Transport and energy companies will have to ensure that the digital infrastructure that they use to deliver essential services, such as traffic control or electricity grid management can withstand cyber-attacks, under new rules agreed by MEPs and the Luxembourg Presidency of the EU Council of Ministers.
Parliament’s rapporteur Andreas Schwab said the deal was the first ever set of EU-wide cyber-security rules.
He said the European Parliament has pushed hard for a harmonised identification of critical operators in energy, transport, health or banking fields, which will have to fulfil security measures and notify significant cyber incidents.
Under the rules, member states will have to cooperate more on cybersecurity – which is even more important in light of the current security situation in Europe.”
MEPs put an end to current fragmentation of 28 cybersecurity systems by listing sectors – energy, transport, banking, financial market, health and water supply – in which critical service companies will have to protect. These companies must also be ready to report serious security breaches to public authorities.
Member states will have to identify concrete “operators of essential services” from these sectors using certain criteria: whether the service is critical for society and the economy, whether it depends on network and information systems and whether an incident could have significant disruptive effects on its provision or public safety.
ISPs such as online marketplaces (e.g. eBay, Amazon), search engines (e.g. Google) and clouds, will also have to ensure the safety of their infrastructure and to report on major incidents.
A network of Computer Security Incidents Response Teams (CSIRTs), set up by each member state to handle incidents, will have to be established to discuss cross border security incidents and identify coordinated responses, the rules say.