Legalize / European Union / Delegated Regulation

Commission Delegated Regulation (EU) 2024/1366 of 11 March 2024 supplementing Regulation (EU) 2019/943 of the European Parliament and of the Council by establishing a network code on sector-specific rules for cybersecurity aspects of cross-border electricity flows

Type Delegated Regulation

Publication 2024-05-24

Last updated 2025-09-14

State In force

Department European Commission, ENER

Source EUR-Lex

articles 49

Reform history JSON API

CHAPTER I GENERAL PROVISIONS

Article 1

Subject matter

This Regulation establishes a network code which lays down sector-specific rules for cybersecurity aspects of cross-border electricity flows, including rules on common minimum requirements, planning, monitoring, reporting and crisis management.

Article 2

Scope

This Regulation applies to cybersecurity aspects of cross-border electricity flows in the activities of the following entities, if they are identified as high-impact or critical-impact entities in accordance with Article 24:

(a) electricity undertakings as defined in Article 2(57) of Directive (EU) 2019/944;

(b) nominated electricity market operators (‘NEMOs’) as defined in Article 2(8) of Regulation (EU) 2019/943;

(c) organised market places or ‘organised markets’ as defined in Article 2(4) of Commission Implementing Regulation (EU) No 1348/2014 ([^E0001]) that arrange transactions on products relevant to cross-border electricity flows;

(d) critical ICT service providers as referred to in Article 3, point (9) of this Regulation;

(e) the ENTSO for Electricity established pursuant to Article 28 of Regulation (EU) 2019/943;

(f) the EU DSO entity established pursuant to Article 52 of Regulation (EU) 2019/943;

(g) balancing responsible parties as defined in Article 2, point (14) of Regulation (EU) 2019/943;

(h) operators of recharging points as defined in Annex I to Directive (EU) 2022/2555;

(i) regional coordination centres (‘RCCs’) as established pursuant to Article 35 of Regulation (EU) 2019/943;

(j) managed security service providers (‘MSSP’) as defined in Article 6(40) of Directive (EU) 2022/2555;

(k) any other entity or third party to whom responsibilities have been delegated or assigned pursuant to this Regulation.

The following authorities are, as part of their current mandates, responsible to perform tasks assigned in this Regulation:

(a) the European Union Agency for the Cooperation of Energy Regulators (‘ACER’) established by Regulation (EU) 2019/942 of the European Parliament and of the Council ([^E0002]);

(b) national competent authorities responsible for carrying out the tasks assigned to them under this Regulation and designated by Member States pursuant to Article 4, or ‘competent authority’;

(c) national regulatory authorities (‘NRAs’) designated by each Member State pursuant to Article 57(1) of Directive (EU) 2019/944;

(d) competent authorities for risk preparedness (‘RP-NCAs’) established pursuant to Article 3 of Regulation (EU) 2019/941;

(e) computer security incident response teams (‘CSIRTs’) as designated or established pursuant to Article 10 of Directive (EU) 2022/2555;

(f) competent authorities responsible for cybersecurity (‘CS-NCAs’) as designated or established pursuant to Article 8 of Directive (EU) 2022/2555;

(g) the European Union Agency for Cybersecurity established pursuant to Regulation (EU) 2019/881;

(h) any other authorities or third party to whom responsibilities have been delegated or assigned pursuant to Article 4(3).

This Regulation shall also apply to all entities who are not established in the Union but who deliver services to entities in the Union, provided they have been identified as high or critical-impact entities by the competent authorities in accordance with Article 24(2).

This Regulation is without prejudice to the Member States’ responsibility for safeguarding national security and their power to safeguard other essential State functions, including ensuring the territorial integrity of the State and maintaining law and order.

This Regulation is without prejudice to the Member States’ responsibility for safeguarding national security with respect to activities in the production of electricity from nuclear powers plants, including activities within the nuclear value chain, in accordance with the Treaties.

Entities, the competent authorities, the single points of contact at entity level and the CSIRTs shall process personal data to the extent necessary for the purposes of this Regulation and in accordance with Regulation (EU) 2016/679, in particular such processing shall rely on Article 6 thereof.

Article 3

Definitions

The following definitions apply:

(1) ‘asset’ means any information, software or hardware in the network and information systems either tangible or intangible, that has value to an individual, an organisation or a government;

(2) ‘competent authority for risk preparedness’ means the competent authority designated pursuant to Article 3 of Regulation (EU) 2019/941;

(3) ‘computer security incident response team’ means a team responsible for risk and incident handling in accordance with Article 10 of Directive (EU) 2022/2555;

(4) ‘critical-impact asset’ means an asset that is necessary to carry out a critical-impact process;

(5) ‘critical-impact entity’ means an entity that carries out a critical-impact process and that is identified by the competent authorities in accordance with Article 24;

(6) ‘critical-impact perimeter’ means a perimeter defined by an entity referred to in Article 2(1) that contains all critical-impact assets and on which access to these assets can be controlled and that defines the scope where the advanced cybersecurity controls apply;

(7) ‘critical-impact process’ means a business process carried out by an entity for which the electricity cybersecurity impact indices are above the critical-impact threshold;

(8) ‘critical-impact threshold’ means the values of the electricity cybersecurity impact indices referred to in Article 19(3)b, above which a cyber-attack on a business process will cause critical disruption of cross-border electricity flows;

(9) ‘critical ICT service provider’ means an entity which provides an ICT service, or ICT process that is necessary for a critical-impact or high-impact process affecting cybersecurity aspects of cross-border electricity flows and that, if compromised, may cause a cyber-attack with impact above the critical-impact or high-impact threshold;

(10) ‘cross-border electricity flow’ means a cross-border flow as defined in Article 2(3) of Regulation (EU) 2019/943;

(11) ‘cyber-attack’ means an incident as defined in Article 3, point (14), of Regulation (EU) 2022/2554;

(12) ‘cybersecurity’ means cybersecurity as defined in Article 2, point (1) of Regulation (EU) 2019/881;

(13) ‘cybersecurity control’ means the actions or procedures carried out with the purpose of avoiding, detecting, counteracting, or minimising cybersecurity risks;

(14) ‘cybersecurity incident’ means an incident as defined in Article 6, point (6) of Directive (EU) 2022/2555;

(15) ‘cybersecurity management system’ means the policies, procedures, guidelines, and associated resources and activities, collectively managed by an entity, in the pursuit of protecting its information assets from cyber threats systematically establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organisation’s network and information system security;

(16) ‘cybersecurity operation centre’ means a dedicated centre where a technical team consisting of one or more experts, supported by cybersecurity IT systems, performs security-related tasks (Cybersecurity operation center (‘CSOC’) services) such as handling of cyber-attacks and security configuration errors, security monitoring, log analysis, and cyber-attack detection;

(17) ‘cyber threat’ means a cyber threat as defined in Article 2, point (8) of Regulation (EU) 2019/881;

(18) ‘cybersecurity vulnerability management’ means the practice of identifying and addressing vulnerabilities;

(19) ‘entity’ means entity as defined in Article 6, point (38) of Directive (EU) 2022/2555;

(20) ‘early alert’ means the information necessary to indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;

(21) ‘electricity cybersecurity impact index’ (‘ECII’) means an index or classification scale that ranks possible consequences of cyber-attacks to business processes involved in cross-border electricity flows;

(22) ‘European cybersecurity certification scheme’ means a scheme as defined in Article 2, point (9) of Regulation (EU) 2019/881;

(23) ‘high-impact entity’ means an entity that carries out a high-impact process and that is identified by the competent authorities in accordance with Article 24;

(24) ‘high-impact process’ means any business process carried out by an entity for which the electricity cybersecurity impact indices are above the high-impact threshold;

(25) ‘high-impact asset’ means an asset that is necessary to carry out a high-impact process;

(26) ‘high-impact threshold’ means the values of the electricity cybersecurity impact indices referred to in Article 19(3)b, above which a successful cyber-attack on a process will cause high disruption of cross-border electricity flows;

(27) ‘high-impact perimeter’ means a perimeter defined by any entity listed in Article 2(1) that contains all high-impact assets and on which access to these assets can be controlled and that defines the scope where the minimum cybersecurity controls apply;

(28) ‘ICT product’ means an ICT product as defined in Article 2, point (12) of Regulation (EU) 2019/881;

(29) ‘ICT service’ means an ICT service as defined in Article 2, point (13) of Regulation (EU) 2019/881;

(30) ‘ICT process’ means an ICT process as defined in Article 2, point (14) of Regulation (EU) 2019/881;

(31) ‘legacy system’ means a legacy ICT system as defined in Article 3(3) of Regulation (EU) 2022/2554;

(32) ‘national single point of contact’ means the single point of contact designated or established by each Member State pursuant to Article 8(3) of Directive (EU) 2022/2555;

(33) ‘NIS cyber crisis management authorities’ means the authorities designated or established pursuant to Article 9, point (1) of Directive (EU) 2022/2555;

(34) ‘originator’ means an entity that initiates an information exchange, information sharing or information storage event;

(35) ‘procurement specifications’ means the specifications that entities define for the procurement of new or updated ICT products, ICT processes or ICT services;

(36) ‘representative’ means a natural or legal person established in the Union who is explicitly designated to act on behalf of a high or critical-impact entity not established in the Union but delivering services to entities in the Union and who may be addressed by a competent authority or a CSIRT in the place of the high or critical-impact entity itself with regard to the obligations of that entity under this Regulation;

(37) ‘risk’ means risk as defined in Article 6, point (9) of Directive (EU) 2022/2555;

(38) ‘risk impact matrix’ means a matrix used during risk assessment to determine the resulting risk impact level for each risk assessed;

(39) ‘simultaneous electricity crisis’ means an electricity crisis as defined in Article 2, point (10) of Regulation (EU) 2019/941;

(40) ‘single point of contact at entity level’ means single point of contact at entity level as designated under Article 38(1) point (c);

(41) ‘stakeholder’ is any party that has an interest in the success and ongoing operation of an organisation or process such as employees, directors, shareholders, regulators, associations, suppliers and customers;

(42) ‘standard’ means a standard as defined in Article 2(1) of Regulation (EU) No 1025/2012 of the European Parliament and of the Council ([^E0003]);

(43) ‘system operation region’ means the system operation regions as defined in Annex I to ACER Decision 05-2022 on the Definition of System Operation Regions, established in accordance with Article 36 of Regulation (EU) 2019/943;

(44) ‘system operators’ means ‘distribution system operator’ (DSO) and ‘transmission system operator’ (TSO) as defined in Articles 2(29) and 2(35) of Directive (EU) 2019/944;

(45) ‘Union-wide critical-impact process’ means any electricity sector process, possibly involving multiple entities, for which the possible impact of a cyber-attack may be deemed critical during the performance of the Union-wide cybersecurity risk assessment;

(46) ‘Union-wide high-impact process’ means any electricity sector process, possibly involving multiple entities, for which the possible impact of a cyber-attack may be deemed high during the performance of the Union-wide cybersecurity risk assessment;

(47) ‘unpatched actively exploited vulnerability’ means a vulnerability, which has not yet been publicly disclosed and patched and for which there is reliable evidence that execution of malicious code was performed by an actor on a system without permission of the system owner;

(48) ‘vulnerability’ means a vulnerability as defined in Article 6, point (15) of Directive (EU) 2022/2555.

Article 4

Competent authority

As soon as possible and in any event by 13 December 2024, each Member State shall designate a national governmental or regulatory authority responsible for carrying out the tasks assigned to it in this Regulation (‘competent authority’). Until the competent authority has been assigned with carrying out the tasks under this Regulation, the regulatory authority designated by each Member State pursuant to Article 57(1) of Directive (EU) 2019/944 shall carry out the tasks of the competent authority in accordance with this Regulation.

Member States shall, without delay, notify the Commission, ACER, ENISA, the NIS Cooperation Group established pursuant to Article 14 of Directive (EU) 2022/2555 and the Electricity Coordination Group set up under Article 1 of Commission Decision of 15 November 2012 ([^E0004]) and communicate to them the name and the contact details of their competent authority designated pursuant to paragraph 1 of this article and any subsequent changes thereto.

Member States may allow their competent authority to delegate tasks assigned to it in this Regulation to other national authorities with the exception of the tasks listed in Article 5. Each competent authority shall monitor the application of this Regulation by the authorities to whom it has delegated tasks. The competent authority shall communicate the name, contact details, assigned tasks and any subsequent changes thereto of the authorities to whom a task has been delegated to the Commission, to ACER, to the Electricity Coordination Group, to ENISA and to the NIS Cooperation Group.

Article 5

Cooperation between relevant authorities and bodies at national level

The competent authorities shall coordinate and ensure appropriate cooperation between the competent authorities responsible for cybersecurity, the cyber crisis management authorities, the NRAs, competent authorities for risk preparedness and CSIRTs for the purpose of the fulfilment of the relevant obligations laid down in this Regulation. The competent authorities shall also coordinate with any other bodies or authorities as determined by each Member State, to ensure efficient procedures and avoid duplications of tasks and obligations. The competent authorities shall be able to instruct the respective NRAs to request ACER for an opinion pursuant to Article 8(3).

Article 6

Terms and conditions or methodologies or plans

TSOs shall develop, in cooperation with the EU DSO entity, proposals for the terms and conditions or methodologies pursuant to paragraph 2, or for plans pursuant to paragraph 3.

The following terms and conditions or methodologies and any amendments thereof shall be subject to approval by all competent authorities:

(a) the cybersecurity risk assessment methodologies pursuant to Article 18(1);

(b) the comprehensive cross-border electricity cybersecurity risk assessment report pursuant to Article 23;

(c) the minimum and advanced cybersecurity controls pursuant to Article 29, the mapping of electricity cybersecurity controls against standards pursuant to Article 34, including minimum and advanced cybersecurity controls in the supply chain in accordance with Article 33;

(d) a cybersecurity procurement recommendation pursuant to Article 35;

(e) the cyber-attacks classification scale methodology pursuant to Article 37(8).

The proposals for the regional cybersecurity risk mitigation plans pursuant to Article 22 shall be subject to approval by all competent authorities of the concerned system operation region.

The proposals for terms and conditions, methodologies listed in paragraph 2, or for plans listed in paragraph 3, shall include a proposed timescale for their implementation and a description of their expected impact on the objectives of this Regulation.

The EU DSO entity may provide a reasoned opinion to the concerned TSOs until 3 weeks before the deadline to submit the proposal for terms and conditions or methodologies or plans to the competent authorities. TSOs responsible for the proposal for terms and conditions or methodologies or plans shall take into consideration the reasoned opinion of the EU DSO entity prior to its submission for competent authorities’ approval. TSOs shall provide reasoning where the EU DSO entity opinion is not taken into account.

When jointly developing terms, conditions and methodologies and plans, the participating TSOs shall closely cooperate. TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO entity, shall regularly inform competent authorities and ACER about the progress of developing the terms and conditions or methodologies, or plans.

Article 7

Voting rules in the TSOs

Where TSOs deciding on proposals for terms and conditions or methodologies are not able to reach an agreement, they shall decide by qualified majority voting. A qualified majority for such proposals shall be calculated as follows:

(a) TSOs representing at least 55 % of the Member States; and

(b) TSOs representing Member States comprising at least 65 % of the population of the Union.

A blocking minority for decisions on proposals for terms and conditions or methodologies listed in Article 6(2) shall include TSOs representing at least four Member States, failing of which the qualified majority shall be deemed attained.

Where TSOs of a system operation region deciding on proposals for plans listed in Article 6(3) are not able to reach an agreement, and where the system operation region concerned is composed of more than five Member States, TSOs shall decide by qualified majority voting. A qualified majority for proposals listed in Article 6(2) shall require the following majority:

(a) TSOs representing at least 72 % of the Member States concerned; and

(b) TSOs representing Member States comprising at least 65 % of the population of the concerned area.

A blocking minority for decisions on proposals for the plans shall include at least a minimum number of TSOs representing more than 35 % of the population of the participating Member States, plus TSOs representing at least one additional Member State concerned, failing of which the qualified majority shall be deemed attained.

For TSO decisions on proposals for terms and conditions or methodologies pursuant to Article 6(2), one vote shall be attributed per Member State. If there is more than one TSO in the territory of a Member State, the Member State shall allocate the voting powers among the TSOs.

If TSOs, in cooperation with the EU DSO entity, fail to submit an initial or amended proposal for terms and conditions or methodologies, or for plans, to the relevant competent authorities within the deadlines set out in this Regulation, they shall provide the relevant competent authorities and ACER with the relevant drafts of the terms and conditions or methodologies, or of the plans. They shall explain what has prevented an agreement. The competent authorities shall jointly take the appropriate steps for the adoption of the required terms and conditions or methodologies, or of the required plans. This may be done for instance by requesting amendments to the drafts pursuant to this paragraph, by revising and completing those drafts, or, where no drafts have been provided, by defining and approving the required terms and conditions or methodologies or plans.

Article 8

Submission of proposals to the competent authorities

TSOs shall submit the proposals for terms and conditions or methodologies, or for plans for approval to the relevant competent authorities within the respective deadlines set out in Articles 18, 23, 29, 33, 34, 35 and 37. The competent authorities may jointly prolong these deadlines in exceptional circumstances, notably in cases where a deadline cannot be met due to circumstances external to the sphere of TSOs or of the EU DSO entity.

Proposals for terms and conditions, methodologies or for plans pursuant to paragraph 1, shall be submitted for information to ACER at the same time that they are submitted to the competent authorities.

Upon a joint request of the NRAs, ACER shall issue an opinion on the proposal for terms and conditions or methodologies, or for the plans, within six months of the receipt of the proposals for terms and conditions or methodologies, or for plans and notify NRAs and competent authorities of the opinion. NRAs, CS-NCAs and any other authorities designated as competent authorities shall coordinate with each other before the NRAs requests an opinion to ACER. ACER may include recommendations in such opinion. ACER shall consult ENISA before issuing an opinion on the proposals listed in Article 6(2).

The competent authorities shall consult and closely cooperate and coordinate with each other in order to reach an agreement on the proposed terms and conditions, methodologies, or plans. Before approving the terms and conditions or methodologies, or the plans, they shall revise and complete the proposals where necessary, after consulting the ENTSO for Electricity and the EU DSO entity, in order to ensure that the proposals are in line with this Regulation and contribute to a high common level of cybersecurity across the Union.

The competent authorities shall decide on the terms and conditions or methodologies or on the plans within six months following the receipt of the terms and conditions or methodologies or of the plans by the relevant competent authority or, where applicable, by the last relevant competent authority concerned.

Where ACER issues an opinion, the relevant competent authorities shall take that opinion into account and shall take their decisions within six months from the receipt of ACER’s opinion.

Where the competent authorities jointly require an amendment to the proposed terms and conditions or methodologies, or the plans, in order to approve them, the TSOs shall develop, in cooperation with the EU DSO entity, a proposal for such amendment to the terms and conditions or methodologies, or the plans. The TSOs shall submit the amended proposal for approval within two months following the request of the competent authorities. The competent authorities shall decide on the amended terms and conditions or methodologies, or plans, within two months following their submission.

Where the competent authorities have not been able to reach an agreement within the period referred to in paragraph 5 or 7, they shall inform the Commission. The Commission may take appropriate steps to make possible the adoption of the required terms and conditions or methodologies, or plans.

TSOs, with the assistance of the ENTSO for Electricity, and the EU DSO entity shall publish the terms and conditions or methodologies, or the plans, on their websites following approval by the relevant competent authorities, except where such information is considered as confidential in accordance with Article 47.

10.

The competent authorities may jointly request proposals for amendments of the approved terms and conditions or methodologies, or of the approved plans, from TSOs and the EU DSO entity and determine a deadline for the submission of those proposals. TSOs, in cooperation with the EU DSO entity, may propose amendments to the competent authorities also on its own initiative. The proposals for amendment to the terms and conditions or methodologies, or for the amendments to the plans, shall be developed and approved in accordance with the procedure set out in this Article.

11.

At least every three years after the first adoption of the respective terms and conditions or methodologies, or the respective adopted plans, TSOs in cooperation with the EU DSO entity, shall review the effectiveness of the adopted terms and conditions or methodologies, or the adopted plans, and shall report the findings of the review to the competent authorities and ACER without undue delay.

Article 9

Consultation

TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO entity shall consult stakeholders, including ACER, ENISA and the competent authority of each Member State, on the draft proposals for terms and conditions or methodologies listed in Article 6(2) and for plans referred to in Article 6(3). The consultation shall last for a period of not less than one month.

The proposals for terms and conditions or methodologies listed in Article 6(2) submitted by the TSOs, in cooperation with the EU DSO entity, shall be published and submitted to consultation at Union level. The proposals for plans listed in Article 6(3) submitted by the relevant TSOs, in cooperation with the EU DSO entity, at regional level shall be submitted to consultation at least at regional level.

TSOs, with the assistance of the ENTSO for Electricity, and the EU DSO Entity responsible for the proposal for terms and conditions or methodologies or plans shall duly take into account the views of stakeholders resulting from the consultations undertaken in accordance with paragraph 1, prior to its submission for regulatory approval. In all cases, a sound justification for including or not including the views resulting from the consultation shall be provided together with the submission and published in a timely manner before or simultaneously with the proposal for terms and conditions or methodologies.

Article 10

Stakeholder involvement

ACER, in close cooperation with ENTSO for Electricity and the EU DSO entity, shall organise stakeholder involvement, including regular meetings with stakeholders to identify problems and propose improvements related to the implementation of this Regulation.

Article 11

Recovery of costs

The costs borne by TSOs and DSOs subject to network tariff regulation and stemming from the obligations laid down in this Regulation, including the costs borne by the ENTSO for Electricity and the EU DSO entity, shall be assessed by the relevant NRA of each Member State.

Costs assessed as reasonable, efficient and proportionate shall be recovered through network tariffs or other appropriate mechanisms, as determined by the relevant NRA.

If requested by the relevant NRAs, TSOs and DSOs referred to in paragraph 1 shall, within a reasonable period determined by the NRA, provide the information necessary to facilitate the assessment of the costs incurred.

Article 12

Monitoring

ACER shall monitor the implementation of this Regulation in accordance with Article 32(1) of Regulation (EU) 2019/943 and Article 4(2) of Regulation (EU) 2019/942. In carrying out this monitoring, ACER may cooperate with ENISA and request support from the ENTSO for Electricity and the EU DSO entity. ACER shall regularly inform the Electricity Coordination Group and the NIS Cooperation Group on the implementation of this Regulation.

ACER shall publish a report at least every three years after the entry into force of this Regulation to:

(a) review the status of implementation of the applicable cybersecurity risk management measures with regard to the high-impact and critical-impact entities;

(b) identify whether additional rules on common requirements, planning, monitoring, reporting and crisis management may be necessary to prevent risks for the electricity sector; and

(c) identify areas of improvement for the revision of this Regulation, or determine uncovered areas and new priorities that may emerge due to technological developments.

By 13 June 2025, ACER, in cooperation with ENISA and after consultation of the ENTSO for Electricity and the EU DSO entity, may issue guidance on the relevant information to be communicated to ACER for the monitoring purposes as well as the process and frequency for the collection, based on the performance indicators defined in accordance with paragraph 5.

The competent authorities may have access to the relevant information held by ACER, which it has collected in accordance with this Article.

ACER in cooperation with ENISA and with the support of the ENTSO for Electricity and the EU DSO entity, shall issue non-binding performance indicators for the assessment of operational reliability that are related to cybersecurity aspects of cross-border electricity flows.

The entities listed in Article 2(1) of this Regulation shall submit to ACER the information required for ACER to perform the tasks listed in paragraph 2.

Article 13

Benchmarking

By 13 June 2025, ACER, in cooperation with ENISA, shall establish a non-binding cybersecurity benchmarking guide. The guide shall explain to NRAs the principles of benchmarking of the implemented cybersecurity controls pursuant to paragraph 2 of this Article, taking into consideration the costs of implementing the controls and the effectiveness of the function played by processes, products, services, systems and solutions used to implement such controls. ACER shall take into account existing benchmarking reports when establishing the non-binding cybersecurity benchmarking guide. ACER shall submit the non-binding cybersecurity benchmarking guide to the NRAs for information.

Within 12 months after the establishment of the benchmarking guide pursuant to paragraph 1, the NRAs shall carry out a benchmarking analysis to assess whether current investments in cybersecurity:

(a) mitigate risks having an impact on cross-border electricity flows;

(b) provide the desired results and engender efficiency gains for the development of the electricity systems;

For the benchmarking analysis, the NRAs may take into account the non-binding cybersecurity benchmarking guide established by ACER, and shall assess in particular:

(a) the average expenditure related to cybersecurity for mitigating risks having an impact on electricity cross-border flows, especially with respect to the high-impact and critical-impact entities;

(b) in cooperation with the ENTSO for Electricity and the EU DSO entity, the average prices of cybersecurity services, systems and products that contribute to a large extent to the enhancement and maintenance of the cybersecurity risk-management measures in the different system operation regions;

(c) the existence and level of comparability of costs and functions of cybersecurity services, systems and solutions suitable for the implementation of this Regulation, identifying possible measures necessary to foster efficiency in spending, particularly where cybersecurity technological investments may be needed.

Any information related to benchmarking analysis shall be handled and processed pursuant to data classification requirements of this Regulation, the minimum cybersecurity controls and the cross-border electricity cybersecurity risk assessment report. The benchmarking analysis referred to in paragraphs 2 and 3 shall not be made public.

Without prejudice to the confidentiality requirements in Article 47 and to the need to protect the security of entities subject to the provisions of this Regulation, the benchmarking analysis referred in paragraphs 2 and 3 of this Article shall be shared with all NRAs, all competent authorities, ACER, ENISA and the Commission.

Article 14

Agreements with TSOs from outside the Union

Within 18 months after the entry into force of this Regulation, TSOs of a system operation region that is neighbouring to a third country shall endeavour to conclude agreements with TSOs of the neighbouring third country that are in accordance with relevant Union law and that set out the basis for cooperation on cybersecurity protection and the cybersecurity cooperation arrangements with those TSOs.

TSOs shall inform the competent authority of the agreements concluded pursuant to paragraph 1.

Article 15

Legal representatives

Entities who do not have an establishment in the Union, but who deliver services to entities in the Union and have been notified as being high-impact or critical-impact entities in accordance with Article 24(6), shall, within three months after the notification, designate, in writing, a representative in the Union and inform the notifying competent authority accordingly.

This representative shall be mandated for the purpose of being addressed by any competent authority or a CSIRT in the Union in addition to or instead of the high-impact or critical-impact entity with regard to the obligations of the entity under this Regulation. The high-impact or critical-impact entity shall provide their legal representative with the necessary powers and sufficient resources to guarantee their efficient and timely cooperation with the relevant competent authorities or CSIRTs.

The representative shall be established in one of the Member States where the entity offers its services. The entity shall be deemed to be under the jurisdiction of the Member State where the representative is established. High-impact or critical-impact entities shall notify the name, postal address, email address and telephone number of their legal representative to the competent authority in the Member State where that legal representative resides or is established.

It shall be possible for the designated legal representative to be held liable for non-compliance with obligations under this Regulation, without prejudice to the liability and legal actions that could be initiated against the high-impact or critical-impact entity itself.

In the absence of a representative within the Union designated under this Article, any Member State in which the entity provides services may take legal action against the entity for non-compliance with the obligations under this Regulation.

The designation of a legal representative within the Union pursuant to paragraph 1 shall not constitute an establishment in the Union.

Article 16

Cooperation between the ENTSO for Electricity and the EU DSO Entity

The ENTSO for Electricity and the EU DSO entity shall cooperate in performing cybersecurity risk assessments pursuant to Article 19 and Article 21, and in particular the following tasks:

(a) development of the cybersecurity risk assessment methodologies pursuant to Article 18(1);

(b) development of the Comprehensive Cross-border electricity cybersecurity risk assessment report pursuant to Article 23;

(d) development of the cybersecurity procurement recommendation pursuant to Article 35;

(e) development of the cyber-attacks classification scale methodology pursuant to Article 37(8);

(f) development of the provisional electricity cybersecurity impact index (‘ECII’) electricity cybersecurity impact index pursuant to Article 48(1) point (a);

(g) development of the consolidated provisional list of high-impact and critical-impact entities pursuant to Article 48(3);

(h) development of the provisional list of Union-wide high-impact and critical-impact processes pursuant to Article 48(4);

(i) development of the provisional list of European and international standards and controls pursuant to Article 48(6);

(j) performance of the Union-wide cybersecurity risk assessment pursuant to Article 19;

(k) performance of the regional cybersecurity risk assessments pursuant to Article 21;

(l) definition of the regional cybersecurity risk mitigation plans pursuant to Article 22;

(m) development of guidance on European cybersecurity certification schemes for ICT products, ICT services, and ICT processes in accordance with Article 36;

(n) development of guidelines for the implementation of this Regulation in consultation with ACER and ENISA.

The cooperation between the ENTSO for Electricity and the EU DSO entity may take the form of a cybersecurity risk working group.

The ENTSO for Electricity and the EU DSO entity shall regularly inform ACER, ENISA, the NIS Cooperation Group and the Electricity Coordination Group on the progress in implementing the Union-wide and regional cybersecurity risk assessments pursuant to Article 19 and Article 21.

Article 17

Cooperation between ACER and the competent authorities

ACER, in cooperation with each competent authority, shall:

(1) monitor the implementation of cybersecurity risk management measures pursuant to Article 12(2) point (a) and reporting obligations pursuant to Article 27 and Article 39; and

(2) monitor the adoption process and the implementation of the terms and conditions, methodologies or plans pursuant to Article 6(2) and (3). The cooperation between ACER, ENISA and each competent authority may take the form of a cybersecurity risk monitoring body.

CHAPTER II RISK ASSESSMENT AND IDENTIFICATION OF THE RELEVANT CYBERSECURITY RISKS

Article 18

Cybersecurity risk assessment methodologies

By 13 March 2025, the TSOs, with the assistance of the ENTSO for Electricity, in cooperation with the EU DSO entity and following a consultation with the NIS Cooperation Group, shall submit a proposal for the cybersecurity risk assessment methodologies at Union level, at regional level and at Member State level.

The cybersecurity risk assessment methodologies at Union level, at regional level and at Member State level shall include:

(a) a list of cyber threats to be considered, including at least the following supply chain threats:
(i) a severe and unexpected corruption of the supply chain;
(ii) the unavailability of ICT products, ICT services, or ICT processes from the supply chain;
(iii) cyber-attacks initiated through actors in the supply chain;
(iv) leaking of sensitive information through the supply chain, including supply chain tracking;
(v) the introduction of weaknesses or backdoors into ICT products, ICT services, or ICT processes through actors in the supply chain;

(b) the criteria to evaluate the impact of cybersecurity risks as high or critical, using defined thresholds for consequences and likelihood;

(c) an approach to analyse the cybersecurity risks coming from legacy systems, the cascading effects of cyber-attacks and the real-time nature of systems operating the grid;

(d) an approach to analyse the cybersecurity risks coming from the dependency on a single supplier of ICT products, ICT services or ICT processes.

The cybersecurity risk assessment methodologies at Union level, at regional level and at Member State level shall assess cybersecurity risks using the same risk impact matrix. The risk impact matrix shall:

(a) measure the consequences of cyber-attacks based on the following criteria:
(i) loss of load;
(ii) reduction of power generation;
(iii) loss of capacity in the primary frequency reserve;
(iv) loss of capacity for restoration of an electric grid to operation without relying on the external transmission network to recover after a total or partial shutdown (also called ‘black start’);
(v) the expected duration of an electricity outage affecting customers in combination with the scale of the outage in customer numbers; and
(vi) any other quantitative or qualitative criteria that could reasonably act as an indicator of the effect of a cyber-attack on cross-border electricity flows;

(b) measure the likelihood of an incident as the frequency of cyber-attacks per year.

The cybersecurity risk assessment methodologies at Union level shall describe how the ECII values for high-impact and critical-impact thresholds will be defined. The ECII shall enable entities to estimate with the help of the criteria referred to in paragraph 2 point (b), the impact of the risks on their business process during the business impact assessments they perform pursuant to Article 26(4) point (c)(i).

The ENTSO for Electricity, in coordination with the EU DSO entity, shall inform the Electricity Coordination Group on the proposals for the cybersecurity risk assessment methodologies that are developed pursuant to paragraph 1.

Article 19

Union-wide cybersecurity risk assessment

Within 9 months after the approval of the cybersecurity risk assessment methodologies pursuant to Article 8 and every three years thereafter, the ENTSO for Electricity, in cooperation with the EU DSO entity and in consultation with the NIS Cooperation Group, shall, without prejudice to Article 22 of Directive (EU) 2022/2555, perform a Union-wide cybersecurity risk assessment and draw up a draft Union-wide cybersecurity risk assessment report. For this purpose, they will use the methodologies developed pursuant to Article 18, and approved pursuant to Article 8, to identify, analyse, and evaluate the possible consequences of cyber-attacks affecting the operational security of the electricity system and disrupting cross-border electricity flows. The Union-wide cybersecurity risk assessment shall not consider the legal, financial or reputational damage of cyber-attacks.

The Union-wide cybersecurity risk assessment report shall include the following elements:

(a) the Union-wide high-impact processes and the Union-wide critical-impact processes;

(b) a risk impact matrix that entities and the competent authorities shall use to assess the cybersecurity risk identified in the cybersecurity risk assessment at Member State level performed pursuant to Article 20 and in the cybersecurity risk assessment at entity level pursuant to Article 26(2) point (b).

With respect to the Union-wide high-impact processes and the Union-wide critical-impact processes, the Union-wide cybersecurity risk assessment report shall include:

(a) an assessment of the possible consequences of a cyber-attack using the metrics defined in the cybersecurity risk assessment methodology developed pursuant to Article 18(2), (3) and (4), and approved pursuant to Article 8;

(b) the ECII and high-impact and critical-impact thresholds that the competent authorities shall use pursuant to Article 24(1) and (2) to identify high-impact and critical-impact entities involved in the Union-wide high-impact processes and in the Union-wide critical-impact processes.

The ENTSO for Electricity, in cooperation with the EU DSO entity, shall submit the draft of the Union-wide cybersecurity risk assessment report with the results of the Union-wide cybersecurity risk assessment to ACER for opinion. ACER shall issue an opinion on the draft report within three months after its receipt. The ENTSO for Electricity and the EU DSO entity shall take utmost account of ACER’s opinion when finalising that report.

Within three months after receipt of ACER’s opinion, the ENTSO for Electricity, in cooperation with the EU DSO entity shall notify the final Union-wide cybersecurity risk assessment report to ACER, the Commission, ENISA and the competent authorities.

Article 20

Member State cybersecurity risk assessment

Each competent authority shall perform a Member State cybersecurity risk assessment on all high-impact and critical-impact entities in its Member State using the methodologies developed pursuant to Article 18 and approved pursuant to Article 8. The Member State cybersecurity risk assessment shall identify and analyse the risks of cyber-attacks affecting the operational security of the electricity system disrupting cross-border electricity flows. The Member State cybersecurity risk assessment shall not consider the legal, financial or reputational damage of cyber-attacks.

Within 21 months after the notification of the high-and critical-impact entities pursuant to Article 24(6) and every three years after that date, and after consulting the CS-NCA responsible for electricity, each competent authority, supported by the CSIRT, shall provide a Member State cybersecurity risk assessment report to the ENTSO for Electricity and the EU DSO entity, containing the following information for each high-impact and critical-impact business process:

(a) the implementation status of the minimum and advanced cybersecurity controls pursuant to Article 29;

(b) a list of all cyber-attacks reported in the previous three years pursuant to Article 38(3);

(d) for each Union-wide high-impact or critical-impact process, an estimate of the risks of a compromise of the confidentiality, integrity and availability for information and relevant assets;

(e) where necessary, a list of additional entities identified as high-impact or critical-impact pursuant to Article 24(1), (2), (3), and (5).

The Member State cybersecurity risk assessment report shall take into account the Member State’s risk preparedness plan established pursuant to Article 10 of Regulation (EU) 2019/941.

The information contained in the Member State cybersecurity risk assessment report pursuant to paragraph 2 points (a) to (d) shall not be linked to specific entities or assets. The Member State cybersecurity risk assessment report shall also include a risk assessment of the temporary derogations issued by the competent authorities in the Member States pursuant to Article 30.

The ENTSO for Electricity and the EU DSO entity may request additional information from the competent authorities in relation to the tasks specified in subparagraph 2 points (a) and (c).

The competent authorities shall ensure that the information they provide is accurate and correct.

Article 21

Regional cybersecurity risk assessments

The ENTSO for Electricity, in cooperation with the EU DSO entity and in consultation with the relevant Regional Coordination Centre, shall perform a regional cybersecurity risk assessment for each system operation region using the methodologies developed pursuant to Article 18, and approved pursuant to Article 8, to identify, analyse, and evaluate the risks of cyber-attacks affecting the operational security of the electricity system and disrupting cross-border electricity flows. The regional cybersecurity risk assessments shall not consider the legal, financial or reputational damage of cyber-attacks.

Within 30 months after the notification of the high-impact and critical-impact entities pursuant to Article 24(6), and every three years after that, the ENTSO for Electricity, in cooperation with the EU DSO entity and in consultation with the NIS Cooperation Group, shall draw up a regional cybersecurity risk assessment report for each system operation region.

The regional cybersecurity risk assessment report shall take into account the relevant information contained in the Union-wide cybersecurity risk assessment reports and in the Member State cybersecurity risk assessments reports.

The regional cybersecurity risk assessment shall consider the regional electricity crisis scenarios related to cybersecurity identified pursuant to Article 6 of the Regulation (EU) 2019/941.

Article 22

Regional cybersecurity risk mitigation plans

Within 36 months after the notification of the high-and critical-impact entities pursuant to Article 24(6) and no later than 13 June 2031, and every three years after that date, the TSOs, with the assistance of the ENTSO for Electricity, in cooperation with the EU DSO entity and in consultation with the Regional Coordination Centres and the NIS Cooperation Group, shall develop a regional cybersecurity risk mitigation plan for each system operation region.

The regional cybersecurity risk mitigation plans shall include:

(a) the minimum and advanced cybersecurity controls that high-impact and critical-impact entities shall apply in the system operation region;

(b) the residual cybersecurity risks in the system operation regions after applying the controls referred to in point (a).

The ENTSO for Electricity shall submit the regional risk mitigation plans to the relevant transmission system operators, to the competent authorities, and to the Electricity Coordination Group. The Electricity Coordination Group may recommend amendments.

The TSOs, with the assistance of the ENTSO for Electricity in cooperation with the EU DSO entity and in consultation with the NIS Cooperation Group shall update the regional risk mitigation plans every three years, unless circumstances warrant more frequent updates.

Article 23

Comprehensive cross-border electricity cybersecurity risk assessment report

Within 40 months after the notification of the high-and critical-impact entities pursuant to Article 24(6) and every three years thereafter, TSOs, with the assistance of the ENTSO for Electricity, in cooperation with the EU DSO entity and in consultation with the NIS Cooperation Group, shall provide to the Electricity Coordination Group a report on the outcome of the assessment of cybersecurity risks with regard to cross-border electricity flows (the ‘comprehensive cross-border electricity cybersecurity risk assessment report’).

The comprehensive cross-border electricity cybersecurity risk assessment report shall be based on the Union-wide cybersecurity risk assessment report, on the Member State cybersecurity risk assessment reports and on the regional cybersecurity risk assessment reports and include the following information:

(a) the list of Union-wide high-impact and critical-impact processes identified in the Union-wide cybersecurity risk assessment report in accordance with Article 19(2) point (a) including the estimation of likelihood and impact of cybersecurity risks evaluated during the regional cybersecurity risk assessment reports pursuant to Article 21(2) and Article 19(3) point (a);

(b) current cyber threats, with a specific focus on emerging threats and risks for the electricity system;

(c) cyber-attacks for the previous period at Union level, providing a critical overview of how such cyber-attacks may have had an impact on electricity cross-border flows;

(d) overall status of implementation of the cybersecurity measures;

(e) status of implementation of the information flows pursuant to Articles 37 and 38;

(f) list of information or specific criteria for classification of information pursuant to Article 46;

(g) identified and highlighted risks that may derive from insecure supply chain management;

(h) results and accumulated experiences from regional and cross-regional cybersecurity exercises organised pursuant to Article 44;

(i) an analysis of the development of the overall cross-border cybersecurity risks in the electricity sector since the last regional cybersecurity risk assessments;

(j) any other information that may be useful to identify possible improvements of this Regulation or the need for a revision of this Regulation or any of its tools; and

(k) aggregated and anonymised information of derogations granted pursuant to Article 30(3).

The entities listed in Article 2(1) may contribute to the development of the comprehensive cross-border electricity cybersecurity risk assessment report, respecting the confidentiality of information in accordance with Article 47. The TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO entity, shall consult these entities from an early stage.

The comprehensive cross-border electricity cybersecurity risk assessment report shall be subject to the rules on protection of exchange of information pursuant to Article 46. Without prejudice to Article 12(4) and Article 47(4), the ENTSO for Electricity and the EU DSO entity shall release a public version of that report which shall not contain information that can cause damage to entities listed in Article 2(1). The public version of this report shall only be released with the agreement of the NIS Cooperation Group and the Electricity Coordination Group. The ENTSO for Electricity in coordination with the EU DSO entity shall be responsible for the compilation and the release of the public version of the report.

Article 24

Identification of high-impact and critical-impact entities

Each competent authority shall identify, by using the ECII and high-impact and critical-impact thresholds included in the Union-wide cybersecurity risk assessment report pursuant to Article 19(3), point (b), the high-impact and critical-impact entities in its Member State that are involved in the Union-wide high-impact and critical-impact processes. The competent authorities can request information from an entity in their Member State to determine the ECII values for that entity. If the determined ECII of an entity is above the high-impact or critical-impact threshold, the identified entity shall be listed in the Member State cybersecurity risk assessment report referred to in Article 20(2).

Each competent authority may identify additional entities in its Member State as high-impact or critical-impact entities if the following criteria are met:

(a) the entity is part of a group of entities for which there is a significant risk that they will be affected simultaneously by a cyber-attack;

(b) the ECII aggregated over the group of entities is above the high-impact or critical-impact threshold.

If a competent authority identifies additional entities in accordance with paragraph 3, all processes at these entities for which the ECII aggregated over the group are above the high-impact threshold shall be considered high-impact processes, and all processes at these entities for which the ECII aggregated over the group are above the critical-impact thresholds shall be considered critical-impact processes.

If a competent authority identifies entities referred to in paragraph 3 point (a) in more than one Member State, it shall inform the other competent authorities, the ENTSO for Electricity and the EU DSO entity. The ENTSO for Electricity in cooperation with the EU DSO entity, based on the information received from all competent authorities, shall provide to the competent authorities an analysis of the aggregation of entities in more than one Member State that can create a distributed disturbance to the cross-border electricity flows, and can result in a cyber-attack. Where a group of entities in several Member States is identified as an aggregation whose ECII is above the high-impact or critical-impact threshold, all concerned competent authorities shall identify the entities in such group as high-impact or critical-impact entities for their respective Member State, based on the aggregated ECII for the group of the entities, and the identified entities shall be listed in the Union-wide cybersecurity risk assessment report.

Each competent authority shall, within nine months after being notified by ENTSO for Electricity and EU DSO entity of the Union-wide cybersecurity risk assessment report pursuant to Article 19(5) and in any case no later than 13 June 2028, notify to the entities on the list that they have been identified as a high-impact or critical-impact entity in its Member State.

When a service provider is reported to a competent authority as being a critical ICT service provider pursuant to Article 27 point (3), that competent authority shall notify it to the competent authorities of the Member States in whose territories the seat or representative is situated. The latter competent authority shall notify the service provider that it has been identified as being a critical service provider.

Article 25

National verification schemes

The competent authorities may establish a national verification scheme to verify that critical-impact entities identified pursuant to Article 24(1) have implemented the national legislative framework that is included in the mapping matrix referred to in Article 34. The national verification scheme may be based on an inspection carried out by the competent authority, independent security audits, or on mutual peer reviews by critical-impact entities in the same Member State supervised by the competent authority.

If a competent authority decides to establish a national verification scheme, that competent authority shall ensure that the verification is performed in accordance with the following requirements:

(a) any party performing the peer review, audit or inspection shall be independent from the critical-impact entity being verified, and shall have no conflicts of interest;

(b) the staff performing the peer review, audit or inspection shall have demonstrable knowledge of:
(i) cybersecurity in the electricity sector;
(ii) cybersecurity management systems;
(iii) the principles of auditing;
(iv) cybersecurity risk assessment;
(v) the common electricity cybersecurity framework;
(vi) the national legislative and regulatory framework and European and international standards in scope of the verification;
(vii) the critical-impact processes in scope of the verification;

(c) the party performing the peer review, audit or inspection shall be allowed sufficient time to perform these activities;

(d) the party performing the peer review, audit or inspection shall take the appropriate measures to protect the information they collect during the verification, in line with its confidentiality level; and

(e) peer reviews, audits or inspections shall be performed at least once every year and cover the full verification scope at least every three years.

If a competent authority decides to establish a national verification scheme, it shall report to ACER on an annual basis how frequently it has carried out inspections under that scheme.

Article 26

Cybersecurity risk management at entity level

Each high-impact and critical-impact entity as identified by the competent authorities pursuant to Article 24(1) shall perform cybersecurity risk management for all its assets in its high-impact and critical-impact perimeters. Each high-impact and critical-impact entity shall perform risk management containing the phases in paragraph 2 every three years.

Each high-impact and critical-impact entity shall base its cybersecurity risk management on an approach that aims to protect their network and information systems and that comprises the following phases:

(a) context establishment;

(b) cybersecurity risk assessment at entity level;

(d) cybersecurity risk acceptance.

During the context establishment phase, each high-impact and critical-impact entity shall:

(a) define the scope of the cybersecurity risk assessment including the high-impact and critical-impact processes identified by the ENTSO for Electricity and the EU DSO entity, and other processes that may be targets of cyber-attacks with a high-impact or critical-impact on cross-border electricity flows; and

(b) define the criteria for risk evaluation and for risk acceptance in accordance with the risk impact matrix that entities and the competent authorities shall use to assess the cybersecurity risks in the cybersecurity risk assessment methodologies at Union level, at regional level and at Member State level developed by the ENTSO for Electricity and the EU DSO entity in accordance with Article 19(2).

During the cybersecurity risk assessment phase, each high-impact and critical-impact entity shall:

(a) identify cybersecurity risks by taking into account:
(i) all assets supporting the Union-wide high-impact and critical-impact processes with an assessment of the possible impact on cross-border electricity flows if the asset is compromised;
(ii) possible cyber threats taking into account the cyber threats identified in the latest Comprehensive cross-border electricity cybersecurity risk assessment report referred to in Article 23 and supply chain threats;
(iii) vulnerabilities, including vulnerabilities in legacy systems;
(iv) possible cyber-attack scenarios, including cyber-attacks affecting the operational security of the electricity system and disrupting cross-border electricity flows;
(v) relevant risk evaluations and assessments carried out at Union level, including coordinated risk assessments of critical supply chains in accordance with Article 22 of Directive (EU) 2022/2555; and
(vi) existing implemented controls;

(b) analyse the likelihood and consequences of the cybersecurity risks identified in point (a) and determine the cybersecurity risk level using the risk impact matrix used to assess cybersecurity risks in cybersecurity risk assessment methodologies at Union level, at regional level and at Member State level developed by TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO entity in accordance with Article 19(2);

(c) classify assets according to the possible consequences when cybersecurity is compromised and determine the high-impact and critical-impact perimeter using the following steps:
(i) perform, for all processes covered by the cybersecurity risk assessment, a business impact assessment using the ECII;
(ii) classify a process as high-impact or critical-impact if its ECII is above the high-impact or critical-impact threshold respectively;
(iii) determine all high-impact and critical-impact assets as the assets needed for the high-impact and critical-impact processes respectively;
(iv) define the high-impact and critical-impact perimeters containing all high-impact and critical-impact assets respectively, so that access to the perimeters may be controlled;

(d) evaluate cybersecurity risks by prioritising them through risk evaluation criteria and risk acceptance criteria referred to in paragraph 3 point (b).

During the cybersecurity risk treatment phase, each high-impact and critical-impact entity shall establish an entity-level risk mitigation plan by selecting risk treatment options appropriate to manage the risks and identify the residual risks.

During the cybersecurity risk acceptance phase, each high-impact and critical-impact entity shall decide whether to accept the residual risk based on the risk acceptance criteria established in paragraph 3 point (b).

Each high-impact and critical-impact entity shall register the assets identified in paragraph 1 in an asset inventory. That asset inventory shall not be part of the risk assessment report.

The competent authority may inspect the assets in the inventory during inspections.

Article 27

Reporting on the risk assessment at entity level

Each high-impact and critical-impact entity shall, within 12 months after the notification of the high-and critical-impact entities pursuant to Article 24(6), and every three years thereafter, provide to the competent authority a report containing the following information:

(1) a list of controls selected for the entity-level risk mitigation plan pursuant to Article 26(5) with the current implementation status of each control;

(2) for each Union-wide high-impact or critical-impact process, an estimate of the risk of a compromise of the confidentiality, integrity, and availability of information and relevant assets. The estimate of this risk shall be given in accordance with the risk impact matrix in Article 19(2);

(3) a list of critical ICT service providers for their critical-impact processes.

CHAPTER III COMMON ELECTRICITY CYBERSECURITY FRAMEWORK

Article 28

Composition, functioning and review of the common electricity cybersecurity framework

The common electricity cybersecurity framework shall be composed of the following controls and cybersecurity management system:

(a) the minimum cybersecurity controls, developed in accordance with Article 29;

(b) the advanced cybersecurity controls, developed in accordance with Article 29;

(c) the mapping matrix, developed in accordance with Article 34, that maps the controls referred to in points (a) and (b) against selected European and international standards and national legislative or regulatory frameworks;

(d) the cybersecurity management system established pursuant to Article 32.

All high-impact entities shall apply the minimum cybersecurity controls pursuant to paragraph 1 point (a) within their high-impact perimeter.

All critical-impact entities shall apply the advanced cybersecurity controls pursuant to paragraph 1 point (b) within their critical-impact perimeter.

Within 7 months after submitting the first draft Union-wide cybersecurity risk assessment report pursuant to Article 19(4), the common electricity cybersecurity framework referred to in paragraph 1 shall be supplemented by the minimum and advanced cybersecurity controls in the supply chain developed pursuant to Article 33.

Article 29

Minimum and advanced cybersecurity controls

Within 7 months after submitting the first draft Union-wide cybersecurity risk assessment report pursuant to Article 19(4), the TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO Entity, shall develop a proposal for minimum and advanced cybersecurity controls.

Within 6 months after drawing up each regional cybersecurity risk assessment report pursuant to Article 21(2) the TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO Entity, shall propose an amendment to the competent authority for the minimum and advanced cybersecurity controls. The proposal will be done in accordance with Article 8(10) and will take into account the risks identified in the regional risk assessment.

The minimum and advanced cybersecurity controls shall be verifiable by taking part in a national verification scheme in accordance with the procedure set out in Article 31 or by undergoing independent third-party security audits performed according to the requirements listed in Article 25(2).

The initial minimum and advanced cybersecurity controls developed pursuant to paragraph (1) shall be based on the risks that are identified in the Union-wide cybersecurity risk assessment report referred to in Article 19(5). The amended minimum and advanced cybersecurity controls developed pursuant to paragraph (2) shall be based on the regional cybersecurity risk assessment report referred to in Article 21(2).

The minimum cybersecurity controls shall include controls to protect the information exchanged pursuant to Article 46.

Within 12 months after the approval of the minimum and advanced cybersecurity controls pursuant to Article 8(5), or after each update pursuant to Article 8(10), the entities listed in Article 2(1) and identified as critical-impact and high-impact entities pursuant to Article 24 shall, during the establishment of the entity-level risk mitigation plan pursuant to Article 26(5), apply the minimum cybersecurity controls within the high-impact perimeter and advanced cybersecurity controls within the critical-impact perimeter.

Article 30

Derogations from the minimum and advanced cybersecurity controls

The entities listed in Article 2(1) may request the respective competent authority to grant a derogation from their obligation to apply the minimum and advanced cybersecurity controls referred to in Article 29(6). The competent authority may grant such a derogation on one of the following grounds:

(a) in exceptional circumstances, where the entity can demonstrate that the costs of implementing the appropriate cybersecurity controls significantly exceed the benefits. ACER and the ENTSO for Electricity in cooperation with the DSO entity may jointly develop a guidance for estimating the costs of cybersecurity controls to help the entities;

(b) where the entity provides an entity-level risk treatment plan that mitigates the cybersecurity risks using alternative controls to a level that is acceptable in accordance with to the risk acceptance criteria referred to Article 26(3), point (b).

Within three months from the receipt of the request referred to in paragraph 1, each competent authority shall decide whether a derogation from the minimum and advanced cybersecurity controls is to be granted. Derogations from the minimum or advanced cybersecurity controls shall be granted for a maximum of three years, with the possibility of renewal.

Aggregated and anonymised information for the derogations granted shall be included as an annex to the comprehensive cross-border electricity cybersecurity risk assessment report referred to in Article 23. The ENTSO for Electricity and the EU DSO entity shall jointly update the list, where necessary.

Article 31

Verification of the common electricity cybersecurity framework

Reading this document does not replace reading the official text published in the Official Journal of the European Union. We assume no responsibility for any inaccuracies arising from the conversion of the original to this format.

This text is published under EUR-Lex's own terms of reuse, not a Legalize or public-domain licence. EUR-Lex
Creative Commons Attribution 4.0 International (CC BY 4.0)
© European Union, https://eur-lex.europa.eu — Source: EUR-Lex (Publications Office of the European Union). Reused under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Only EU legislation published in the printed Official Journal of the European Union is deemed authentic; consolidated texts are reproduced here for documentation purposes and have been reformatted to Markdown.