Chapter V, Article 37 · Commission Delegated Regulation (EU) 2024/1366

Contents

Article 37Rules on information sharing#

1.If a competent authority receives information related to a reportable cyber-attack, that competent authority:

(a)shall assess the level of confidentiality of that information and inform the entity about the outcome of its assessment without undue delay and not later than within 24 hours of receipt of the information;

(b)shall attempt to find any other similar cyber-attack in the Union reported to other competent authorities, in order to correlate the information received in the context of the reportable cyber-attack with information provided in the context of other cyber-attacks and enrich existing information, strengthen and coordinate cybersecurity responses;

(c)shall be responsible for the removal of business secrets and the anonymisation of the information in accordance with the relevant national and Union rules;

(d)shall share the information with the national single points of contact, CSIRTs and all competent authorities designated pursuant to Article 4 in other Member States without undue delay and no later than 24 hours after the reception of a reportable cyber-attack and provide updated information on a regular basis to those authorities or bodies;

(e)shall disseminate the information of the cyber-attack, after anonymisation and removal of business secrets pursuant to paragraph 1(c), to critical-impact and high-impact entities in its Member State without undue delay and no later than 24 hours after receiving information according to paragraph 1(a), and provide updated information on a regular basis allowing the entities to organise their defence effectively;

(f)may request the reporting high-impact or critical-impact entity to further disseminate the reportable cyber-attack information in a secure manner to other entities that may be affected, with the aim to generate situational awareness by the electricity sector and to prevent the materialisation of a risk that may escalate in a cross-border cybersecurity electricity incident;

(g)shall share with ENISA a summary report, after anonymisation and removal of business secrets, with the information of the cyber-attack.

10.The feasibility study shall address the possibility for such a common tool to:

(a)support critical-impact and high-impact entities with relevant security related information for operations of cross-border electricity flows, such as near real-time reporting of cyber-attacks, early alerts related to cybersecurity matters and undisclosed vulnerabilities on equipment in use in the electricity system;

(b)be maintained in a suitable and highly trustable environment;

(c)allow for data collection from critical-impact and high-impact entities and facilitate removal of confidential information and anonymisation of the data and their prompt dissemination to critical-impact and high-impact entities.

11.The ENTSO for Electricity, in cooperation with the EU DSO entity, shall:

(a)consult ENISA and the NIS Cooperation Group, the national single points of contact and the representatives of main stakeholders when assessing the feasibility;

(b)present the results of the feasibility study to ACER and the NIS Cooperation Group.

12.The ENTSO for Electricity, in cooperation with the EU DSO entity may analyse and facilitate initiatives proposed by critical-impact and high-impact entities to evaluate and test such tools for information sharing.

2.If a CSIRT becomes aware of an unpatched actively exploited vulnerability, it shall:

(a)share it with ENISA via an appropriate secure information exchange channel without delay, unless otherwise specified in other Union law;

(b)support the concerned entity to receive from the manufacturer or provider an effective, coordinated and rapid management of the unpatched actively exploited vulnerability or of effective and efficient mitigation measures;

(c)share available information with the vendor and request the manufacturer or provider, where possible, to identify a list of CSIRTs in Member States concerned by the unpatched actively exploited vulnerability and that shall be informed;

(d)share available information with the CSIRTs identified under the previous point, based on need-to-know principle;

(e)share, where they exist, mitigation strategies and measures to the reported unpatched actively exploited vulnerability.

3.If a competent authority becomes aware of an unpatched actively exploited vulnerability, that competent authority shall:

(a)share, where they exist, mitigation strategies and measures to the reported unpatched actively exploited vulnerability, in coordination with the CSIRTs in its Member State;

(b)shall share the information with a CSIRT in the Member State where the unpatched actively exploited vulnerability has been reported.

4.If the competent authority becomes aware of an unpatched vulnerability, without evidence of yet being actively exploited, it shall without undue delay coordinate with the CSIRT for the purposes of coordinated vulnerability disclosure as laid down in Article 12(1) of Directive (EU) 2022/2555.

5.If a CSIRT receives information related to cyber threats from one or several high-impact or critical-impact entities pursuant to Article 38(6), it shall disseminate that information or any other information of importance for preventing, detecting, responding to or mitigating the related risk to critical-impact and high-impact entities in its Member State and, where appropriate, to all concerned CSIRTs and to its national single point of contact without undue delay and no later than four hours after receiving information.

6.If a competent authority becomes aware of information related to cyber threats from one or several high-impact or critical-impact entities, it shall forward this information to the CSIRT for the purpose of paragraph 5.

7.The competent authorities may delegate in full or in part the responsibilities under paragraphs 3 and 4 concerning one or more high-impact or critical-impact entities that operate in more than one Member State to another competent authority in one of those Member States, following an agreement among the concerned competent authorities.

8.The TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO entity shall develop a cyber-attack classification scale methodology by 13 June 2025. The TSOs, with the assistance of the ENTSO for Electricity and the EU DSO entity may request the competent authorities to consult ENISA and their competent authorities responsible for cybersecurity for assistance in the development of such classification scale. The methodology shall provide the classification for the gravity of a cyber-attack according to five levels, the two highest levels being ‘high’ and ‘critical’. The classification shall be based on the assessment of the following parameters:

(a)the potential impact considering the assets and perimeters exposed determined in accordance with Article 26(4), point (c); and

(b)the severity of the cyber-attack.

9.By 13 June 2026, the ENTSO for Electricity, in collaboration with the EU DSO entity, shall perform a feasibility study to assess the possibility and the financial costs necessary to develop a common tool enabling all entities to share information with relevant national authorities.

Defined terms · 43

Show every defined term

asset
means any information, software or hardware in the network and information systems either tangible or intangible, that has value to an individual, an organisation or a government;
competent authority for risk preparedness
means the competent authority designated pursuant to Article 3 of Regulation (EU) 2019/941;
computer security incident response team
means a team responsible for risk and incident handling in accordance with Article 10 of Directive (EU) 2022/2555;
critical ICT service provider
means an entity which provides an ICT service, or ICT process that is necessary for a critical-impact or high-impact process affecting cybersecurity aspects of cross-border electricity flows and that, if compromised, may cause a cyber-attack with impact above the critical-impact or high-impact threshold;
critical-impact asset
means an asset that is necessary to carry out a critical-impact process;
critical-impact entity
means an entity that carries out a critical-impact process and that is identified by the competent authorities in accordance with Article 24;
critical-impact perimeter
means a perimeter defined by an entity referred to in Article 2(1) that contains all critical-impact assets and on which access to these assets can be controlled and that defines the scope where the advanced cybersecurity controls apply;
critical-impact process
means a business process carried out by an entity for which the electricity cybersecurity impact indices are above the critical-impact threshold;
critical-impact threshold
means the values of the electricity cybersecurity impact indices referred to in Article 19(3)b, above which a cyber-attack on a business process will cause critical disruption of cross-border electricity flows;
cross-border electricity flow
means a cross-border flow as defined in Article 2(3) of Regulation (EU) 2019/943;
cyber threat
means a cyber threat as defined in Article 2, point (8) of Regulation (EU) 2019/881;
cyber-attack
means an incident as defined in Article 3, point (14), of Regulation (EU) 2022/2554;
cybersecurity
means cybersecurity as defined in Article 2, point (1) of Regulation (EU) 2019/881;
cybersecurity control
means the actions or procedures carried out with the purpose of avoiding, detecting, counteracting, or minimising cybersecurity risks;
cybersecurity incident
means an incident as defined in Article 6, point (6) of Directive (EU) 2022/2555;
cybersecurity management system
means the policies, procedures, guidelines, and associated resources and activities, collectively managed by an entity, in the pursuit of protecting its information assets from cyber threats systematically establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organisation’s network and information system security;
cybersecurity operation centre
means a dedicated centre where a technical team consisting of one or more experts, supported by cybersecurity IT systems, performs security-related tasks (Cybersecurity operation center (‘CSOC’) services) such as handling of cyber-attacks and security configuration errors, security monitoring, log analysis, and cyber-attack detection;
cybersecurity vulnerability management
means the practice of identifying and addressing vulnerabilities;
early alert
means the information necessary to indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;
electricity cybersecurity impact index
(‘ECII’) means an index or classification scale that ranks possible consequences of cyber-attacks to business processes involved in cross-border electricity flows;
entity
means entity as defined in Article 6, point (38) of Directive (EU) 2022/2555;
European cybersecurity certification scheme
means a scheme as defined in Article 2, point (9) of Regulation (EU) 2019/881;
high-impact asset
means an asset that is necessary to carry out a high-impact process;
high-impact entity
means an entity that carries out a high-impact process and that is identified by the competent authorities in accordance with Article 24;
high-impact perimeter
means a perimeter defined by any entity listed in Article 2(1) that contains all high-impact assets and on which access to these assets can be controlled and that defines the scope where the minimum cybersecurity controls apply;
high-impact process
means any business process carried out by an entity for which the electricity cybersecurity impact indices are above the high-impact threshold;
high-impact threshold
means the values of the electricity cybersecurity impact indices referred to in Article 19(3)b, above which a successful cyber-attack on a process will cause high disruption of cross-border electricity flows;
legacy system
means a legacy ICT system as defined in Article 3(3) of Regulation (EU) 2022/2554;
national single point of contact
means the single point of contact designated or established by each Member State pursuant to Article 8(3) of Directive (EU) 2022/2555;
originator
means an entity that initiates an information exchange, information sharing or information storage event;
procurement specifications
means the specifications that entities define for the procurement of new or updated ICT products, ICT processes or ICT services;
representative
means a natural or legal person established in the Union who is explicitly designated to act on behalf of a high or critical-impact entity not established in the Union but delivering services to entities in the Union and who may be addressed by a competent authority or a CSIRT in the place of the high or critical-impact entity itself with regard to the obligations of that entity under this Regulation;
risk
means risk as defined in Article 6, point (9) of Directive (EU) 2022/2555;
risk impact matrix
means a matrix used during risk assessment to determine the resulting risk impact level for each risk assessed;
simultaneous electricity crisis
means an electricity crisis as defined in Article 2, point (10) of Regulation (EU) 2019/941;
single point of contact at entity level
means single point of contact at entity level as designated under Article 38(1) point (c);
standard
means a standard as defined in Article 2(1) of Regulation (EU) No 1025/2012 of the European Parliament and of the Council;
system operation region
means the system operation regions as defined in Annex I to ACER Decision 05-2022 on the Definition of System Operation Regions, established in accordance with Article 36 of Regulation (EU) 2019/943;
system operators
means ‘distribution system operator’ (DSO) and ‘transmission system operator’ (TSO) as defined in Articles 2(29) and 2(35) of Directive (EU) 2019/944;
Union-wide critical-impact process
means any electricity sector process, possibly involving multiple entities, for which the possible impact of a cyber-attack may be deemed critical during the performance of the Union-wide cybersecurity risk assessment;
Union-wide high-impact process
means any electricity sector process, possibly involving multiple entities, for which the possible impact of a cyber-attack may be deemed high during the performance of the Union-wide cybersecurity risk assessment;
unpatched actively exploited vulnerability
means a vulnerability, which has not yet been publicly disclosed and patched and for which there is reliable evidence that execution of malicious code was performed by an actor on a system without permission of the system owner;
vulnerability
means a vulnerability as defined in Article 6, point (15) of Directive (EU) 2022/2555.