Identification and designation of European critical infrastructures and assessment of the need to improve their protection

The Council adopted conclusions emphasising that the ultimate responsibility of the Member States for managing arrangements for the protection of critical infrastructures within their national borders. At the same time, the Council reiterates that action at European Community level will add value by supporting and complementing Member States' activities, while respecting the principle of subsidiarity and taking due account of available budgetary resources as defined in the Financial Framework 2007 - 2013. Member States’ responsibility includes, with due regard for existing Community competences, risk analysis and threat assessment in relation to European critical infrastructure situated in their territory, interfacing with its owners/operators, and exchanging information with the Commission on a summary basis.

The Council welcomes the efforts of the Commission to develop a European procedure for the identification and designation of European Critical Infrastructure and the assessment of the need to improve its protection. This procedure should be based on adequate definitions and take into account cross-cutting as well as sectoral criteria, with a view to focusing its actions on those infrastructures damage to or destruction of which would have critical consequences. The Council considers in particular that such a procedure, established with due regard for the competences of the Member States and of the Community, could be of added value.

Owners/operators of European Critical Infrastructure, including the private sector, must be actively involved. They should - by a variety of means and arrangements including voluntary measures - take proper measures to protect their infrastructures. Such measures could be security plans and security liaison officers. The costs to owners and operators of taking these measures should be proportionate and reasonable.

The Council stresses that the greatest possible use should be made of recommendations, information sharing and exchange of best practice at EC level in order to promote voluntary protection measures by the owners/operators of European Critical Infrastructures. The Council will examine the added value of further measures with a view to ensuring security standards in the European Union and comparable competition conditions throughout the European Union. The Council stresses the need for any framework to be clear and consistent; duplications of or contradictions between different measures, acts or provisions must be avoided.

Where the exchange of sensitive or classified information in any group or body is indispensable for the implementation of a European Programme for Critical Infrastructure Protection, the provisions set up in the appropriate security procedures and regulations must be strictly observed.

The Council encourages Member States to launch any appropriate action for the protection of critical infrastructures. The Council recognises that existing actions by Member States are conducted through a variety of means and will pay particular attention to the question of how future measures for protecting European Critical Infrastructures can enable this approach to continue under a common framework. Member States may decide to take up the Commission's offer to provide critical infrastructure protection relevant support and research results generated at EC level or by Member States.

The Council intends to continue its discussion about the Commission communication including the Action plan and the Commission proposal for a Directive in the spirit of the abovementioned conclusions.