Chapter III, Article 33 · Commission Delegated Regulation (EU) 2024/1366

Contents

Article 33Minimum and advanced cybersecurity controls in the supply chain#

1.Within 7 months after submitting the first draft Union-wide cybersecurity risk assessment report pursuant to Article 19(4), the TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO entity, shall develop a proposal for minimum and advanced cybersecurity controls in the supply chain that mitigate the supply chain risks identified in the Union-wide cybersecurity risk assessments, supplementing the minimum and advanced cybersecurity controls developed pursuant to Article 29. The minimum and advanced cybersecurity controls in the supply chain shall be developed together with the minimum and advanced cybersecurity controls pursuant to Article 29. The minimum and advanced cybersecurity controls in the supply chain shall cover the entire lifecycle of all ICT products, ICT services and ICT processes inside the high-impact or critical-impact perimeters of a high-impact or critical-impact entity. The NIS Cooperation Group shall be consulted when developing the proposal for minimum and advanced cybersecurity controls in the supply chain.

2.The minimum cybersecurity controls in the supply chain shall consist of controls for high-impact and critical-impact entities that:

(a)include recommendations for the procurement of ICT products, ICT services, and ICT processes referring to cybersecurity specifications, covering at least:

(i)the background verification checks of the staff of the supplier involved in the supply chain and dealing with sensitive information or with access to the high-impact or critical-impact assets of the entity. Background verification check may include a verification of the identity and background of staff or contractors of an entity in accordance with national law and procedures and relevant and applicable Union law, including Regulation (EU) 2016/679 and Directive (EU) 2016/680 of the European Parliament and of the Council^note. Background checks shall be proportionate and strictly limited to what is necessary. They shall be carried out for the sole purpose of evaluating a potential security risk to the entity concerned. They need to be proportional to business requirements, the classification of the information to be accessed and the perceived risks, and may be performed by the entity itself, by an external company performing a screening, or through a government clearing;

(ii)the processes for secure and controlled design, development and production of ICT products, ICT services and ICT processes, promoting the design and development of ICT products, ICT services, and ICT processes, which include appropriate technical measures to ensure cybersecurity;

(iii)design of network and information systems in which devices are not trusted even when they are within a secure perimeter, require verification of all requests they receive and apply the least privilege principle;

(iv)the access of the supplier to the assets of the entity;

(v)the contractual obligations on the supplier to protect and restrict access to the entity’s sensitive information;

(vi)the underpinning cybersecurity procurement specifications to subcontractors of the supplier;

(vii)the traceability of the application of the cybersecurity specifications from the development through production until delivery of ICT products, ICT services or ICT processes;

(viii)the support for security updates throughout the entire lifetime of ICT products, ICT services or ICT processes;

(ix)the right to audit cybersecurity in the design, development and production processes of the supplier; and

(x)the assessment of the risk profile of the supplier;

(b)require such entities to take into account the procurement recommendations referred to in subparagraph (a) when concluding contracts with suppliers, collaboration partners and other parties in the supply chain, covering ordinary deliveries of ICT products, ICT services and ICT processes as well as unsolicited events and circumstances like termination and transition of contracts in cases of negligence of the contractual partner;

(c)require such entities to take into account the results of relevant coordinated security risk assessments of critical supply chains carried out in accordance with Article 22(1) of Directive (EU) 2022/2555;

(d)include criteria to select and contract suppliers that can meet the cybersecurity specifications as stated in paragraph (a) and that possess a level of cybersecurity appropriate to the cybersecurity risks of the ICT product, ICT service, or ICT processes that the supplier delivers;

(e)include criteria to diversify sources of supply for ICT products, ICT services and ICT processes and reduce the risk of a vendor lock-in;

(f)include criteria to monitor, review or audit the cybersecurity specifications for supplier internal operational processes throughout the entire lifecycle of each ICT product, ICT service and ICT process on a regular basis.

3.For the cybersecurity specifications in the cybersecurity procurement recommendation referred to in paragraph 2, point (a), high-impact or critical-impact entities shall use the principles of procurement pursuant to Directive 2014/24/EU of the European Parliament and of the Council^note, in accordance with Article 35(4), or define their own specifications based on the results of the cybersecurity risk assessment at entity level.

4.The advanced cybersecurity controls in the supply chain shall include controls for critical-impact entities to verify, during procurement, that ICT products, ICT services and ICT processes that will be used as critical-impact assets satisfy the cybersecurity specifications. The ICT product, ICT service or ICT process shall be verified either through a European cybersecurity certification scheme referred to in Article 31 or through verification activities selected and organised by the entity. The depth and coverage of the verification activities shall be sufficient to provide assurance that the ICT product, ICT service or ICT process can be used to mitigate the risks identified in the risk assessment at entity level. The critical-impact entity shall document the steps taken to reduce the risks identified.

5.The minimum and advanced cybersecurity controls in the supply chain shall apply to the procurement of relevant ICT product, ICT services and ICT processes. The minimum and advanced cybersecurity controls of the supply chain will apply to procurement processes in the entities identified as critical-impact and high-impact entities pursuant to Article 24 that starts six months after the adoption or update of the minimum and advanced cybersecurity controls referred to in Article 29.

6.Within 6 months after drawing up each regional cybersecurity risk assessment report pursuant to Article 21(2) the TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO Entity, shall propose an amendment to the competent authority for the minimum and advanced cybersecurity controls in the supply chain. The proposal will be done in accordance with Article 8(10) and will take into account the risks identified in the regional risk assessment.

Defined terms · 43

Show every defined term

asset
means any information, software or hardware in the network and information systems either tangible or intangible, that has value to an individual, an organisation or a government;
competent authority for risk preparedness
means the competent authority designated pursuant to Article 3 of Regulation (EU) 2019/941;
computer security incident response team
means a team responsible for risk and incident handling in accordance with Article 10 of Directive (EU) 2022/2555;
critical ICT service provider
means an entity which provides an ICT service, or ICT process that is necessary for a critical-impact or high-impact process affecting cybersecurity aspects of cross-border electricity flows and that, if compromised, may cause a cyber-attack with impact above the critical-impact or high-impact threshold;
critical-impact asset
means an asset that is necessary to carry out a critical-impact process;
critical-impact entity
means an entity that carries out a critical-impact process and that is identified by the competent authorities in accordance with Article 24;
critical-impact perimeter
means a perimeter defined by an entity referred to in Article 2(1) that contains all critical-impact assets and on which access to these assets can be controlled and that defines the scope where the advanced cybersecurity controls apply;
critical-impact process
means a business process carried out by an entity for which the electricity cybersecurity impact indices are above the critical-impact threshold;
critical-impact threshold
means the values of the electricity cybersecurity impact indices referred to in Article 19(3)b, above which a cyber-attack on a business process will cause critical disruption of cross-border electricity flows;
cross-border electricity flow
means a cross-border flow as defined in Article 2(3) of Regulation (EU) 2019/943;
cyber threat
means a cyber threat as defined in Article 2, point (8) of Regulation (EU) 2019/881;
cyber-attack
means an incident as defined in Article 3, point (14), of Regulation (EU) 2022/2554;
cybersecurity
means cybersecurity as defined in Article 2, point (1) of Regulation (EU) 2019/881;
cybersecurity control
means the actions or procedures carried out with the purpose of avoiding, detecting, counteracting, or minimising cybersecurity risks;
cybersecurity incident
means an incident as defined in Article 6, point (6) of Directive (EU) 2022/2555;
cybersecurity management system
means the policies, procedures, guidelines, and associated resources and activities, collectively managed by an entity, in the pursuit of protecting its information assets from cyber threats systematically establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organisation’s network and information system security;
cybersecurity operation centre
means a dedicated centre where a technical team consisting of one or more experts, supported by cybersecurity IT systems, performs security-related tasks (Cybersecurity operation center (‘CSOC’) services) such as handling of cyber-attacks and security configuration errors, security monitoring, log analysis, and cyber-attack detection;
cybersecurity vulnerability management
means the practice of identifying and addressing vulnerabilities;
early alert
means the information necessary to indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;
electricity cybersecurity impact index
(‘ECII’) means an index or classification scale that ranks possible consequences of cyber-attacks to business processes involved in cross-border electricity flows;
entity
means entity as defined in Article 6, point (38) of Directive (EU) 2022/2555;
European cybersecurity certification scheme
means a scheme as defined in Article 2, point (9) of Regulation (EU) 2019/881;
high-impact asset
means an asset that is necessary to carry out a high-impact process;
high-impact entity
means an entity that carries out a high-impact process and that is identified by the competent authorities in accordance with Article 24;
high-impact perimeter
means a perimeter defined by any entity listed in Article 2(1) that contains all high-impact assets and on which access to these assets can be controlled and that defines the scope where the minimum cybersecurity controls apply;
high-impact process
means any business process carried out by an entity for which the electricity cybersecurity impact indices are above the high-impact threshold;
high-impact threshold
means the values of the electricity cybersecurity impact indices referred to in Article 19(3)b, above which a successful cyber-attack on a process will cause high disruption of cross-border electricity flows;
legacy system
means a legacy ICT system as defined in Article 3(3) of Regulation (EU) 2022/2554;
national single point of contact
means the single point of contact designated or established by each Member State pursuant to Article 8(3) of Directive (EU) 2022/2555;
originator
means an entity that initiates an information exchange, information sharing or information storage event;
procurement specifications
means the specifications that entities define for the procurement of new or updated ICT products, ICT processes or ICT services;
representative
means a natural or legal person established in the Union who is explicitly designated to act on behalf of a high or critical-impact entity not established in the Union but delivering services to entities in the Union and who may be addressed by a competent authority or a CSIRT in the place of the high or critical-impact entity itself with regard to the obligations of that entity under this Regulation;
risk
means risk as defined in Article 6, point (9) of Directive (EU) 2022/2555;
risk impact matrix
means a matrix used during risk assessment to determine the resulting risk impact level for each risk assessed;
simultaneous electricity crisis
means an electricity crisis as defined in Article 2, point (10) of Regulation (EU) 2019/941;
single point of contact at entity level
means single point of contact at entity level as designated under Article 38(1) point (c);
standard
means a standard as defined in Article 2(1) of Regulation (EU) No 1025/2012 of the European Parliament and of the Council;
system operation region
means the system operation regions as defined in Annex I to ACER Decision 05-2022 on the Definition of System Operation Regions, established in accordance with Article 36 of Regulation (EU) 2019/943;
system operators
means ‘distribution system operator’ (DSO) and ‘transmission system operator’ (TSO) as defined in Articles 2(29) and 2(35) of Directive (EU) 2019/944;
Union-wide critical-impact process
means any electricity sector process, possibly involving multiple entities, for which the possible impact of a cyber-attack may be deemed critical during the performance of the Union-wide cybersecurity risk assessment;
Union-wide high-impact process
means any electricity sector process, possibly involving multiple entities, for which the possible impact of a cyber-attack may be deemed high during the performance of the Union-wide cybersecurity risk assessment;
unpatched actively exploited vulnerability
means a vulnerability, which has not yet been publicly disclosed and patched and for which there is reliable evidence that execution of malicious code was performed by an actor on a system without permission of the system owner;
vulnerability
means a vulnerability as defined in Article 6, point (15) of Directive (EU) 2022/2555.