CER and NIS2 – who, what, when
CER complements NIS2 by focusing on operational resilience, while NIS2 targets network and information system security.
What is CER Directive (Critical Entities Resilience)
Purpose: The CER Directive aims to strengthen the resilience and protection of critical entities that provide essential services across the EU, particularly against cyber, physical, and hybrid threats.
Entry into Force: Critical entities must be identified by 17 July 2026.
Who must comply:
- Energy: Electricity, oil, heating, hydrogen, and gas subsectors
- Transport: Air, rail, water, road, and public transport subsectors
- Banking: Credit institutions
- Financial market infrastructure: Trading venues, central counterparties subsectors
- Health: Healthcare providers, research labs, pharmaceutical operations and manufacturing, medical device manufacturing, and medicinal product distribution
- Drinking water: Drinking water supply and distribution
- Waste water: Sewage treatment and disposal, waste water collection
- Digital infrastructure: IXP, DNS service providers, TLD name registries, cloud computing services, data center service providers, content delivery networks, trust service providers, electronic communications networks
- Public administration: Government services, public administration of central governments
- Space: Ground-based infrastructures that support space-based service providers
- Food: Production, processing, distribution, supply chain, and wholesale distribution
Key Objectives:
- Enhance cyber and physical resilience of critical infrastructure.
- Improve risk assessment practices at both national and organizational levels.
- Address cross-border impacts and foster cooperation among Member States.
Obligations for Critical Entities:
- Perform risk assessments
- Report incidents within 24 hours
- Undergo inspections, audits, and comply with directives
- Enforcement: Managed by national competent authorities. The Critical Entities Resilience Group (CERG) supports EU-wide coordination.
- Relation to NIS2: CER complements NIS2 by focusing on operational resilience, while NIS2 targets network and information system security.
What is NIS2?
The NIS2 Directive (Directive (EU) 2022/2555) is a European Union law that sets minimum cybersecurity requirements for critical infrastructure companies across the EU. It replaces the original NIS Directive and takes effect on October 18, 2024.
Purpose:
To improve and harmonize cybersecurity standards across EU Member States and reduce fragmentation from the original NIS.
Who must comply?
Organizations that meet all three criteria:
- Operate in the EU
- Have over 50 employees and €10M+ revenue
- Belong to critical sectors, such as:
- Energy, Transport, Banking, Health, Water
- ICT, Digital infrastructure, Public administration
- Food, Chemicals, Manufacturing, Space, etc.
Entities are categorized as:
- Essential: Larger, high-impact organizations
- Important: Smaller or medium-sized but still critical
Key Requirements:
- Implement cybersecurity risk-management measures
- Report significant incidents to national CSIRTs
- Manage supply chain risks
- Ensure top-level management accountability
- Maintain compliance documentation and regular audits
Reporting Duties:
Entities must submit:
- Early warning
- Incident notification
- Intermediate, final, and progress reports
Penalties for Non-Compliance:
- Essential entities: Up to €10M or 2% of global turnover
- Important entities: Up to €7M or 1.4% of global turnover
Top Management Liability:
Executives are directly responsible for cybersecurity compliance.
See our product
Unique electronic key system offers the highest level of security on the market.