Cybersecurity exercises at entity and Member State levels
1. By 31 December of the year after the notification of critical-impact entities, and every three years thereafter, each critical-impact entity shall perform a cybersecurity exercise including one or more scenarios with cyber-attacks affecting cross-border electricity flows directly or indirectly and related to the risks identified during the cybersecurity risk assessments at Member State and entity levels in accordance with Article 20 and Article 27.
2. By derogation from paragraph 1, the RP-NCA, after consulting the competent authority and the relevant cyber crisis management authority as designated or established in Directive (EU) 2022/2555 under Article 9 may decide to organise a cybersecurity exercise at Member State level as described in paragraph 1 instead of performing the cybersecurity exercise at entity level. In this regard, the competent authority shall inform:
(a)
all critical-impact entities of its Member State, the NRA, CSIRTs and the CS-NCA at the latest by 30 June of the year preceding the cybersecurity exercise at entity level;
(b)
each entity that shall participate in the cybersecurity exercise at Member State level at the latest 6 months before the exercise is to take place.
3. The RP-NCA with the technical support of its CSIRTs, shall organise the cybersecurity exercise described in paragraph 2 at Member State level independently or in the context of a different cybersecurity exercise in that Member State. In order to be able to group these exercises, RP-NCA may postpone the cybersecurity exercise at Member State level referred to in paragraph 1 by one year.
4. The cybersecurity exercises at entity level and at Member State level shall be consistent with the national cybersecurity crisis management frameworks in accordance with Article 9(4), point (d) of Directive (EU) 2022/2555.
5. By 31 December 2026, and every three years thereafter, the ENTSO for Electricity, in cooperation with the EU DSO entity, shall make available an exercise scenario template to perform the cybersecurity exercises at entity and Member State level referred to in paragraphs 1. This template shall take into account the results of the most recently performed cybersecurity risk assessment at entity and Member State levels and shall include key success criteria. The ENTSO for Electricity and the EU DSO entity shall involve ACER and ENISA in the development of such template.
Regional or cross regional cybersecurity exercises
1. By 31 December 2029, and every three years thereafter, in each system operation region, the ENTSO for Electricity, in cooperation with the EU DSO entity, shall organise a regional cybersecurity exercise. The critical-impact entities in the system operation region shall participate in the regional cybersecurity exercise. The ENTSO for Electricity, in cooperation with the EU DSO entity, may organise, instead of a regional cybersecurity exercise, a cross regional cybersecurity exercise in more than one system operating regions in the same timeframe. The exercise should take into account other existing cybersecurity risk assessments and scenarios developed at Union level.
2. ENISA shall support the ENTSO for Electricity and the EU DSO entity in the preparation and organisation of the cybersecurity exercise at regional or at cross-regional level.
3. The ENTSO for Electricity, in coordination with the EU DSO entity, shall inform the critical-impact entities that shall participate in the regional or cross regional cybersecurity exercise six months before the exercise takes place.
4. The organiser of a regular cybersecurity exercise at Union level pursuant to Article 7(5) of Regulation (EU) 2019/881, or of any mandatory cybersecurity exercise related to the electricity sector within the same geographic perimeter, may invite the ENTSO for Electricity and the EU DSO entity to participate. In such cases, the obligation in paragraph 1 does not apply, provided that all critical-impact entities in the system operation region take part in the same exercise.
5. If the ENTSO for Electricity and the EU DSO entity participate in a cybersecurity exercise referred to in paragraph 4, they may postpone the regional or cross-regional cybersecurity exercise referred to in paragraph 1 by one year.
6. By 31 December 2027, and every three years after that date, the ENTSO for Electricity, in coordination with the EU DSO entity, shall make available an exercise template to perform the regional and cross regional cybersecurity exercises. This template shall take into account the results of the most recently performed cybersecurity risk assessment at regional level and shall include key success criteria. The ENTSO for Electricity shall consult the Commission and may seek advice from ACER, ENISA and the Joint Research Centre on the organisation and execution of the regional and cross regional cybersecurity exercises.
Outcome of cybersecurity exercises at entity, Member State, regional or cross regional levels
1. Upon request from a critical-impact entity, critical service providers shall participate in the cybersecurity exercises referred to in Article 43(1) and (2) and in Article 44(1) when they provide services for the critical-impact entity in the area corresponding with the scope of the relevant cybersecurity exercise.
2. The organisers of the cybersecurity exercises referred to in Article 43(1) and (2) and in Article 44(1), with the advice of ENISA if requested by them and pursuant to Article 7(5) of Regulation (EU) 2019/881, shall analyse and finalise the relevant cybersecurity exercise through a report summarising the lessons, addressed to all participants. The report shall include:
(a)
the exercise scenarios, meeting reports, main positions, successes and lessons learnt at any level of the electricity value chain;
(b)
whether the key success criteria were met;
(c)
a list of recommendations for entities participating in the relevant cybersecurity exercise to correct, adapt or change cybersecurity crisis processes, procedures, associated governance models and any existing contractual engagements with critical service providers.
3. If requested by the CSIRTs network or the NIS Cooperation Group or the EU CyCLONe, the organisers of the cybersecurity exercises referred to in Article 43(1) and (2) and in Article 44(1) shall share the outcome of the relevant cybersecurity exercise. The organisers shall share with each entity participating in the exercises the information referred to in paragraph 2, points (a) and (b) of this Article. The organisers shall share the list of recommendations referred to in that paragraph, point (c) exclusively with the entities addressed in the recommendations.
4. The organisers of the cybersecurity exercises referred to in Article 43(1) and (2) and in Article 44(1) shall follow up regularly with the entities participating in the exercises on the implementation of the recommendations pursuant to paragraph 2, point (c) of this Article.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
