Union-wide coordinated approach to strengthen the resilience of critical infrastructure 2023/C 20/01 - Main contents

EN

Official Journal of the European Union

C 20/1

With the aim to secure the functioning of the internal market, it is in the interests of all Member States and the Union as a whole to clearly identify and protect relevant critical infrastructure that provides essential services within that market, especially in key sectors such as energy, digital infrastructure, transport and space, as well as critical infrastructure with significant cross-border relevance (1), the disruption of which could significantly impact other Member States.

This Recommendation, which is a non-binding act, demonstrates the political will of the Member States to cooperate together and their commitment to the recommended measures, highlighted in a five-point plan issued by the President of the European Commission, while fully respecting Member States’ competences. This Recommendation does not affect the protection of the essential interests of Member States’ national security, public security or defence and no Member State should be expected to share information that is detrimental to those interests.

While the primary responsibility for ensuring the security and provision of essential services by critical infrastructure rests with the Member States and their critical infrastructure operators, increased coordination at Union level is appropriate, especially in light of evolving threats that may impact several Member States simultaneously, such as Russia’s war of aggression against Ukraine and hybrid campaigns against Member States, or affect the resilience and good functioning of the Union’s economy, internal market and society as a whole. Particular attention should be paid to critical infrastructure outside the territory of the Member States, such as undersea critical infrastructure or offshore energy infrastructure.

The European Council has, in its conclusions of 20 and 21 October 2022, strongly condemned the acts of sabotage against critical infrastructure, such as those against the Nord Stream pipelines, indicating the Union’s will to meet any deliberate disruption of critical infrastructure or other hybrid actions with a united and determined response.

In view of the fast-evolving threat landscape, resilience-enhancing measures should be taken as a matter of priority in key sectors such as energy, digital infrastructure, transport and space, and in other relevant sectors identified by the Member States. Such measures should focus on enhancing the resilience of critical infrastructure taking into account relevant risks, especially cascading effects, supply chain disruption, dependence, impacts of climate change, unreliable vendors and partners, and hybrid threats and campaigns including foreign information manipulation and interference. Where national critical infrastructure is concerned, in view of the possible consequences priority should be given to critical infrastructure with significant cross-border relevance. Member States are encouraged to provide such resilience-enhancing measures, where appropriate, as a matter of urgency, while maintaining the approach set out in the evolving legal framework.

The protection of European critical infrastructure in the energy and transport sectors is currently regulated by Council Directive 2008/114/EC (2), and security of network and information systems across...