Legislative Observatory
European Parliament
Please fill in this field to find a procedure

Identification and designation of European critical infrastructures and assessment of the need to improve their protection

2006/0276(CNS)

PURPOSE: to create a horizontal framework for the identification of European Critical Infrastructures.

LEGISLATIVE ACT: Council Directive 2008/114/EC on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection.

CONTENT: the Council adopted this Directive following political agreement reached in June 2008. The Directive establishes a procedure for the identification and designation of European critical infrastructures (‘ECIs’), and a common approach to the assessment of the need to improve the protection of such infrastructures in order to contribute to the protection of people. It focuses on the energy and transport sectors.

‘European critical infrastructure’ or ‘ECI’ is defined as critical infrastructure located in Member States the disruption or destruction of which would have a significant impact on at least 2 Member States. The significance of the impact will be assessed in terms of cross-cutting criteria. This includes effects resulting from cross-sector dependencies on other types of infrastructure.

In the Annex, the Directive details the types of infrastructures concerned:

Energy

  • electricity Infrastructures and facilities for generation and transmission of electricity in respect of supply electricity;
  • oil production, refining, treatment, storage and transmission by pipelines;
  • gas production, refining, treatment, storage and transmission by pipelines, LNG terminals.

Transport

  • road transport
  • rail transport
  • air transport
  • inland waterways transport
  • ocean and short-sea shipping and ports.

Evaluation method: ECIs should be identified and designated by means of a common procedure. The evaluation of security requirements for such infrastructures should be done under a common minimum approach. Each Member State must identify potential ECIs which both satisfy cross-cutting and sectoral criteria. The Directive requires each Member State to identify the critical infrastructures which may be designated as an ECI. This procedure shall be implemented by each Member State through the following series of consecutive steps (Annex III).

  • Step 1: each Member State shall apply the sectoral criteria in order to make a first selection of critical infrastructures within a sector.
  • Step 2: each Member State shall apply the definition of critical infrastructure to the potential ECI identified under step 1.
  • Step 3: each Member State shall apply the transboundary element of the definition of ECI to the potential ECI.
  • Step 4: each Member State shall apply the cross-cutting criteria to the remaining potential ECIs.

The cross-cutting criteria shall take into account: the severity of impact; and, for infrastructure providing an essential service, the availability of alternatives; and the duration of disruption/recovery. A potential ECI which does not satisfy the cross-cutting criteria will not be considered to be an ECI. A potential ECI which has passed through this procedure shall only be communicated to the Member States which may be significantly affected by the potential ECI.

The cross-cutting criteria shall comprise the following:

  • casualties criterion (assessed in terms of the potential number of fatalities or injuries);
  • economic effects criterion (assessed in terms of the significance of economic loss and/or degradation of products or services; including potential environmental effects);
  • public effects criterion (assessed in terms of the impact on public confidence, physical suffering and disruption of daily life; including the loss of essential services).

The sectoral criteria shall take into account the characteristics of individual ECI sectors.

Identification: the process of identifying and designating must be completed by 12 January 2011 and reviewed on a regular basis.

The Member State on whose territory a designated ECI is located shall inform the Commission on an annual basis of the number of designated ECIs per sector and of the number of Member States dependent on each designated ECI. Only those Member States that may be significantly affected by an ECI shall know its identity. The Member States on whose territory an ECI is located shall inform the owner/operator of the infrastructure concerning its designation as an ECI. Information concerning the designation of an infrastructure as an ECI shall be classified at an appropriate level.

Operator security plans: the operator security plan (‘OSP’) procedure must identify the critical infrastructure assets of the ECI and which security solutions exist or are being implemented for their protection. The minimum content to be addressed by an ECI OSP procedure is set out in Annex II, and includes conducting a risk analysis based on major threat scenarios, vulnerability of each asset, and potential impact.

Security Liaison Officers: the Security Liaison Officer functions as the point of contact for security related issues between the owner/operator of the ECI and the relevant Member State authority.

Commission support for ECIs: the Commission will support the owners/operators of designated ECIs by providing access to available best practices and methodologies as well as support training and the exchange of information on new technical developments related to critical infrastructure protection.

Sensitive European critical infrastructure protection-related information: the act provides that any person handling classified information pursuant to this Directive on behalf of a Member State or the Commission must have an appropriate level of security vetting. Member States, the Commission and relevant supervisory bodies shall ensure that sensitive European critical infrastructure protection-related information submitted to the Member States or to the Commission is not used for any purpose other than the protection of critical infrastructures.

Review: a review of this Directive shall begin on 12 January 2012. If deemed appropriate and in conjunction with the review, subsequent sectors to be used for the purpose of implementing this Directive may be identified. Priority shall be given to the ICT sector.

Implementation: 12/01/2011.

ENTRY INTO FORCE: 12/01/2009.