Operator of Essential Services

From CIPedia
Jump to navigation Jump to search

Definitions

European Definitions

European Commission

Operator of essential services means a public or private entity of a type referred to in Annex II [of the EU Directive 2016/1148], which meets the criteria laid down in Article 5(2).

Operador de Serviços Essenciais: Uma entidade pública ou privada pertencente a um dos tipos referidos no anexo II da Diretiva (UE) n.º 2016/1148 do Parlamento Europeu e do Conselho, de 6 de julho de 2016, e que cumpre os critérios previstos no n.º 2 do artigo 5.º, da mesma Diretiva. [1]

Annex II of the Directive contains the list of essential ICT-controlled / ICT-based services: energy (power, gas, oil), transport (air, rail, water, road), banking, financial market infrastructures, health sector, drinking water supply & distribution, and Digital Infrastructure (IXPs, DNS service providers, TLD name registries).
Article 5(2): The criteria for the identification of the operators of essential services shall be as follows: (a) an entity provides a service which is essential for the maintenance of critical societal and/or economic activities; (b) the provision of that service depends on network and information systems; and (c) an incident would have significant disruptive effects on the provision of that service.
Article 5(2) The criteria for the identification of the operators of essential services shall be as follows:

  1. (a) an entity provides a service which is essential for the maintenance of critical societal and/or economic activities;
  2. (b) the provision of that service depends on network and information systems; and
  3. (c) an incident would have significant disruptive effects on the provision of that service.


ANNEX II Table
Sector Subsector Type of entity
Energy Electricity Electricity undertakings as defined in point (35) of Article 2 of Directive 2009/72/EC of the European Parliament and of the Council [2], which carry out the function of ‘supply’ as defined in point (19) of Article 2 of that Directive
Distribution system operators as defined in point (6) of Article 2 of Directive 2009/72/EC
Transmission system operators as defined in point (4) of Article 2 of Directive 2009/72/EC
Oil Operators of oil transmission pipelines
Operators of oil production, refining and treatment facilities, storage and transmission
Gas Supply undertakings as defined in point (8) of Article 2 of Directive 2009/73/EC of the European Parliament and of the Council [3]
Distribution system operators as defined in point (6) of Article 2 of Directive 2009/73/EC
Transmission system operators as defined in point (4) of Article 2 of Directive 2009/73/EC
Storage system operators as defined in point (10) of Article 2 of Directive 2009/73/EC
LNG system operators as defined in point (12) of Article 2 of Directive 2009/73/EC
Natural gas undertakings as defined in point (1) of Article 2 of Directive 2009/73/EC
Operators of natural gas refining and treatment facilities
Transport Air transport Air carriers as defined in point (4) of Article 3 of Regulation (EC) No 300/2008 of the European Parliament and of the Council
Airport managing bodies as defined in point (2) of Article 2 of Directive 2009/12/EC of the European Parliament and of the Council ( 4), airports as defined in point (1) of Article 2 of that Directive, including the core airports listed in Section 2 of Annex II to Regulation (EU) No 1315/2013 of the European Parliament and of the Council ( 5), and entities operating ancillary installations contained within airports
Traffic management control operators providing air traffic control (ATC) services as defined in point (1) of Article 2 of Regulation (EC) No 549/2004 of the European Parliament and of the Council
Rail transport Infrastructure managers as defined in point (2) of Article 3 of Directive 2012/34/EU of the European Parliament and of the Council
Railway undertakings as defined in point (1) of Article 3 of Directive 2012/34/EU, including operators of service facilities as defined in point (12) of Article 3 of Directive 2012/34/EU
Water transport Inland, sea and coastal passenger and freight water transport companies, as defined for maritime transport in Annex I to Regulation (EC) No 725/2004 of the European Parliament and of the Council ( 8), not including the individual vessels operated by those companies
Managing bodies of ports as defined in point (1) of Article 3 of Directive 2005/65/EC of the European Parliament and of the Council ( 9), including their port facilities as defined in point (11) of Article 2 of Regulation (EC) No 725/2004, and entities operating works and equipment contained within ports
Operators of vessel traffic services as defined in point (o) of Article 3 of Directive 2002/59/EC of the European Parliament and of the Council
Road transport Road authorities as defined in point (12) of Article 2 of Commission Delegated Regulation (EU) 2015/962 ( 11) responsible for traffic management control
Operators of Intelligent Transport Systems as defined in point (1) of Article 4 of Directive 2010/40/EU of the European Parliament and of the Council
Banking Credit institutions as defined in point (1) of Article 4 of Regulation (EU) No 575/2013 of the European Parliament and of the Council
Financial market infrastructures Operators of trading venues as defined in point (24) of Article 4 of Directive 2014/65/EU of the European Parliament and of the Council
Central counterparties (CCPs) as defined in point (1) of Article 2 of Regulation (EU) No 648/2012 of the European Parliament and of the Council
Health sector Health care settings (including hospitals and private clinics) Healthcare providers as defined in point (g) of Article 3 of Directive 2011/24/EU of the European Parliament and of the Council
Drinking water supply and distribution Suppliers and distributors of water intended for human consumption as defined in point (1)(a) of Article 2 of Council Directive 98/83/EC ( 17) but excluding distributors for whom distribution of water for human consumption is only part of their general activity of distributing other commodities and goods which are not considered essential services
Digital infrastructure IXPs
DNS service providers
TLD name registries

National Definitions

Austria

„Betreiber wesentlicher Dienste“ eine öffentliche oder private Einrichtung einer in Anhang II genannten Art, die den Kriterien des Artikels 5 Absatz 2 entspricht. [4]


OES: Energy, Transport, Banks, Financial infrastructure, Health, Drinking water, Digital infrastructure

Wesentliche Dienste und Sicherheitsvorfälle: Energie, Verkehr, Bankwesen, Finanzinfrastrukturen, Gesundheitswesen, Trinkwasserversorgung, Digitale infrastruktur) [5]



Belgium

„Aanbieder van essentiële diensten”: een publieke of private entiteit waarvan de soort is vermeld in bijlage II en die voldoet aan de criteria van artikel 5, lid 2. [6]

«Opérateur de services essentiels»: une entité publique ou privée dont le type figure à l'annexe II et qui répond aux critères énoncés à l'article 5, paragraphe 2. [7]

„Betreiber wesentlicher Dienste“ eine öffentliche oder private Einrichtung einer in Anhang II genannten Art, die den Kriterien des Artikels 5 Absatz 2 entspricht. [8]



Benin

Opérateur d’Infrastructure d’Information Critique : Opérateur public ou privé qui opère une infrastructure d’information critique. [9]



Bulgaria

„оператор на основни услуги“ означава публичен или частен субект от посочените в приложение II категории, който отговаря на критериите, определени в член 5, параграф 2. [10]

The list of OES are the same listed out in the NIS Directive. [11]

Congo

Opérateur de service essentiel: opérateur public ou privé qui fournit un service essentiel. [12]



Croatia

„Operator ključne usluge” znači javni ili privatni subjekt tipa navedenog u Prilogu II., koji ispunjava kriterije utvrđene u članku 5. stavku 2. [13]



Cyprus

«φορέας εκμετάλλευσης βασικών υπηρεσιών»: δημόσια ή ιδιωτική οντότητα είδους αναφερόμενου στο παράρτημα ΙΙ η οποία πληροί τα κριτήρια που ορίζονται στο άρθρο 5 παράγραφος 2. [14]

Additional industries that are considered OESs include electronic communications, wastewater, food, government and national security/ emergency services and environmental. OESs must report any ‘data incidents’ to CSIRT without undue delay. [15]


Czech Republic

„Provozovatelem základních služeb“ veřejný nebo soukromý subjekt, jehož druh je uveden v příloze II a jenž splňuje kritéria stanovené v čl. 5 odst. 2. [16]

Considered additional OES: chemical industry and digital infrastructure. [17]

Denmark

»Operatør af væsentlige tjenester«: en offentlig eller privat enhed af en type som omhandlet i bilag II, der opfylder kriterierne i artikel 5, stk. 2. [18]



Estonia

„Oluliste teenuste operaator“– II lisas osutatud liiki avaliku või erasektori üksus, mis vastab artikli 5 lõikes 2 sätestatud kriteeriumidele. [19]<

Additional OES: electronic communication service providers, public broadcasting, providers of digital identification and digital signing service and district heating service providers. [20]

Finland

’Keskeisten palvelujen tarjoajalla’ julkista tai yksityistä toimijaa, joka on liitteessä II tarkoitettua tyyppiä ja täyttää 5 artiklan 2 kohdassa säädetyt kriteerit. [21]

Considered additional OES: online marketplaces, search engine, cloud providers and other digital infrastructures. [22]

France

«Opérateur de services essentiels»: une entité publique ou privée dont le type figure à l'annexe II et qui répond aux critères énoncés à l'article 5, paragraphe 2. [23]


An operator of critical infrastructure: - exercises activities cited in Article R. 1332-2 and included in a critical sector; - manages or uses for this activity one or more organisations or works, one or more facilities, whose damage, unavailability or destruction due to malicious action, sabotage or terrorism would directly or indirectly seriously compromise the military or economic capabilities, the security or the survival ability of the nation or seriously threaten the lives of its population. [24]


Un opérateur d’importance vitale : exerce des activités mentionnées à l’article R. 1332-2 et comprises dans un secteur d’activités d’importance vitale ; gère ou utilise au titre de cette activité un ou des établissements ou ouvrages, une ou des installations dont le dommage ou l’indisponibilité ou la destruction par suite d’un acte de malveillance, de sabotage ou de terrorisme risquerait, directement ou indirectement d’obérer gravement le potentiel de guerre ou économique, la sécurité ou la capacité de survie de la Nation ou de mettre gravement en cause la santé ou la vie de la population. [25]

Considered OES: industries involved in the civil activities of the State, judicial activities, military activities of the State, food, electronic, audio-visual and information communication, space and research, and finance industries. For non-compliance OES can face an administrative fine either 75,000 EURO, 100,000 EURO or 150,000 EURO. [26]

Germany

„Betreiber wesentlicher Dienste“ eine öffentliche oder private Einrichtung einer in Anhang II genannten Art, die den Kriterien des Artikels 5 Absatz 2 entspricht. [27]

No additional OES have been appointed. [28]

Greece

«φορέας εκμετάλλευσης βασικών υπηρεσιών»: δημόσια ή ιδιωτική οντότητα είδους αναφερόμενου στο παράρτημα ΙΙ η οποία πληροί τα κριτήρια που ορίζονται στο άρθρο 5 παράγραφος 2. [29]



Hungary

„alapvető szolgáltatásokat nyújtó szereplő”: a II. mellékletben említett típusú olyan közjogi vagy magánjogi szervezet, amely megfelel a 5. cikk (2) bekezdésében meghatározott kritériumoknak. [30]



No additional OES have been appointed. Any ‘data incident’ should be reported to the competent authority immediately, however further stipulations on ‘extraordinary incidents’ are described. [31]

Ireland

‘Operator of essential services’ means a public or private entity of a type referred to in Annex II, which meets the criteria laid down in Article 5(2) [of EU 2016/1148]. [32]

: Sectors that revolve around energy, transport, banking, financial market infrastructure, health, water and digital infrastructure are all considered OES. [33]

Italy

«Operatore di servizi essenziali», soggetto pubblico o privato, di un tipo di cui all'allegato II, che soddisfa i criteri di cui all'articolo 5, paragrafo 2. [34]

No additional appointed OES. [35]

Kosovo

Operator of essential services: is an entity fulfilling the following criteria:
a) The entity provides a service which is essential for the maintenance of critical societal and/or economic activities.
b) The provision of that service depends on network and information systems; and
c)An incident would have significant disruptive effects on the provision of that service. [36]


Latvia

“Pamatpakalpojumu sniedzējs” ir tāda veida publiska vai privāta vienība, kā minēts II pielikumā, un kas atbilst 5. panta 2. punktā noteiktajiem kritērijiem. [37]

No additional OES have been appointed. [38]

Lithuania

Esminių paslaugų operatorius– viešojo arba privačiojo sektoriaus subjektas, kurio rūšis yra nurodyta II priede ir kuris tenkina 5 straipsnio 2 dalyje nustatytus kriterijus. [39]

Considered as additional OES are: the industrial sector, chemical and nuclear sub-sector, state administration, civil safety, environmental, national defence and foreign and security affairs. [40]

Luxembourg

«Opérateur de services essentiels»: une entité publique ou privée dont le type figure à l'annexe II et qui répond aux critères énoncés à l'article 5, paragraphe 2. [41]



Malta

“Operatur ta' servizzi essenzjali” tfisser entità pubblika jew privata ta' tip imsemmi fl-Anness II, li jissodisfa l-kriterji stabbiliti fl-Artikolu 5(2). [42]


Mauritania/Mauritanie

Opérateur de service essentiel: opérateur public ou privé qui fournit un service essentiel. [43]


Montenegro

Operatori kritične infrastrukture - državni organi, organi državne uprave, organi lokalne samouprave, organi lokalne uprave i službe obrazovane u skladu sa zakonom kojim se uređuje lokalna samouprava, privredna društva i druga pravna lica koji koriste, odnosno upravljaju sistemima, mrežama, objektima, odnosno njihovim djelovima koji su određeni kao kritična infrastruktura. [44] [45]


Netherlands

„Aanbieder van essentiële diensten”: een publieke of private entiteit waarvan de soort is vermeld in bijlage II en die voldoet aan de criteria van artikel 5, lid 2 [46]

See tables below. For any ‘data incidents’, OES must report without undue delay to National Cyber Security Centre in addition to the relevant competent authority. Significant ‘data incidents' can result in an administrative fine of 5 million euro. In addition, an administrative fine of up to 1 million euro for OES entities that fail to cooperate. [47]

APPOINTED OES (AED in Dutch) according to Art 2 of EU 2016/1148 in the Netherlands [48]
Sector Subsector Type of entity
Energy Electricity
Transmission system operator TenneT (Elektriciteitswet 1998 art 10.2 and 14) [49]
Regional Distribution system operators (Elektriciteitswet 1998 art 10.9, 13.1 and 14) [49]
Gas
Transmission system operator (Gaswet art 2.1 and 5) [50]
Regional Distribution system operators (Gaswet art 2.8 and 5) [50]
Natural gas undertaking 'De Nederlandse Aardolie Maatschappij B.V.'
Oil Stichting Centraal Orgaan Voorraadvorming Aardolieproducten
Operators of oil production, refining and treatment facilities, storage and transmission
Transport Air transport
Royal Schiphol Group NV
Luchtverkeersleiding Nederland
Maastricht Upper Area Control Centre (MUAC)
Koninklijke Marechaussee
Each aircraft operator with over 25% of the total air movements at Schiphol in a year
Harbours
De Divisie Havenmeester van het Havenbedrijf Rotterdam N.V.
Financial Banking The by De Nederlandse Bank N.V. appointed credit companies according to EU 575/2013 art 4.1 (payments and securities trading)
Financial infrastructure Operators of trading platforms as defined in point (24) of Article 4 of Directive 2014/65/EU of the European Parliament and of the Council
Central counterparties (CCPs) as defined in point (1) of Article 2 of Regulation (EU) No 648/2012 of the European Parliament and of the Council
Health sector NO AES NO AES identified - decision of the Ministry of Ministry of Health, Welfare and Sport (VWS) [51]
Drinking water Drinking water supply and distribution Suppliers and distributors of water as defined in the Drinkwaterwet art 1.1. [52]
Digital infrastructure IXP Operators of IXPs as defined by art 4, under 13 of EU 2016/1148 connecting more than 300 autonomous systems
TLD name registries Any IANA registered TLD operator of a TLD register managing over 1 million domain names
DNS service providers Any IANA registered TLD operator managing over 1 million domain names and operating as a DNS service provider as defined by art 4, under 14 and 15 of EU 2016/1148


APPOINTED OES according to Art 3 (Other OES) of EU 2016/1148 in the Netherlands [53]
Sector Subsector Type of entity
Nuclear Holder of permit Kernenergiewet art 15b Nuclear energy production, processing and storage facilities
Facilities appointed under Geheimhoudingsbesluit Kernernergiewet, toepassingsbesluit 24/09/1971/nr 671/524 Protection of nuclear facilities
Guaranteeing security and confidentiality of data, equipment and materials used in the uranium enrichment process by separating isotopes using gas ultracentrifuges
Water Flood defences, water management and surface water quality to be determined by the Minister of Infrastructure and Water Management
Financial Settlement companies appointed by De Nederlandse Bank based on Wet financieel toezicht art 1:1
Central securities depository appointed by De Nederlandse Bank based on EU 909/2014 art 2.1

Digital infrastructure Electronic communication networks and -services/ICT Any operator of an electronic communication network or service which is directly or indirectly used for telephony, SMS, internet access for at least 1 million end users


Een aanbieder van een communicatiedienst is de natuurlijke persoon of rechtspersoon die in de uitoefening van een beroep of bedrijf aan de gebruikers van zijn dienst de mogelijkheid biedt te communiceren via een geautomatiseerd werk, of die gegevens verwerkt voor een zodanige dienst of gebruikers van die dienst. [54]



Poland

„Operator usług kluczowych” oznacza podmiot publiczny lub prywatny, należący do jednego z rodzajów, o których mowa w załączniku II, spełniający kryteria określone w art. 5 ust. 2. [55] [56]

Addional OES are: heating and mining. [57]


Portugal

«Operador de serviços essenciais», uma entidade pública ou privada pertencente a um dos tipos referidos no anexo II e que cumpre os critérios previstos no artigo 5.o, n.o 2. [58]

No additional OES defined. [59]

Romania

„Operator de servicii esențiale” înseamnă o entitate publică sau privată de tipul menționat în anexa II care îndeplinește criteriile prevăzute la articolul 5 alineatul (2). [60]

No additional OES defined. [61]

Slovakia

„Prevádzkovateľ základných služieb“ je verejný alebo súkromný subjekt, ktorého typ sa uvádza v prílohe II, spĺňajúci kritériá stanovené v článku 5 ods. 2. [62]

Additional OES sectors are pharmaceutical/ chemical industry, public administration, electronic communication, postal service. [63] A list of OES can be found here: [64]

Slovenia

„Izvajalec bistvenih storitev“ pomeni javni ali zasebni subjekt, ki spada med vrste iz Priloge II in izpolnjuje merila, določena v členu 5(2). [65]

Additional OES sectors are environmental protection industries. [66]

Spain

«operador de servicios esenciales»: una entidad pública o privada de uno de los tipos que figuran en el anexo II, que reúna los criterios establecidos en el artículo 5, apartado 2. [67]

No additional OES sectors defined. [68]

Sweden

Leverantör av samhällsviktiga tjänster : en offentlig eller privat enhet av en typ som avses i bilaga II vilken uppfyller kriterierna i artikel 5.2. [69]

No additional OES sectors defined. [70]

United Kingdom

‘Operator of essential services’ means a public or private entity of a type referred to in Annex II, which meets the criteria laid down in Article 5(2) [of EU 2016/1148]. [71]

No additional OES sectors defined. [72]

Standard Definition

Other Definitions

See also

Notes

References

  1. ↑ DIRECTIVE (EU) 2016/1148 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union
  2. ↑ Directive 2009/72/EC of the European Parliament and of the Council
  3. ↑ Directive 2009/73/EC of the European Parliament and of the Council
  4. ↑ Directive (EU) 2016/1148 -DE
  5. ↑ Bundesgesetzblatt für die Republik Österreich 17.07.2019 Teil II 215 NISV
  6. ↑ Directive (EU) 2016/1148 - - NL
  7. ↑ Directive (EU) 2016/1148 - - FR
  8. ↑ Directive (EU) 2016/1148 -DE
  9. ↑ DÉCRET N° 2023 - 060 DU 22 FEVRIER 2023 portant approbation des règles de politique de protection des infrastructures d’information critiques en République du Bénin
  10. ↑ Directive (EU) 2016/1148 - BG
  11. ↑ NIS tracker
  12. ↑ Stratégie nationale de cybersécurité 2022 - 2025 de la République Démocratique de Congo
  13. ↑ Directive (EU) 2016/1148 - HR
  14. ↑ Directive (EU) 2016/1148 - EL
  15. ↑ NIS tracker
  16. ↑ Directive (EU) 2016/1148 - CS
  17. ↑ NIS tracker
  18. ↑ Directive (EU) 2016/1148 - DA
  19. ↑ Directive (EU) 2016/1148 - ET
  20. ↑ NIS tracker
  21. ↑ Directive (EU) 2016/1148 - FI
  22. ↑ NIS tracker
  23. ↑ Directive (EU) 2016/1148 - FR
  24. ↑ Information Systems Defence and Security: France’s Strategy, Republique Francaise, 2011.
  25. ↑ Glossaire SSI.gouv.fr
  26. ↑ NIS tracker
  27. ↑ Directive (EU) 2016/1148 -DE
  28. ↑ NIS tracker
  29. ↑ Directive (EU) 2016/1148 – EL
  30. ↑ Directive (EU) 2016/1148 - HU
  31. ↑ NIS tracker
  32. ↑ Directive (EU) 2016/1148 - EN
  33. ↑ NIS tracker
  34. ↑ Directive (EU) 2016/1148 - IT
  35. ↑ NIS tracker
  36. ↑ National Cyber Security Strategy and Action Plan 2023 – 2026 (2023)
  37. ↑ Directive (EU) 2016/1148 - LV
  38. ↑ NIS tracker
  39. ↑ Directive (EU) 2016/1148 - LT
  40. ↑ NIS tracker
  41. ↑ Directive (EU) 2016/1148 - FR
  42. ↑ Directive (EU) 2016/1148 - MT
  43. ↑ Strategie nationale de cybersecurite 2022-2025 (2022)
  44. ↑ Strategija sajber bezbjednosti Crne Gore 2022-2026 (2021)
  45. ↑ Стратегија сајбер безбједности Црне Горе 2022-2026
  46. ↑ Directive (EU) 2016/1148 - NL
  47. ↑ NIS tracker
  48. ↑ Staatsblad van het Koninkrijk der Nederlanden, 388, 30-10-20-18
  49. ↑ 49.0 49.1 Elektriciteitswet 1998
  50. ↑ 50.0 50.1 Gaswet
  51. ↑ Commissiebrief Tweede Kamer inzake waarom ziekenhuizen en andere zorgaanbieders volgens de memorie van de toelichting van de Cybersecuritywet niet aangewezen worden als essentiële diensten en toezegging rapporteren voortgang Actieplan informatiebeveiliging, 2 juli 2018
  52. ↑ Drinkwaterwet
  53. ↑ Staatsblad van het Koninkrijk der Nederlanden, 388, 30-10-20-18
  54. ↑ Handreiking Cybercrime (2012)
  55. ↑ Directive (EU) 2016/1148 - PL
  56. ↑ Strategia Cyberbezpieczeństwa Rzeczypospolitej Polskiej na lata 2017-2022
  57. ↑ NIS tracker
  58. ↑ Directive (EU) 2016/1148 - PT
  59. ↑ NIS tracker
  60. ↑ Directive (EU) 2016/1148 - RO
  61. ↑ NIS tracker
  62. ↑ Directive (EU) 2016/1148 - SK
  63. ↑ NIS tracker
  64. ↑ Zoznam základných služieb/List of basic services SK
  65. ↑ Directive (EU) 2016/1148 - SL
  66. ↑ NIS tracker
  67. ↑ Directive (EU) 2016/1148 - ES
  68. ↑ NIS tracker
  69. ↑ Directive (EU) 2016/1148 - SV
  70. ↑ NIS tracker
  71. ↑ Directive (EU) 2016/1148 - EN
  72. ↑ NIS tracker


Retrieved from "https://websites.fraunhofer.de/CIPedia/index.php?title=Operator_of_Essential_Services&oldid=13937"