electricity undertakings as defined in Article 2(57) of Directive (EU) 2019/944;

nominated electricity market operators (‘NEMOs’) as defined in Article 2(8) of Regulation (EU) 2019/943;

organised market places or ‘organised markets’ as defined in Article 2(4) of Commission Implementing Regulation (EU) No 1348/2014 ( 1 ) that arrange transactions on products relevant to cross-border electricity flows;

critical ICT service providers as referred to in Article 3, point (9) of this Regulation;

the ENTSO for Electricity established pursuant to Article 28 of Regulation (EU) 2019/943;

the EU DSO entity established pursuant to Article 52 of Regulation (EU) 2019/943;

balancing responsible parties as defined in Article 2, point (14) of Regulation (EU) 2019/943;

operators of recharging points as defined in Annex I to Directive (EU) 2022/2555;

regional coordination centres (‘RCCs’) as established pursuant to Article 35 of Regulation (EU) 2019/943;

managed security service providers (‘MSSP’) as defined in Article 6(40) of Directive (EU) 2022/2555;

any other entity or third party to whom responsibilities have been delegated or assigned pursuant to this Regulation.

the European Union Agency for the Cooperation of Energy Regulators (‘ACER’) established by Regulation (EU) 2019/942 of the European Parliament and of the Council ( 2 );

national competent authorities responsible for carrying out the tasks assigned to them under this Regulation and designated by Member States pursuant to Article 4, or ‘competent authority’;

national regulatory authorities (‘NRAs’) designated by each Member State pursuant to Article 57(1) of Directive (EU) 2019/944;

competent authorities for risk preparedness (‘RP-NCAs’) established pursuant to Article 3 of Regulation (EU) 2019/941;

computer security incident response teams (‘CSIRTs’) as designated or established pursuant to Article 10 of Directive (EU) 2022/2555;

competent authorities responsible for cybersecurity (‘CS-NCAs’) as designated or established pursuant to Article 8 of Directive (EU) 2022/2555;

the European Union Agency for Cybersecurity established pursuant to Regulation (EU) 2019/881;

any other authorities or third party to whom responsibilities have been delegated or assigned pursuant to Article 4(3).

the cybersecurity risk assessment methodologies pursuant to Article 18(1);

the comprehensive cross-border electricity cybersecurity risk assessment report pursuant to Article 23;

the minimum and advanced cybersecurity controls pursuant to Article 29, the mapping of electricity cybersecurity controls against standards pursuant to Article 34, including minimum and advanced cybersecurity controls in the supply chain in accordance with Article 33;

a cybersecurity procurement recommendation pursuant to Article 35;

the cyber-attacks classification scale methodology pursuant to Article 37(8).

TSOs representing at least 55 % of the Member States; and

TSOs representing Member States comprising at least 65 % of the population of the Union.

TSOs representing at least 72 % of the Member States concerned; and

TSOs representing Member States comprising at least 65 % of the population of the concerned area.

review the status of implementation of the applicable cybersecurity risk management measures with regard to the high-impact and critical-impact entities;

identify whether additional rules on common requirements, planning, monitoring, reporting and crisis management may be necessary to prevent risks for the electricity sector; and

identify areas of improvement for the revision of this Regulation, or determine uncovered areas and new priorities that may emerge due to technological developments.

mitigate risks having an impact on cross-border electricity flows;

provide the desired results and engender efficiency gains for the development of the electricity systems;

are efficient and integrated into the overall procurement of assets and services.

the average expenditure related to cybersecurity for mitigating risks having an impact on electricity cross-border flows, especially with respect to the high-impact and critical-impact entities;

in cooperation with the ENTSO for Electricity and the EU DSO entity, the average prices of cybersecurity services, systems and products that contribute to a large extent to the enhancement and maintenance of the cybersecurity risk-management measures in the different system operation regions;

the existence and level of comparability of costs and functions of cybersecurity services, systems and solutions suitable for the implementation of this Regulation, identifying possible measures necessary to foster efficiency in spending, particularly where cybersecurity technological investments may be needed.

development of the cybersecurity risk assessment methodologies pursuant to Article 18(1);

development of the Comprehensive Cross-border electricity cybersecurity risk assessment report pursuant to Article 23;

development of the common electricity cybersecurity framework pursuant to Chapter III;

development of the cybersecurity procurement recommendation pursuant to Article 35;

development of the cyber-attacks classification scale methodology pursuant to Article 37(8);

development of the provisional electricity cybersecurity impact index (‘ECII’) electricity cybersecurity impact index pursuant to Article 48(1) point (a);

development of the consolidated provisional list of high-impact and critical-impact entities pursuant to Article 48(3);

development of the provisional list of Union-wide high-impact and critical-impact processes pursuant to Article 48(4);

development of the provisional list of European and international standards and controls pursuant to Article 48(6);

performance of the Union-wide cybersecurity risk assessment pursuant to Article 19;

performance of the regional cybersecurity risk assessments pursuant to Article 21;

definition of the regional cybersecurity risk mitigation plans pursuant to Article 22;

development of guidance on European cybersecurity certification schemes for ICT products, ICT services, and ICT processes in accordance with Article 36;

development of guidelines for the implementation of this Regulation in consultation with ACER and ENISA.

a list of cyber threats to be considered, including at least the following supply chain threats:

the criteria to evaluate the impact of cybersecurity risks as high or critical, using defined thresholds for consequences and likelihood;

an approach to analyse the cybersecurity risks coming from legacy systems, the cascading effects of cyber-attacks and the real-time nature of systems operating the grid;

an approach to analyse the cybersecurity risks coming from the dependency on a single supplier of ICT products, ICT services or ICT processes.

measure the consequences of cyber-attacks based on the following criteria:

measure the likelihood of an incident as the frequency of cyber-attacks per year.

the Union-wide high-impact processes and the Union-wide critical-impact processes;

a risk impact matrix that entities and the competent authorities shall use to assess the cybersecurity risk identified in the cybersecurity risk assessment at Member State level performed pursuant to Article 20 and in the cybersecurity risk assessment at entity level pursuant to Article 26(2) point (b).

an assessment of the possible consequences of a cyber-attack using the metrics defined in the cybersecurity risk assessment methodology developed pursuant to Article 18(2), (3) and (4), and approved pursuant to Article 8;

the ECII and high-impact and critical-impact thresholds that the competent authorities shall use pursuant to Article 24(1) and (2) to identify high-impact and critical-impact entities involved in the Union-wide high-impact processes and in the Union-wide critical-impact processes.

the implementation status of the minimum and advanced cybersecurity controls pursuant to Article 29;

a list of all cyber-attacks reported in the previous three years pursuant to Article 38(3);

a summary of the cyber threat information reported in the previous three years pursuant to Article 38(6);

for each Union-wide high-impact or critical-impact process, an estimate of the risks of a compromise of the confidentiality, integrity and availability for information and relevant assets;

where necessary, a list of additional entities identified as high-impact or critical-impact pursuant to Article 24(1), (2), (3), and (5).

the minimum and advanced cybersecurity controls that high-impact and critical-impact entities shall apply in the system operation region;

the residual cybersecurity risks in the system operation regions after applying the controls referred to in point (a).

the list of Union-wide high-impact and critical-impact processes identified in the Union-wide cybersecurity risk assessment report in accordance with Article 19(2) point (a) including the estimation of likelihood and impact of cybersecurity risks evaluated during the regional cybersecurity risk assessment reports pursuant to Article 21(2) and Article 19(3) point (a);

current cyber threats, with a specific focus on emerging threats and risks for the electricity system;

cyber-attacks for the previous period at Union level, providing a critical overview of how such cyber-attacks may have had an impact on electricity cross-border flows;

overall status of implementation of the cybersecurity measures;

status of implementation of the information flows pursuant to Articles 37 and 38;

list of information or specific criteria for classification of information pursuant to Article 46;

identified and highlighted risks that may derive from insecure supply chain management;

results and accumulated experiences from regional and cross-regional cybersecurity exercises organised pursuant to Article 44;

an analysis of the development of the overall cross-border cybersecurity risks in the electricity sector since the last regional cybersecurity risk assessments;

any other information that may be useful to identify possible improvements of this Regulation or the need for a revision of this Regulation or any of its tools; and

aggregated and anonymised information of derogations granted pursuant to Article 30(3).

the entity is part of a group of entities for which there is a significant risk that they will be affected simultaneously by a cyber-attack;

the ECII aggregated over the group of entities is above the high-impact or critical-impact threshold.

any party performing the peer review, audit or inspection shall be independent from the critical-impact entity being verified, and shall have no conflicts of interest;

the staff performing the peer review, audit or inspection shall have demonstrable knowledge of:

the party performing the peer review, audit or inspection shall be allowed sufficient time to perform these activities;

the party performing the peer review, audit or inspection shall take the appropriate measures to protect the information they collect during the verification, in line with its confidentiality level; and

peer reviews, audits or inspections shall be performed at least once every year and cover the full verification scope at least every three years.

context establishment;

cybersecurity risk assessment at entity level;

cybersecurity risk treatment;

cybersecurity risk acceptance.

define the scope of the cybersecurity risk assessment including the high-impact and critical-impact processes identified by the ENTSO for Electricity and the EU DSO entity, and other processes that may be targets of cyber-attacks with a high-impact or critical-impact on cross-border electricity flows; and

define the criteria for risk evaluation and for risk acceptance in accordance with the risk impact matrix that entities and the competent authorities shall use to assess the cybersecurity risks in the cybersecurity risk assessment methodologies at Union level, at regional level and at Member State level developed by the ENTSO for Electricity and the EU DSO entity in accordance with Article 19(2).

identify cybersecurity risks by taking into account:

analyse the likelihood and consequences of the cybersecurity risks identified in point (a) and determine the cybersecurity risk level using the risk impact matrix used to assess cybersecurity risks in cybersecurity risk assessment methodologies at Union level, at regional level and at Member State level developed by TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO entity in accordance with Article 19(2);

classify assets according to the possible consequences when cybersecurity is compromised and determine the high-impact and critical-impact perimeter using the following steps:

evaluate cybersecurity risks by prioritising them through risk evaluation criteria and risk acceptance criteria referred to in paragraph 3 point (b).

the minimum cybersecurity controls, developed in accordance with Article 29;

the advanced cybersecurity controls, developed in accordance with Article 29;

the mapping matrix, developed in accordance with Article 34, that maps the controls referred to in points (a) and (b) against selected European and international standards and national legislative or regulatory frameworks;

the cybersecurity management system established pursuant to Article 32.

in exceptional circumstances, where the entity can demonstrate that the costs of implementing the appropriate cybersecurity controls significantly exceed the benefits. ACER and the ENTSO for Electricity in cooperation with the DSO entity may jointly develop a guidance for estimating the costs of cybersecurity controls to help the entities;

where the entity provides an entity-level risk treatment plan that mitigates the cybersecurity risks using alternative controls to a level that is acceptable in accordance with to the risk acceptance criteria referred to Article 26(3), point (b).

determine the scope of the cybersecurity management system considering interfaces and dependencies with other entities;

ensure that all its senior management is informed of relevant legal obligations and actively contributes to the implementation of the cybersecurity management system through timely decisions and prompt reactions;

ensure that the resources needed for the cybersecurity management system are available;

establish a cybersecurity policy that shall be documented and communicated within the entity and to parties affected by the security risks;

assign and communicate responsibilities for roles relevant to cybersecurity;

perform cybersecurity risk management at entity level as defined in Article 26;

determine and provide the resources required for the implementation, maintenance and continual improvement of the cybersecurity management system, taking into account the necessary competence and awareness of cybersecurity resources;

determine the internal and external communication that is relevant to cybersecurity;

create, update and control documented information related to the cybersecurity management system;

evaluate the performance and effectiveness of the cybersecurity management system;

conduct internal audits at planned intervals to ensure that the cybersecurity management system is effectively implemented and maintained;

review the implementation of the cybersecurity management system at planned intervals; and control and correct non-compliance of the resources and activities with the policies, procedures, guidelines in the cybersecurity management system.

include recommendations for the procurement of ICT products, ICT services, and ICT processes referring to cybersecurity specifications, covering at least:

require such entities to take into account the procurement recommendations referred to in subparagraph (a) when concluding contracts with suppliers, collaboration partners and other parties in the supply chain, covering ordinary deliveries of ICT products, ICT services and ICT processes as well as unsolicited events and circumstances like termination and transition of contracts in cases of negligence of the contractual partner;

require such entities to take into account the results of relevant coordinated security risk assessments of critical supply chains carried out in accordance with Article 22(1) of Directive (EU) 2022/2555;

include criteria to select and contract suppliers that can meet the cybersecurity specifications as stated in paragraph (a) and that possess a level of cybersecurity appropriate to the cybersecurity risks of the ICT product, ICT service, or ICT processes that the supplier delivers;

include criteria to diversify sources of supply for ICT products, ICT services and ICT processes and reduce the risk of a vendor lock-in;

include criteria to monitor, review or audit the cybersecurity specifications for supplier internal operational processes throughout the entire lifecycle of each ICT product, ICT service and ICT process on a regular basis.

a description and classification of the types of ICT products, ICT services and ICT processes used by high-impact and critical-impact entities in the high-impact and critical-impact perimeter;

a list of the types of ICT products, ICT services, and ICT processes for which a set of non-binding cybersecurity recommendations shall be developed based on the relevant regional cybersecurity risk assessment reports and on the priorities of high-impact and critical-impact entities.

comply with the principles of procurement pursuant to Directive 2014/24/EU; and

are compatible with and take into account the most recent available European cybersecurity certification schemes relevant to the ICT product, ICT service, or ICT process.

shall assess the level of confidentiality of that information and inform the entity about the outcome of its assessment without undue delay and not later than within 24 hours of receipt of the information;

shall attempt to find any other similar cyber-attack in the Union reported to other competent authorities, in order to correlate the information received in the context of the reportable cyber-attack with information provided in the context of other cyber-attacks and enrich existing information, strengthen and coordinate cybersecurity responses;

shall be responsible for the removal of business secrets and the anonymisation of the information in accordance with the relevant national and Union rules;

shall share the information with the national single points of contact, CSIRTs and all competent authorities designated pursuant to Article 4 in other Member States without undue delay and no later than 24 hours after the reception of a reportable cyber-attack and provide updated information on a regular basis to those authorities or bodies;

shall disseminate the information of the cyber-attack, after anonymisation and removal of business secrets pursuant to paragraph 1(c), to critical-impact and high-impact entities in its Member State without undue delay and no later than 24 hours after receiving information according to paragraph 1(a), and provide updated information on a regular basis allowing the entities to organise their defence effectively;

may request the reporting high-impact or critical-impact entity to further disseminate the reportable cyber-attack information in a secure manner to other entities that may be affected, with the aim to generate situational awareness by the electricity sector and to prevent the materialisation of a risk that may escalate in a cross-border cybersecurity electricity incident;

shall share with ENISA a summary report, after anonymisation and removal of business secrets, with the information of the cyber-attack.

share it with ENISA via an appropriate secure information exchange channel without delay, unless otherwise specified in other Union law;

support the concerned entity to receive from the manufacturer or provider an effective, coordinated and rapid management of the unpatched actively exploited vulnerability or of effective and efficient mitigation measures;

share available information with the vendor and request the manufacturer or provider, where possible, to identify a list of CSIRTs in Member States concerned by the unpatched actively exploited vulnerability and that shall be informed;

share available information with the CSIRTs identified under the previous point, based on need-to-know principle;

share, where they exist, mitigation strategies and measures to the reported unpatched actively exploited vulnerability.

share, where they exist, mitigation strategies and measures to the reported unpatched actively exploited vulnerability, in coordination with the CSIRTs in its Member State;

shall share the information with a CSIRT in the Member State where the unpatched actively exploited vulnerability has been reported.

the potential impact considering the assets and perimeters exposed determined in accordance with Article 26(4), point (c); and

the severity of the cyber-attack.

support critical-impact and high-impact entities with relevant security related information for operations of cross-border electricity flows, such as near real-time reporting of cyber-attacks, early alerts related to cybersecurity matters and undisclosed vulnerabilities on equipment in use in the electricity system;

be maintained in a suitable and highly trustable environment;

allow for data collection from critical-impact and high-impact entities and facilitate removal of confidential information and anonymisation of the data and their prompt dissemination to critical-impact and high-impact entities.

consult ENISA and the NIS Cooperation Group, the national single points of contact and the representatives of main stakeholders when assessing the feasibility;

present the results of the feasibility study to ACER and the NIS Cooperation Group.

establish, for all assets within its cybersecurity perimeter determined pursuant to Article 26(4) point (c), at least the CSOC capabilities to:

have the right to procure all or parts of these capabilities pursuant to point (a) through MSSPs. Critical-impact and high-impact entities shall remain responsible for MSSPs and supervise their efforts;

designate a single point of contact at entity level for the purpose of information sharing.

it provides relevant information for other critical-impact and high-impact entity for preventing, detecting, responding or mitigating the impact of the risk;

the identified techniques, tactics and procedures used in the context of an attack lead to information such as compromised URL or IP addresses, hashes or any other attribute useful to contextualise and correlate the attack;

a cyber threat may be further assessed and contextualised with additional information provided by service providers or third parties not subject to this Regulation.

that the information is submitted pursuant to this Regulation;

whether the information concerns:

in the case of a reportable cyber-attack, the level of the cyber-attack according to the cyber-attack classification scale methodology referred to in Article 37(8) and information leading to this classification including at least the criticality of the cyber-attack.

ensure that their own single point of contact at entity level has access on a need-to-know basis to the information they received from the national single point of contact through their competent authority;

unless already done pursuant to Article 3(4) of Directive (EU) 2022/2555, notify the competent authority of the Member State in which they are established and the national single point of contact with a list of their cybersecurity single points of contact at entity level:

establish cyber-attack management procedures for cyber-attacks, including roles and responsibilities, tasks and reactions based on the observable evolution of the cyber-attack within the critical-impact and high-impact perimeters;

test the overall cyber-attack management procedures at least every year by testing at least one scenario affecting directly or indirectly cross-border electricity flows. That annual test may be conducted by critical-impact and high-impact entities during the regular exercises referred to in Article 43. Any live cyber-attack response activity with a consequence classified at least Scale 2, according to the cyber-attack classification scale methodology referred to in Article 37(8) and with a cybersecurity root cause, may serve as an annual test of the cyber-attack response plan.

coordinate the efficient retrieval and further dissemination of all relevant cybersecurity information to the entities involved in the crisis management process;

organise the communication between all the entities impacted by the crisis and the competent authorities, in order to reduce overlaps and increase the efficiency in the analyses and technical responses to remedy the simultaneous electricity crises with a cybersecurity root cause;

provide, in cooperation with the competent CSIRTs, the expertise required, including operational advice on the implementation of possible mitigation measures to the entities impacted by the incident;

notify and provide regular updates on the state of the incident to the Commission and the Electricity Coordination Group, following the protection principles laid down in Article 46;

seek advice from relevant authorities, agencies or entities that might be of help to mitigate the electricity crisis.

have compatible cross-border cybersecurity incident handling procedures as defined in Article 6(8) of Directive (EU) 2022/2555 formally incorporated in their crisis management plans;

are part of the general crisis management activities.

rules of declaration of the crisis as set out in Article 14(2) and (3) of the Regulation (EU) 2019/941;

clear roles and responsibilities for crisis management, including the role of other relevant critical-impact and high-impact entities;

up-to-date contact information as well as rules for communication and information sharing during a crisis situation including the connection to the CSIRTs.

processes depending on availability, integrity and reliability of IT services;

all business continuity locations including the locations for hardware and software;

all internal roles and responsibilities connected to business continuity processes.

collect voluntary shared information from:

assess and classify collected information;

assess the information ENISA has access to for identifying cyber risk conditions and relevant indicators for aspects of cross-border electricity flows;

identify conditions and indicators that frequently correlate with cyber-attacks within the electricity sector;

define whether further analysis and preventive actions shall be taken through assessment and identification of risk factors;

inform the competent authorities on the identified risks and recommended preventive actions specific to the entities concerned;

inform all relevant entities listed in Article 2 on the results of the information assessed in accordance with points (b), (c) and (d) of this paragraph;

periodically include the relevant information in the situational awareness report, issued in accordance with Article 7(6) of Regulation (EU) 2019/881;

derive, where possible, applicable data that indicates that a potential security breach or cyber-attack (‘indicators of compromise’) from the collected information.

all critical-impact entities of its Member State, the NRA, CSIRTs and the CS-NCA at the latest by 30 June of the year preceding the cybersecurity exercise at entity level;

each entity that shall participate in the cybersecurity exercise at Member State level at the latest 6 months before the exercise is to take place.

the exercise scenarios, meeting reports, main positions, successes and lessons learnt at any level of the electricity value chain;

whether the key success criteria were met;

a list of recommendations for entities participating in the relevant cybersecurity exercise to correct, adapt or change cybersecurity crisis processes, procedures, associated governance models and any existing contractual engagements with critical service providers.

be proportionate;

take into consideration cybersecurity risks related to known past and emerging threats to which such information may be subject in the context of this Regulation;

to the extent possible, be based on national, European or international standards and best practices;

be documented.

who are authorised to access that information based on their functions and limited to the execution of the tasks assigned;

for whom the entity was able to assess ethical and integrity principles, as well as for whom there is no evidence of negative outcome from a background verification check to evaluate reliability of the individual in accordance with the best practices and standard security requirements of the entity, and, where necessary, with the national laws and regulations.

consult and be authorised by the competent authority to share such information;

anonymise such information without losing the elements necessary to inform the public of an imminent and serious risk to cross-border electricity flows and the possible mitigation measures;

safeguard the identity of the originator and of the entities that have been processing such information under this Regulation.

a provisional electricity cybersecurity impact index (‘ECII’) pursuant to paragraph 2 of this Article;

a provisional list of Union-wide high-impact and critical-impact processes pursuant to paragraph 4 of this Article; and

a provisional list of European and international standards and controls required by national legislation with relevance for cybersecurity aspects of cross-border electricity flows pursuant to paragraph 6 of this Article.

European and international standards and national legislation which provide guidance on methodologies for cybersecurity risk management at entity level; and

cybersecurity controls equivalent to the controls that are expected to be part of the minimum and advanced cybersecurity controls.