INFORMATION TECHNOLOGY
Legislative Decree No. 134 of 4 September 2024 on ‘Implementation of Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical players’ published in the Official Gazette.
With the Directive (EU) 2022/2557 (ERC Directive) action is taken to:
achieve an appropriate level of harmonisation in the identification of sectors, sub-sectors and categories of actors that qualify as critical;
strengthen their resilience, understood as their ability to prevent, protect, respond to, mitigate, absorb, adapt to and restore their operational capabilities following incidents that may disrupt the provision of essential services.
Critical Entity: a public or private entity identified within the categories of entities operating in the sectors and sub-sectors set out in Annex A of this provision. Critical Entities are identified in at least the following sectors:
- energy;
- transport;
- banking;
- financial market infrastructure;
- health;
- drinking water;
- waste water;
- digital infrastructure;
- space;
- food production, processing and distribution;
- public administration bodies.
Specifically, Legislative Decree No. 134/2024 establishes:
measures to ensure that services that are essential for the maintenance of vital societal functions, economic activities, public health and safety, or the environment are provided without hindrance, as well as criteria for the identification of critical actors;
obligations on critical actors to strengthen their resilience, to a high level, and to enhance their ability to provide essential services, in the internal market, in order to improve their functioning;
measures to support the fulfilment of obligations imposed on critical actors;
provisions regarding the supervision and imposition of sanctions on critical actors;
Provisions regarding the identification of critical actors of particular European relevance and the European Commission's advisory missions to assess the measures put in place by these actors to fulfil their obligations;
provisions for the preparation of the National Strategy for Critical Subject Resilience;
the regulation of risk assessment by the State and risk assessment by critical actors;
the establishment of the Inter-Ministerial Resilience Committee, as well as the identification of the relevant sectoral authorities and the single point of contact;
the modalities of cooperation with other Member States and the European Commission, including national participation in the critical actors resilience group.
Critical actors' resilience measures.
Critical actors should take and apply appropriate and proportionate technical, security and organisational measures to ensure their own resilience, based on the relevant State risk assessment information provided by the PCU.
The single point of contact (PCU), established within the Presidency of the Council of Ministers, has the functions of:
o ensuring liaison with the European Commission and cooperation with third countries;
o coordinating activities to support critical actors in strengthening their resilience;
o receiving notifications from critical actors, at the same time as the competent authorities, of incidents that disrupt or may significantly disrupt the provision of essential services;
o promote research and training activities on critical infrastructure resilience.
achieve an appropriate level of harmonisation in the identification of sectors, sub-sectors and categories of actors that qualify as critical;
strengthen their resilience, understood as their ability to prevent, protect, respond to, mitigate, absorb, adapt to and restore their operational capabilities following incidents that may disrupt the provision of essential services.
Critical Entity: a public or private entity identified within the categories of entities operating in the sectors and sub-sectors set out in Annex A of this provision. Critical Entities are identified in at least the following sectors:
- energy;
- transport;
- banking;
- financial market infrastructure;
- health;
- drinking water;
- waste water;
- digital infrastructure;
- space;
- food production, processing and distribution;
- public administration bodies.
Specifically, Legislative Decree No. 134/2024 establishes:
measures to ensure that services that are essential for the maintenance of vital societal functions, economic activities, public health and safety, or the environment are provided without hindrance, as well as criteria for the identification of critical actors;
obligations on critical actors to strengthen their resilience, to a high level, and to enhance their ability to provide essential services, in the internal market, in order to improve their functioning;
measures to support the fulfilment of obligations imposed on critical actors;
provisions regarding the supervision and imposition of sanctions on critical actors;
Provisions regarding the identification of critical actors of particular European relevance and the European Commission's advisory missions to assess the measures put in place by these actors to fulfil their obligations;
provisions for the preparation of the National Strategy for Critical Subject Resilience;
the regulation of risk assessment by the State and risk assessment by critical actors;
the establishment of the Inter-Ministerial Resilience Committee, as well as the identification of the relevant sectoral authorities and the single point of contact;
the modalities of cooperation with other Member States and the European Commission, including national participation in the critical actors resilience group.
Critical actors' resilience measures.
Critical actors should take and apply appropriate and proportionate technical, security and organisational measures to ensure their own resilience, based on the relevant State risk assessment information provided by the PCU.
The single point of contact (PCU), established within the Presidency of the Council of Ministers, has the functions of:
o ensuring liaison with the European Commission and cooperation with third countries;
o coordinating activities to support critical actors in strengthening their resilience;
o receiving notifications from critical actors, at the same time as the competent authorities, of incidents that disrupt or may significantly disrupt the provision of essential services;
o promote research and training activities on critical infrastructure resilience.
