(1)

Strategic cooperation between Member States and sharing of information, experience and best practice relating to the security of network and information systems is essential for effectively responding to the challenges of incidents and risks related to the security of those systems across the Union.

(2)

In order to support and facilitate strategic cooperation and the exchange of information among Member States and to develop trust and confidence amongst them, Article 11 of Directive (EU) 2016/1148, establishes a Cooperation Group, composed of representatives of the Member States, the Commission and the European Union Agency for Network and Information Security

(3)

Under Article 11 of Directive (EU) 2016/1148 the Cooperation Group is required to carry out its tasks on the basis of biennial work programmes, the first of which must be established by 9 February 2018. Among its tasks, the Cooperation Group is to provide strategic guidance for the activities of the Computer Security Incident Response Teams network, exchange information and best practice, discussing capabilities and preparedness of the Member States. The Cooperation Group is also required to prepare by 9 August 2018 and every year and half thereafter, a report assessing the experience gained with the strategic cooperation pursued under this Article.

(4)

Pursuant to Article 24(2) of Directive (EU) 2016/1148 for the period from 9 February 2017 to 9 November 2018 and for the purposes of supporting Member States in taking a consistent approach in the identification of operators of essential services, the Cooperation Group is to discuss the process, substance and type of national measures allowing for the identification of operators of essential services within a specific sector. The Cooperation Group is also to discuss, at the request of a Member State, specific draft national measures of that Member State regarding the identification of operators of essential services within a specific sector.

(5)

Under Article 14(7) of Directive (EU) 2016/1148 competent authorities acting together within the Cooperation Group may develop and adopt guidelines concerning the circumstances in which operators of essential services are required to notify incidents, including on the parameters to determine the significance of the impact of an incident.

(6)

Pursuant to Article 11(2) of Directive (EU) 2016/1148 the Commission is to provide the secretariat of the Cooperation Group. The Commission should also provide secretarial support for sub-groups created in accordance with this decision.

(7)

The Cooperation Group should be chaired by a representative of a Member State holding the Presidency of the Council of the European Union. The Chair should be assisted in the performance of his duties by representatives of the Member States holding the previous and the following Presidency of the Council of the Union. The Chair may specify in relation to which duties such assistance may be needed. In case a Member State holding the Presidency of the Council would refrain from chairing the Group, a substitute chair should be elected by a two-third majority of the members of the Group.

(8)

The work of the Chair should be governed by the principles of inclusiveness, engagement, respect for diversity and consensus building. In particular, the Chair of the Cooperation group should facilitate the engagement of all members, allowing for diverse views and positions to be expressed and endeavour to find solutions which command the widest possible support within the Cooperation Group.

(9)

Pursuant to Article 11(2) of Directive (EU) 2016/1148, the Cooperation Group may, where appropriate, invite representatives of relevant stakeholders to attend the meetings of the group. In order to ensure that acceding countries comply with the requirements of Directive (EU) 2016/1148 from the day of accession, it is appropriate that representatives of such countries are invited to attend the meetings of the Cooperation Group as from the date of signature of the Treaty of accession. The decision to invite representatives of relevant stakeholders or experts to attend a meeting or a particular part of a meeting of the Cooperation Group should be taken by the Chair, unless by a simple majority of the component members, the Group would oppose the participation of the representative or expert concerned in the meeting or in part of it.

(10)

Pursuant to Article 13 of Directive (EU) 2016/1148 the Union may conclude international agreements in accordance with Article 218 TFEU with third countries and international organisations that will allow and organise their participation in some activities of the Cooperation Group.

(11)

In the interest of efficiency, the Cooperation Group should have the possibility to create sub-groups.

(12)

In the interest of simplification, the Cooperation Group should adopt more detailed rules of procedure, relating, inter alia, to modalities of distribution of documentation, the written procedure or the drawing up of summary minutes of meetings.

(13)

In principle, the discussions of the Group should not be open to the public as their disclosure could have negative implications for trust and confidence building between the members, in view of the fact that matters discussed often concern public security. The Group however may decide with the agreement of the Chair to open up its discussion for certain matters to the public and also to facilitate public disclosure of appropriate documentation.

(14)

With a view to ensuring the smooth functioning of the Group from the day referred to in Article 24(1) of Directive (EU) 2016/1148, this decision should enter into force on the day following that of its publication in the Official Journal of the European Union.

(15)

The measures provided for in this Decision are in accordance with the opinion of the Network and Information Systems Security Committee established by Article 22 of Directive (EU) 2016/1148,