Chapter V, Article 20 · Regulation (EU, Euratom) 2023/2841

Contents

Article 20Cybersecurity information-sharing arrangements#

1.Union entities may, on a voluntary basis, notify CERT-EU of, and provide it with information on, incidents, cyber threats, near misses and vulnerabilities that affect them. CERT-EU shall ensure that efficient means of communication, with a high level of traceability, confidentiality and reliability, are available for the purpose of facilitating information sharing with the Union entities. When processing notifications, CERT-EU may prioritise the processing of mandatory notifications over voluntary notifications. Without prejudice to Article 12, voluntary notification shall not result in the imposition of any additional obligations upon the reporting Union entity to which it would not have been subject had it not submitted the notification.

2.To perform its mission and tasks conferred pursuant to Article 13, CERT-EU may request Union entities to provide it with information from their respective ICT system inventories, including information relating to cyber threats, near misses, vulnerabilities, indicators of compromise, cybersecurity alerts and recommendations regarding configuration of cybersecurity tools to detect incidents. The requested Union entity shall transmit the requested information, and any subsequent updates thereto, without undue delay.

3.CERT-EU may exchange incident-specific information with Union entities which reveals the identity of the Union entity affected by the incident, provided that the Union entity affected consents. Where a Union entity withholds its consent, it shall provide CERT-EU with reasons substantiating that decision.

4.Union entities shall, upon request, share information with the European Parliament and the Council on the completion of cybersecurity plans.

5.The IICB or CERT-EU, as applicable, shall, upon request, share guidelines, recommendations and calls for action with the European Parliament and the Council.

6.The sharing obligations laid down in this Article shall not extend to:

(a)EUCI;

(b)information the further distribution of which has been excluded by means of a visible marking, unless the sharing thereof with CERT-EU has been explicitly allowed.