Identification and designation of European critical infrastructures and assessment of the need to improve their protection

This document presents the main preliminary findings of the review of the European Programme for Critical Infrastructure Protection (EPCIP) and in particular Directive 2008/114/EC on the identification and designation of European Critical Infrastructures.

It provides a general analysis of the elements of the critical infrastructure protection programme and describes the on-going development of risk assessment methodology in this field.

In addition, it contains the required annual reporting on EPCIP’s external dimension.

The report states that the review of the different EPCIP elements so far implemented has already led to a number of important findings for the preparation of a reshaped CIP policy package. All Member States have legally implemented Directive 2008/114/EC by establishing a process to identify and designate European Critical Infrastructures, which has contributed to raising CIP awareness in the EU and in the Member States. Furthermore, although there is evidence that the Directive has also helped in assessing the need to improve the protection of European critical infrastructures in the transport and energy sectors, there is no indication that it has actually improved security in these sectors.