Chapter II, Article 24 · Commission Delegated Regulation (EU) 2024/1366

Contents

Article 24Identification of high-impact and critical-impact entities#

1.Each competent authority shall identify, by using the ECII and high-impact and critical-impact thresholds included in the Union-wide cybersecurity risk assessment report pursuant to Article 19(3), point (b), the high-impact and critical-impact entities in its Member State that are involved in the Union-wide high-impact and critical-impact processes. The competent authorities can request information from an entity in their Member State to determine the ECII values for that entity. If the determined ECII of an entity is above the high-impact or critical-impact threshold, the identified entity shall be listed in the Member State cybersecurity risk assessment report referred to in Article 20(2).

2.Each competent authority shall identify, by using the ECII and high-impact and critical-impact thresholds included in the Union-wide cybersecurity risk assessment report pursuant to Article 19(3), point (b), the high-impact and critical-impact entities not established in the Union in so far they are active within the Union. The competent authority may request information from an entity not established in the Union to determine the ECII values for the entity.

3.Each competent authority may identify additional entities in its Member State as high-impact or critical-impact entities if the following criteria are met:

(a)the entity is part of a group of entities for which there is a significant risk that they will be affected simultaneously by a cyber-attack;

(b)the ECII aggregated over the group of entities is above the high-impact or critical-impact threshold.

4.If a competent authority identifies additional entities in accordance with paragraph 3, all processes at these entities for which the ECII aggregated over the group are above the high-impact threshold shall be considered high-impact processes, and all processes at these entities for which the ECII aggregated over the group are above the critical-impact thresholds shall be considered critical-impact processes.

5.If a competent authority identifies entities referred to in paragraph 3 point (a) in more than one Member State, it shall inform the other competent authorities, the ENTSO for Electricity and the EU DSO entity. The ENTSO for Electricity in cooperation with the EU DSO entity, based on the information received from all competent authorities, shall provide to the competent authorities an analysis of the aggregation of entities in more than one Member State that can create a distributed disturbance to the cross-border electricity flows, and can result in a cyber-attack. Where a group of entities in several Member States is identified as an aggregation whose ECII is above the high-impact or critical-impact threshold, all concerned competent authorities shall identify the entities in such group as high-impact or critical-impact entities for their respective Member State, based on the aggregated ECII for the group of the entities, and the identified entities shall be listed in the Union-wide cybersecurity risk assessment report.

6.Each competent authority shall, within nine months after being notified by ENTSO for Electricity and EU DSO entity of the Union-wide cybersecurity risk assessment report pursuant to Article 19(5) and in any case no later than 13 June 2028, notify to the entities on the list that they have been identified as a high-impact or critical-impact entity in its Member State.

7.When a service provider is reported to a competent authority as being a critical ICT service provider pursuant to Article 27 point (3), that competent authority shall notify it to the competent authorities of the Member States in whose territories the seat or representative is situated. The latter competent authority shall notify the service provider that it has been identified as being a critical service provider.

Defined terms · 43

Show every defined term

asset
means any information, software or hardware in the network and information systems either tangible or intangible, that has value to an individual, an organisation or a government;
competent authority for risk preparedness
means the competent authority designated pursuant to Article 3 of Regulation (EU) 2019/941;
computer security incident response team
means a team responsible for risk and incident handling in accordance with Article 10 of Directive (EU) 2022/2555;
critical ICT service provider
means an entity which provides an ICT service, or ICT process that is necessary for a critical-impact or high-impact process affecting cybersecurity aspects of cross-border electricity flows and that, if compromised, may cause a cyber-attack with impact above the critical-impact or high-impact threshold;
critical-impact asset
means an asset that is necessary to carry out a critical-impact process;
critical-impact entity
means an entity that carries out a critical-impact process and that is identified by the competent authorities in accordance with Article 24;
critical-impact perimeter
means a perimeter defined by an entity referred to in Article 2(1) that contains all critical-impact assets and on which access to these assets can be controlled and that defines the scope where the advanced cybersecurity controls apply;
critical-impact process
means a business process carried out by an entity for which the electricity cybersecurity impact indices are above the critical-impact threshold;
critical-impact threshold
means the values of the electricity cybersecurity impact indices referred to in Article 19(3)b, above which a cyber-attack on a business process will cause critical disruption of cross-border electricity flows;
cross-border electricity flow
means a cross-border flow as defined in Article 2(3) of Regulation (EU) 2019/943;
cyber threat
means a cyber threat as defined in Article 2, point (8) of Regulation (EU) 2019/881;
cyber-attack
means an incident as defined in Article 3, point (14), of Regulation (EU) 2022/2554;
cybersecurity
means cybersecurity as defined in Article 2, point (1) of Regulation (EU) 2019/881;
cybersecurity control
means the actions or procedures carried out with the purpose of avoiding, detecting, counteracting, or minimising cybersecurity risks;
cybersecurity incident
means an incident as defined in Article 6, point (6) of Directive (EU) 2022/2555;
cybersecurity management system
means the policies, procedures, guidelines, and associated resources and activities, collectively managed by an entity, in the pursuit of protecting its information assets from cyber threats systematically establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organisation’s network and information system security;
cybersecurity operation centre
means a dedicated centre where a technical team consisting of one or more experts, supported by cybersecurity IT systems, performs security-related tasks (Cybersecurity operation center (‘CSOC’) services) such as handling of cyber-attacks and security configuration errors, security monitoring, log analysis, and cyber-attack detection;
cybersecurity vulnerability management
means the practice of identifying and addressing vulnerabilities;
early alert
means the information necessary to indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;
electricity cybersecurity impact index
(‘ECII’) means an index or classification scale that ranks possible consequences of cyber-attacks to business processes involved in cross-border electricity flows;
entity
means entity as defined in Article 6, point (38) of Directive (EU) 2022/2555;
European cybersecurity certification scheme
means a scheme as defined in Article 2, point (9) of Regulation (EU) 2019/881;
high-impact asset
means an asset that is necessary to carry out a high-impact process;
high-impact entity
means an entity that carries out a high-impact process and that is identified by the competent authorities in accordance with Article 24;
high-impact perimeter
means a perimeter defined by any entity listed in Article 2(1) that contains all high-impact assets and on which access to these assets can be controlled and that defines the scope where the minimum cybersecurity controls apply;
high-impact process
means any business process carried out by an entity for which the electricity cybersecurity impact indices are above the high-impact threshold;
high-impact threshold
means the values of the electricity cybersecurity impact indices referred to in Article 19(3)b, above which a successful cyber-attack on a process will cause high disruption of cross-border electricity flows;
legacy system
means a legacy ICT system as defined in Article 3(3) of Regulation (EU) 2022/2554;
national single point of contact
means the single point of contact designated or established by each Member State pursuant to Article 8(3) of Directive (EU) 2022/2555;
originator
means an entity that initiates an information exchange, information sharing or information storage event;
procurement specifications
means the specifications that entities define for the procurement of new or updated ICT products, ICT processes or ICT services;
representative
means a natural or legal person established in the Union who is explicitly designated to act on behalf of a high or critical-impact entity not established in the Union but delivering services to entities in the Union and who may be addressed by a competent authority or a CSIRT in the place of the high or critical-impact entity itself with regard to the obligations of that entity under this Regulation;
risk
means risk as defined in Article 6, point (9) of Directive (EU) 2022/2555;
risk impact matrix
means a matrix used during risk assessment to determine the resulting risk impact level for each risk assessed;
simultaneous electricity crisis
means an electricity crisis as defined in Article 2, point (10) of Regulation (EU) 2019/941;
single point of contact at entity level
means single point of contact at entity level as designated under Article 38(1) point (c);
standard
means a standard as defined in Article 2(1) of Regulation (EU) No 1025/2012 of the European Parliament and of the Council;
system operation region
means the system operation regions as defined in Annex I to ACER Decision 05-2022 on the Definition of System Operation Regions, established in accordance with Article 36 of Regulation (EU) 2019/943;
system operators
means ‘distribution system operator’ (DSO) and ‘transmission system operator’ (TSO) as defined in Articles 2(29) and 2(35) of Directive (EU) 2019/944;
Union-wide critical-impact process
means any electricity sector process, possibly involving multiple entities, for which the possible impact of a cyber-attack may be deemed critical during the performance of the Union-wide cybersecurity risk assessment;
Union-wide high-impact process
means any electricity sector process, possibly involving multiple entities, for which the possible impact of a cyber-attack may be deemed high during the performance of the Union-wide cybersecurity risk assessment;
unpatched actively exploited vulnerability
means a vulnerability, which has not yet been publicly disclosed and patched and for which there is reliable evidence that execution of malicious code was performed by an actor on a system without permission of the system owner;
vulnerability
means a vulnerability as defined in Article 6, point (15) of Directive (EU) 2022/2555.