 6 Amendment 315 #
Proposal for a directive Article 14 – paragraph 6 6.
Amendment 316 #
Proposal for a directive Article 14 – paragraph 7 Amendment 317 #
Proposal for a directive Article 14 – paragraph 7 Amendment 318 #
Proposal for a directive Article 14 – paragraph 8 Amendment 319 #
Proposal for a directive Article 14 – paragraph 8 8. Paragraphs 1 and 2 shall not apply to microenterprises and SMEs as defined in Commission Recommendation 2003/361/EC of 6 May 2003 concerning the definition of micro, small and medium- sized enterprises35. __________________ 35 OJ L 124, 20.5.2003, p. 36.
Amendment 320 #
Proposal for a directive Article 15 – paragraph 1 1.
Amendment 321 #
Proposal for a directive Article 15 – paragraph 1 1. Member States shall ensure that the competent authorities have all the powers necessary to
Amendment 322 #
Proposal for a directive Article 15 – paragraph 2 – point b Amendment 323 #
Proposal for a directive Article 15 – paragraph 2 – point b (b)
Amendment 324 #
Proposal for a directive Article 15 – paragraph 2 – point b (b) undergo, where the information provided according to point (a) of this paragraph is not conclusive, a security audit carried out by a qualified independent body or national authority and make the results thereof available to the competent authority.
Amendment 325 #
Proposal for a directive Article 15 – paragraph 3 Amendment 326 #
Proposal for a directive Article 15 – paragraph 3 3. Member States shall ensure that competent authorities have the power to issue binding instructions to market
Amendment 327 #
Proposal for a directive Article 15 – paragraph 4 Amendment 328 #
Proposal for a directive Article 15 – paragraph 4 4. The competent authorities
Amendment 329 #
Proposal for a directive Article 15 – paragraph 5 5.
Amendment 330 #
Proposal for a directive Article 16 – paragraph 1 1. To ensure convergent implementation of Article 14(1), Member States, without prescribing the use of any particular technology, shall encourage the use of interoperable standards and /or specifications relevant to networks and information security. Such standards and/or specifications where appropriate shall take into account international and/or global equivalents.
Amendment 331 #
Proposal for a directive Article 16 – paragraph 1 1. To ensure convergent implementation of Article 14(1), Member States
Amendment 332 #
Proposal for a directive Article 16 – paragraph 1 1. To ensure convergent implementation of Article 14(1), Member States shall encourage the use of open standards and/or specifications relevant to networks and information security, and ensure that these standards comply with existing Union legislation.
Amendment 333 #
Proposal for a directive Article 16 – paragraph 1 1. To ensure convergent implementation of Article 14(1), Member States shall encourage the use of European and international standards and/or specifications relevant to networks and information security.
Amendment 334 #
Proposal for a directive Article 16 – paragraph 2 2.
Amendment 335 #
Proposal for a directive Article 17 – paragraph 1 1.
Amendment 336 #
Proposal for a directive Article 17 – paragraph 1 1. Member States shall lay down rules on sanctions applicable to negligent and intentional infringements of the national provisions adopted pursuant to this Directive and shall take all measures necessary to ensure that they are implemented. The sanctions provided for must be effective, proportionate and dissu |