Chapter I, Article 8 · Commission Delegated Regulation (EU) 2024/1366

Contents

Article 8Submission of proposals to the competent authorities#

1.TSOs shall submit the proposals for terms and conditions or methodologies, or for plans for approval to the relevant competent authorities within the respective deadlines set out in Articles 18, 23, 29, 33, 34, 35 and 37. The competent authorities may jointly prolong these deadlines in exceptional circumstances, notably in cases where a deadline cannot be met due to circumstances external to the sphere of TSOs or of the EU DSO entity.

10.The competent authorities may jointly request proposals for amendments of the approved terms and conditions or methodologies, or of the approved plans, from TSOs and the EU DSO entity and determine a deadline for the submission of those proposals. TSOs, in cooperation with the EU DSO entity, may propose amendments to the competent authorities also on its own initiative. The proposals for amendment to the terms and conditions or methodologies, or for the amendments to the plans, shall be developed and approved in accordance with the procedure set out in this Article.

11.At least every three years after the first adoption of the respective terms and conditions or methodologies, or the respective adopted plans, TSOs in cooperation with the EU DSO entity, shall review the effectiveness of the adopted terms and conditions or methodologies, or the adopted plans, and shall report the findings of the review to the competent authorities and ACER without undue delay.

2.Proposals for terms and conditions, methodologies or for plans pursuant to paragraph 1, shall be submitted for information to ACER at the same time that they are submitted to the competent authorities.

3.Upon a joint request of the NRAs, ACER shall issue an opinion on the proposal for terms and conditions or methodologies, or for the plans, within six months of the receipt of the proposals for terms and conditions or methodologies, or for plans and notify NRAs and competent authorities of the opinion. NRAs, CS-NCAs and any other authorities designated as competent authorities shall coordinate with each other before the NRAs requests an opinion to ACER. ACER may include recommendations in such opinion. ACER shall consult ENISA before issuing an opinion on the proposals listed in Article 6(2).

4.The competent authorities shall consult and closely cooperate and coordinate with each other in order to reach an agreement on the proposed terms and conditions, methodologies, or plans. Before approving the terms and conditions or methodologies, or the plans, they shall revise and complete the proposals where necessary, after consulting the ENTSO for Electricity and the EU DSO entity, in order to ensure that the proposals are in line with this Regulation and contribute to a high common level of cybersecurity across the Union.

5.The competent authorities shall decide on the terms and conditions or methodologies or on the plans within six months following the receipt of the terms and conditions or methodologies or of the plans by the relevant competent authority or, where applicable, by the last relevant competent authority concerned.

6.Where ACER issues an opinion, the relevant competent authorities shall take that opinion into account and shall take their decisions within six months from the receipt of ACER’s opinion.

7.Where the competent authorities jointly require an amendment to the proposed terms and conditions or methodologies, or the plans, in order to approve them, the TSOs shall develop, in cooperation with the EU DSO entity, a proposal for such amendment to the terms and conditions or methodologies, or the plans. The TSOs shall submit the amended proposal for approval within two months following the request of the competent authorities. The competent authorities shall decide on the amended terms and conditions or methodologies, or plans, within two months following their submission.

8.Where the competent authorities have not been able to reach an agreement within the period referred to in paragraph 5 or 7, they shall inform the Commission. The Commission may take appropriate steps to make possible the adoption of the required terms and conditions or methodologies, or plans.

9.TSOs, with the assistance of the ENTSO for Electricity, and the EU DSO entity shall publish the terms and conditions or methodologies, or the plans, on their websites following approval by the relevant competent authorities, except where such information is considered as confidential in accordance with Article 47.

Defined terms · 43

Show every defined term

asset
means any information, software or hardware in the network and information systems either tangible or intangible, that has value to an individual, an organisation or a government;
competent authority for risk preparedness
means the competent authority designated pursuant to Article 3 of Regulation (EU) 2019/941;
computer security incident response team
means a team responsible for risk and incident handling in accordance with Article 10 of Directive (EU) 2022/2555;
critical ICT service provider
means an entity which provides an ICT service, or ICT process that is necessary for a critical-impact or high-impact process affecting cybersecurity aspects of cross-border electricity flows and that, if compromised, may cause a cyber-attack with impact above the critical-impact or high-impact threshold;
critical-impact asset
means an asset that is necessary to carry out a critical-impact process;
critical-impact entity
means an entity that carries out a critical-impact process and that is identified by the competent authorities in accordance with Article 24;
critical-impact perimeter
means a perimeter defined by an entity referred to in Article 2(1) that contains all critical-impact assets and on which access to these assets can be controlled and that defines the scope where the advanced cybersecurity controls apply;
critical-impact process
means a business process carried out by an entity for which the electricity cybersecurity impact indices are above the critical-impact threshold;
critical-impact threshold
means the values of the electricity cybersecurity impact indices referred to in Article 19(3)b, above which a cyber-attack on a business process will cause critical disruption of cross-border electricity flows;
cross-border electricity flow
means a cross-border flow as defined in Article 2(3) of Regulation (EU) 2019/943;
cyber threat
means a cyber threat as defined in Article 2, point (8) of Regulation (EU) 2019/881;
cyber-attack
means an incident as defined in Article 3, point (14), of Regulation (EU) 2022/2554;
cybersecurity
means cybersecurity as defined in Article 2, point (1) of Regulation (EU) 2019/881;
cybersecurity control
means the actions or procedures carried out with the purpose of avoiding, detecting, counteracting, or minimising cybersecurity risks;
cybersecurity incident
means an incident as defined in Article 6, point (6) of Directive (EU) 2022/2555;
cybersecurity management system
means the policies, procedures, guidelines, and associated resources and activities, collectively managed by an entity, in the pursuit of protecting its information assets from cyber threats systematically establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organisation’s network and information system security;
cybersecurity operation centre
means a dedicated centre where a technical team consisting of one or more experts, supported by cybersecurity IT systems, performs security-related tasks (Cybersecurity operation center (‘CSOC’) services) such as handling of cyber-attacks and security configuration errors, security monitoring, log analysis, and cyber-attack detection;
cybersecurity vulnerability management
means the practice of identifying and addressing vulnerabilities;
early alert
means the information necessary to indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;
electricity cybersecurity impact index
(‘ECII’) means an index or classification scale that ranks possible consequences of cyber-attacks to business processes involved in cross-border electricity flows;
entity
means entity as defined in Article 6, point (38) of Directive (EU) 2022/2555;
European cybersecurity certification scheme
means a scheme as defined in Article 2, point (9) of Regulation (EU) 2019/881;
high-impact asset
means an asset that is necessary to carry out a high-impact process;
high-impact entity
means an entity that carries out a high-impact process and that is identified by the competent authorities in accordance with Article 24;
high-impact perimeter
means a perimeter defined by any entity listed in Article 2(1) that contains all high-impact assets and on which access to these assets can be controlled and that defines the scope where the minimum cybersecurity controls apply;
high-impact process
means any business process carried out by an entity for which the electricity cybersecurity impact indices are above the high-impact threshold;
high-impact threshold
means the values of the electricity cybersecurity impact indices referred to in Article 19(3)b, above which a successful cyber-attack on a process will cause high disruption of cross-border electricity flows;
legacy system
means a legacy ICT system as defined in Article 3(3) of Regulation (EU) 2022/2554;
national single point of contact
means the single point of contact designated or established by each Member State pursuant to Article 8(3) of Directive (EU) 2022/2555;
originator
means an entity that initiates an information exchange, information sharing or information storage event;
procurement specifications
means the specifications that entities define for the procurement of new or updated ICT products, ICT processes or ICT services;
representative
means a natural or legal person established in the Union who is explicitly designated to act on behalf of a high or critical-impact entity not established in the Union but delivering services to entities in the Union and who may be addressed by a competent authority or a CSIRT in the place of the high or critical-impact entity itself with regard to the obligations of that entity under this Regulation;
risk
means risk as defined in Article 6, point (9) of Directive (EU) 2022/2555;
risk impact matrix
means a matrix used during risk assessment to determine the resulting risk impact level for each risk assessed;
simultaneous electricity crisis
means an electricity crisis as defined in Article 2, point (10) of Regulation (EU) 2019/941;
single point of contact at entity level
means single point of contact at entity level as designated under Article 38(1) point (c);
standard
means a standard as defined in Article 2(1) of Regulation (EU) No 1025/2012 of the European Parliament and of the Council;
system operation region
means the system operation regions as defined in Annex I to ACER Decision 05-2022 on the Definition of System Operation Regions, established in accordance with Article 36 of Regulation (EU) 2019/943;
system operators
means ‘distribution system operator’ (DSO) and ‘transmission system operator’ (TSO) as defined in Articles 2(29) and 2(35) of Directive (EU) 2019/944;
Union-wide critical-impact process
means any electricity sector process, possibly involving multiple entities, for which the possible impact of a cyber-attack may be deemed critical during the performance of the Union-wide cybersecurity risk assessment;
Union-wide high-impact process
means any electricity sector process, possibly involving multiple entities, for which the possible impact of a cyber-attack may be deemed high during the performance of the Union-wide cybersecurity risk assessment;
unpatched actively exploited vulnerability
means a vulnerability, which has not yet been publicly disclosed and patched and for which there is reliable evidence that execution of malicious code was performed by an actor on a system without permission of the system owner;
vulnerability
means a vulnerability as defined in Article 6, point (15) of Directive (EU) 2022/2555.