- asset
means any information, software or hardware in the network and information systems either tangible or intangible, that has value to an individual, an organisation or a government;
- competent authority for risk preparedness
means the competent authority designated pursuant to Article 3 of Regulation (EU) 2019/941;
- computer security incident response team
means a team responsible for risk and incident handling in accordance with Article 10 of Directive (EU) 2022/2555;
- critical ICT service provider
means an entity which provides an ICT service, or ICT process that is necessary for a critical-impact or high-impact process affecting cybersecurity aspects of cross-border electricity flows and that, if compromised, may cause a cyber-attack with impact above the critical-impact or high-impact threshold;
- critical-impact asset
means an asset that is necessary to carry out a critical-impact process;
- critical-impact entity
means an entity that carries out a critical-impact process and that is identified by the competent authorities in accordance with Article 24;
- critical-impact perimeter
means a perimeter defined by an entity referred to in Article 2(1) that contains all critical-impact assets and on which access to these assets can be controlled and that defines the scope where the advanced cybersecurity controls apply;
- critical-impact process
means a business process carried out by an entity for which the electricity cybersecurity impact indices are above the critical-impact threshold;
- critical-impact threshold
means the values of the electricity cybersecurity impact indices referred to in Article 19(3)b, above which a cyber-attack on a business process will cause critical disruption of cross-border electricity flows;
- cross-border electricity flow
means a cross-border flow as defined in Article 2(3) of Regulation (EU) 2019/943;
- cyber threat
means a cyber threat as defined in Article 2, point (8) of Regulation (EU) 2019/881;
- cyber-attack
means an incident as defined in Article 3, point (14), of Regulation (EU) 2022/2554;
- cybersecurity
means cybersecurity as defined in Article 2, point (1) of Regulation (EU) 2019/881;
- cybersecurity control
means the actions or procedures carried out with the purpose of avoiding, detecting, counteracting, or minimising cybersecurity risks;
- cybersecurity incident
means an incident as defined in Article 6, point (6) of Directive (EU) 2022/2555;
- cybersecurity management system
means the policies, procedures, guidelines, and associated resources and activities, collectively managed by an entity, in the pursuit of protecting its information assets from cyber threats systematically establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organisation’s network and information system security;
- cybersecurity operation centre
means a dedicated centre where a technical team consisting of one or more experts, supported by cybersecurity IT systems, performs security-related tasks (Cybersecurity operation center (‘CSOC’) services) such as handling of cyber-attacks and security configuration errors, security monitoring, log analysis, and cyber-attack detection;
- cybersecurity vulnerability management
means the practice of identifying and addressing vulnerabilities;
- early alert
means the information necessary to indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;
- electricity cybersecurity impact index
(‘ECII’) means an index or classification scale that ranks possible consequences of cyber-attacks to business processes involved in cross-border electricity flows;
- entity
means entity as defined in Article 6, point (38) of Directive (EU) 2022/2555;
- European cybersecurity certification scheme
means a scheme as defined in Article 2, point (9) of Regulation (EU) 2019/881;
- high-impact asset
means an asset that is necessary to carry out a high-impact process;
- high-impact entity
means an entity that carries out a high-impact process and that is identified by the competent authorities in accordance with Article 24;
- high-impact perimeter
means a perimeter defined by any entity listed in Article 2(1) that contains all high-impact assets and on which access to these assets can be controlled and that defines the scope where the minimum cybersecurity controls apply;
- high-impact process
means any business process carried out by an entity for which the electricity cybersecurity impact indices are above the high-impact threshold;
- high-impact threshold
means the values of the electricity cybersecurity impact indices referred to in Article 19(3)b, above which a successful cyber-attack on a process will cause high disruption of cross-border electricity flows;
- legacy system
means a legacy ICT system as defined in Article 3(3) of Regulation (EU) 2022/2554;
- national single point of contact
means the single point of contact designated or established by each Member State pursuant to Article 8(3) of Directive (EU) 2022/2555;
- originator
means an entity that initiates an information exchange, information sharing or information storage event;
- procurement specifications
means the specifications that entities define for the procurement of new or updated ICT products, ICT processes or ICT services;
- representative
means a natural or legal person established in the Union who is explicitly designated to act on behalf of a high or critical-impact entity not established in the Union but delivering services to entities in the Union and who may be addressed by a competent authority or a CSIRT in the place of the high or critical-impact entity itself with regard to the obligations of that entity under this Regulation;
- risk
means risk as defined in Article 6, point (9) of Directive (EU) 2022/2555;
- risk impact matrix
means a matrix used during risk assessment to determine the resulting risk impact level for each risk assessed;
- simultaneous electricity crisis
means an electricity crisis as defined in Article 2, point (10) of Regulation (EU) 2019/941;
- single point of contact at entity level
means single point of contact at entity level as designated under Article 38(1) point (c);
- standard
means a standard as defined in Article 2(1) of Regulation (EU) No 1025/2012 of the European Parliament and of the Council;
- system operation region
means the system operation regions as defined in Annex I to ACER Decision 05-2022 on the Definition of System Operation Regions, established in accordance with Article 36 of Regulation (EU) 2019/943;
- system operators
means ‘distribution system operator’ (DSO) and ‘transmission system operator’ (TSO) as defined in Articles 2(29) and 2(35) of Directive (EU) 2019/944;
- Union-wide critical-impact process
means any electricity sector process, possibly involving multiple entities, for which the possible impact of a cyber-attack may be deemed critical during the performance of the Union-wide cybersecurity risk assessment;
- Union-wide high-impact process
means any electricity sector process, possibly involving multiple entities, for which the possible impact of a cyber-attack may be deemed high during the performance of the Union-wide cybersecurity risk assessment;
- unpatched actively exploited vulnerability
means a vulnerability, which has not yet been publicly disclosed and patched and for which there is reliable evidence that execution of malicious code was performed by an actor on a system without permission of the system owner;
- vulnerability
means a vulnerability as defined in Article 6, point (15) of Directive (EU) 2022/2555.