Report assessing the consistency of the approaches taken by Member States in the identification of operators of essential services in accordance with Article 23(1) of Directive 2016/1148/EU

Summary:

Report presented on 28 October 2019 by the European Commission assessing the consistency of the approaches taken by Member States in the identification of operators of essential services relating to security of network and information systems.

Further information:

Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union (the NIS Directive) is the first internal market instrument aimed at improving the resilience of the EU against cyber-security risks. The Directive aims at ensuring the continuity of services by introducing concrete measures building cyber-security capabilities across the EU and mitigating growing threats to network and information systems used to provide essential services in key sectors.

Following its entry into force in August 2016, Member States had until 9 May 2018 to adopt national measures necessary to comply with the provisions of the NIS Directive. This report assesses the consistency of the approaches taken by Member States in the identification of operators of essential services. As the consistency of OES identification and the risk of fragmentation in the internal market in this area are closely linked, this report will also feed into the wider assessment of the NIS Directive.