NIS2· Article 23a
Text
Article 23a NIS2 as printed in the Council text of 22 October 2026
Incident reporting information point
Source Council, 22 October 2026. Article 23a: ST 14756/26, page 159 · pp. 159–160 · exact text page
ENISA shall develop and maintain an incident reporting information point to support the identification and fulfilment of the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so (‘incident reporting information point’).
The incident reporting information point shall:
be designed to allow, on the basis of relevant information provided, the identification of the applicable reporting obligations referred to in paragraph 1 and the direction to the appropriate national entry point referred in Article 23b, and (c) make available simplified and documented information on incident notification processes in the different Member States. (3) When developing the incident reporting information point, ENISA shall consult the relevant national competent authorities under the relevant Union legal acts, the Cooperation Group, the CSIRT Network and other relevant bodies or groups established at Union level under relevant Union legal acts. ENISA shall establish structured communication channels to ensure that information available on the incident reporting information point is swiftly and effectively updated. Member States shall communicate to ENISA all relevant and necessary information for the purpose of paragraph 1a. (4) The incident reporting information point shall not enable the submission, transmission, storage or processing of any incident notification or related data, and shall not collect any information allowing the identification of the notifying entity or of any incident. (5) After establishing the incident reporting information point and in cooperation with the Cooperation Group, ENISA shall explore the possibility to extend the incident reporting information point by providing a report on:
regulatory mapping of relevant EU legal acts imposing cybersecurity risk management measures;
national measures, including transposition measures, implementing relevant Union legal acts imposing cybersecurity risk management obligations;
content to support entities in complying with obligations, in particular regarding entity registration, and cybersecurity risk-management.
How the provision changed
Each text against the law in forceEach text against the text before it
| What each text would do to the law in force | |||||||
|---|---|---|---|---|---|---|---|
| Element | Commission19 Nov 2025Art 23a | Council21 May 2026Art 23a | Council10 Jun 2026Art 23a | Council18 Jun 2026Art 23a | Council3 Sep 2026Art 23a | Council2 Oct 2026Art 23a | Council22 Oct 2026Art 23a |
| Compared with | law in force | the proposal | 21 May text | 10 Jun text | 18 Jun text | 3 Sep text | 2 Oct text |
| From the Commission’s Article 23a | |||||||
| Establishment and purpose of ENISA’s reporting point | 23a(1) Adds Added | 23a(1) Adds, changed since the proposal Changed | 23a(1) Adds, changed since 21 May Changed | 23a(1) Adds Unchanged | 23a(1) Adds Unchanged | 23a(1) Adds Unchanged | 23a(1) Adds Unchanged |
| Security of the single-entry point and its information | 23a(2) Adds Added | Not in the law in force or this text, dropped since the proposal Dropped | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text |
| Technical specifications for the single-entry point | 23a(3) Adds Added | Not in the law in force or this text, dropped since the proposal Dropped | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text |
| No ENISA access to notifications | 23a(4) Adds Added | Not in the law in force or this text, dropped since the proposal Dropped | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text |
| Piloting before notifications are enabled | 23a(5) Adds Added | Not in the law in force or this text, dropped since the proposal Dropped | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text |
| Assessment and notice of proper functioning | 23a(6) Adds Added | Not in the law in force or this text, dropped since the proposal Dropped | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text |
| Corrective measures after a negative assessment | 23a(7) Adds Added | Not in the law in force or this text, dropped since the proposal Dropped | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text |
| Added in the Council texts | |||||||
| Functions of the information point | Not in the law in force or this text In neither text | 23a(2a) Adds, added since the proposal Added | 23a(2) Adds, changed since 21 May Changed | 23a(2) Adds Unchanged | 23a(2) Adds Unchanged | 23a(2) Adds Unchanged | 23a(2) Adds Unchanged |
| Consultation, updating and national input | Not in the law in force or this text In neither text | 23a(2b) Adds, added since the proposal Added | 23a(3) Adds, changed since 21 May Changed | 23a(3) Adds Unchanged | 23a(3) Adds Unchanged | 23a(3) Adds Unchanged | 23a(3) Adds Unchanged |
| No handling of notifications or identifying information | Not in the law in force or this text In neither text | 23a(2c) Adds, added since the proposal Added | 23a(4) Adds Unchanged | 23a(4) Adds Unchanged | 23a(4) Adds Unchanged | 23a(4) Adds Unchanged | 23a(4) Adds Unchanged |
| Possible extension of the information point | Not in the law in force or this text In neither text | 23a(2d) Adds, added since the proposal Added | 23a(5) Adds, changed since 21 May Changed | 23a(5) Adds Unchanged | 23a(5) Adds Unchanged | 23a(5) Adds Unchanged | 23a(5) Adds Unchanged |
Each text against the law in force: +Adds adds a provision the law in force lacks— neither the law in force nor the text has it changed from the text before
Each text against the text before it: +Added in this text, not in the text before~Changed wording changed−Dropped drops a provision the text before added=Unchanged same as the text before— in neither text
Council text of 21 May 2026 · ST 9547/26 ST 9547/26 reproduces only some of the proposal’s changes, so this comparison applies only those it shows or visibly drops. It says nothing about the others.
Parliament amendments
90 amendments to this article
16 amendments would delete the whole article: members of EPP.
| Type | S&D | Greens/EFA | Renew | EPP | ECR | PfE | ESN | Rapporteur |
|---|---|---|---|---|---|---|---|---|
| − Deletion | · | · | · | 16 | · | · | · | · |
| ~ Alternative | · | 2 | 9 | 19 | 13 | 17 | 1 | · |
| + Addition | 1 | 4 | 12 | 4 | 1 | 2 | · | 1 |
By political group
- − Deletion EPP 16
- ~ Alternative Greens/EFA 2 Renew 9 EPP 19 ECR 13 PfE 17 ESN 1
- + Addition S&D 1 Greens/EFA 4 Renew 12 EPP 4 ECR 1 PfE 2 Rapporteur 1
Show
Article 23a as a whole68 amendments
270 −Deletion Daniel BudaEPP · JURI Deletes the proposed article
Article 23a- Tabled by
- Daniel Buda
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- JURI amendments 69–296 to the draft opinion
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23 a
271 −Deletion Daniel BudaEPP · JURI Deletes the proposed article
Single-entry point for incident reporting- Tabled by
- Daniel Buda
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- JURI amendments 69–296 to the draft opinion
- Source
- Official text, page 159
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive 2022/2555 / Article 23 a
272 −Deletion Daniel BudaEPP · JURI Deletes the proposed article
(1) ENISA shall develop and maintain a single-entry point to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so (‘single-entry point’). Without prejudice to Article 16 of Regulation (EU) 2024/2847 of the European Parliament and of the Council, ENISA may ensure that the single-entry point builds on the single reporting platform established under that Regulation.- Tabled by
- Daniel Buda
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- JURI amendments 69–296 to the draft opinion
- Source
- Official text, page 159
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23 a
273 −Deletion Daniel BudaEPP · JURI Deletes the proposed article
(2) ENISA shall take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the single-entry point and the information submitted or disseminated via the single-entry point. ENISA shall take into account the sensitivity of information submitted or disseminated pursuant to the Union legal acts referred to in paragraph (1) and ensure that competent authorities under those Union legal acts have access to and process the information as required under those Union legal acts.- Tabled by
- Daniel Buda
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- JURI amendments 69–296 to the draft opinion
- Source
- Official text, page 160
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23 a
274 −Deletion Daniel BudaEPP · JURI Deletes the proposed article
(3) ENISA shall provide and implement the specifications on the technical, operational and organisational measures regarding the establishment, maintenance and secure operation of the single-entry point. ENISA shall develop the specifications in cooperation with the Commission, the CSIRTs network and the competent authorities under the Union legal acts referred to in paragraph (1). The specifications shall ensure that: (a) the necessary capability for interoperability with regard to other relevant reporting obligations referred to in paragraph (1) is ensured; (b) technical arrangements for the relevant entities and authorities under the Union legal acts referred to in paragraph (1) to access, submit , retrieve, transmit or otherwise process information from the single-entry point, are in place and, provide technical protocols and tools that allow the entities and authorities to further process the receive information within their systems; (c) the specificities of the incident reporting requirements set out under the Union legal acts referred to in paragraph (1) are duly taken into account; (d) where relevant, the single-entry point is interoperable and compatible with European Business Wallets referred to in [Proposal for a Regulation: Insert title of the proposal] and that the European Business Wallets can be used at least to identify and authenticate entities using the single-entry point; (e) entities using the single-entry point can retrieve and supplement information that they have previously submitted via the single-entry point; (f) a single notification of information submitted by an entity via the single-entry point can be used to fulfil reporting obligations as set out under any of the other Union legal acts which provide for incident reporting to the single-entry point.- Tabled by
- Daniel Buda
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- JURI amendments 69–296 to the draft opinion
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23 a
275 ~Alternative Tobiasz Bocheński +1ECR · JURI “with regard that submitted notification is forwarded to all relevant authorities in a legally effective manner”
(b) technical arrangements for the relevant entities and authorities under the Union legal acts referred to in paragraph (1) to access, submit , retrieve, transmit or otherwise process information from the single-entry point, are in place and, provide technical protocols and tools that allow the entities and authorities to further process the receive information within their systems, with regard that submitted notification is forwarded to all relevant authorities in a legally effective manner;
- Tabled by
- Tobiasz Bocheński, Kosma Złotowski
- Group
- ECR
- Targets
- NIS2 Directive Article 23a
- Document
- JURI amendments 69–296 to the draft opinion
- Printed header
- Article 6 – paragraph 1 – point 1 / Regulation (EU) 2016/679 / Article 23 a
276 −Deletion Daniel BudaEPP · JURI Deletes the proposed article
(4) Unless provided for in the Union legal acts referred to in paragraph (1) of this, ENISA shall not have access to the notifications submitted through the single-entry point.- Tabled by
- Daniel Buda
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- JURI amendments 69–296 to the draft opinion
- Source
- Official text, page 162
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23 a
277 −Deletion Daniel BudaEPP · JURI Deletes the proposed article
(5) Within [18] months from the entry into force of this Regulation, ENISA shall pilot the functioning of the single-entry point for each added Union legal act, including testing that takes into account the specificities and requirements for the notifications set out by each respective Union legal act, and after consulting the Commission and the relevant competent authorities under the respective Union legal acts. ENISA shall enable the notification of incidents under each Union legal act referred to in paragraph (1) only after piloting the functioning and after the Commission published a notice pursuant to paragraph 6.- Tabled by
- Daniel Buda
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- JURI amendments 69–296 to the draft opinion
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23 a
278 −Deletion Daniel BudaEPP · JURI Deletes the proposed article
(6) The Commission shall, in cooperation with ENISA, assess the proper functioning, reliability, integrity and confidentiality of the single-entry point. When the Commission, after consultation of the CSIRTs network and the competent authorities under the Union legal acts referred to in paragraph 1, finds that the single-entry point ensures the proper functioning, reliability, integrity and confidentiality, it shall publish a notice to that effect in the Official Journal of the European Union.- Tabled by
- Daniel Buda
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- JURI amendments 69–296 to the draft opinion
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23 a
279 −Deletion Daniel BudaEPP · JURI Deletes the proposed article
(7) Where the Commission finds in its assessment that the single-entry point does not ensure the proper functioning, reliability, integrity or confidentiality, ENISA shall take, in cooperation with the Commission and without undue delay, all necessary corrective measures to ensure the proper functioning, reliability, integrity or confidentiality without delay and inform the Commission of the results. Thereafter, the Commission shall reassess the proper functioning, reliability, integrity or confidentiality of the single-entry point and shall publish a notice in accordance with paragraph 6.’- Tabled by
- Daniel Buda
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- JURI amendments 69–296 to the draft opinion
- Source
- Official text, page 164
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23 a
Show 58 more amendments
501 ~Alternative Virginie JoronPfE · IMCO “European point of entry for incident reporting”
Single-entryEuropean point of entry for incident reporting- Tabled by
- Virginie Joron
- Group
- PfE
- Targets
- NIS2 Directive Article 23a
- Document
- IMCO amendments 329–532 to the draft opinion
- Source
- Official text, page 106
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23 a
502 ~Alternative Virginie JoronPfE · IMCO “ENISA shall act as the single European coordination point between the national single points of entry established or appointed by the Member States…”
(1)
ENISA shall develop and maintain a single-entry point to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so (‘single-entry point’).ENISA may develop and maintain a point of entry to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so (‘Union point of entry’). ENISA shall act as the single European coordination point between the national single points of entry established or appointed by the Member States, while guaranteeing their interoperability and the secure routing of notifications; it shall not function as a centralised point for the actual receipt, transmission or storage of notifications. Without prejudice to Article 16 of Regulation (EU) 2024/2847 of the European Parliament and of the Council, ENISA may ensure that coordination between thesingle-entrynationalpointpoints of entry builds on the single reporting platform established for the Member States under that Regulation.- Tabled by
- Virginie Joron
- Group
- PfE
- Targets
- NIS2 Directive Article 23a
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23 a
503 +Addition Virginie JoronPfE · IMCO “The Union point of entry shall be based on existing national notification systems and shall guarantee the secure routing and interoperability of…” numbered 1a
(1a)The Union point of entry shall be based on existing national notification systems and shall guarantee the secure routing and interoperability of notifications between the notifying entities and the competent national authorities, without centralising the storage of these notifications within a single body. ENISA’s role shall be limited to technical operations and routing as well as checking the format and completeness of the notifications; ENISA shall not be the recipient of the notifications in substantive terms.
- Tabled by
- Virginie Joron
- Group
- PfE
- Targets
- NIS2 Directive Article 23a
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23 a
504 ~Alternative Morten Løkkegaard +2Renew · IMCO “including information concerning vulnerabilities, mitigation measures, ransomware demands, payment information or other commercially or legally…”
(2) ENISA shall take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the single-entry point and the information submitted or disseminated via the single-entry point. ENISA shall take into account the sensitivity of information submitted or disseminated pursuant to the Union legal acts referred to in paragraph (1), including information concerning vulnerabilities, mitigation measures, ransomware demands, payment information or other commercially or legally sensitive information, and shall ensure that such information is subject to appropriate confidentiality, professional secrecy, access-control and data minimisation safeguards, while ensuring that competent authorities under those Union legal acts have access to and process the information as required under those Union legal acts.
Justification
Sensitive incident information, including information related to vulnerabilities, mitigation measures and ransomware, must be protected by strong confidentiality and access-control safeguards. This is necessary to build trust in the single-entry point and to avoid underreporting by entities operating across the Single Market.
- Tabled by
- Morten Løkkegaard, Svenja Hahn, Sandro Gozi
- Group
- Renew
- Targets
- NIS2 Directive Article 23a
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (UE) 2022/2555 / Article 23a – paragraph 1 – point 2
505 ~Alternative Virginie JoronPfE · IMCO “and the national points of entry, each within their respective responsibilities”
(2) ENISA and the national points of entry, each within their respective responsibilities, shall take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the single-entry point and the information submitted or disseminated via
the single-entrythis point. ENISA and the national points of entry shall take into account the sensitivity of information submitted or disseminated pursuant to the Union legal acts referred to in paragraph (1) and ensure that competent authorities under those Union legal acts have access to and process the information as required under those Union legal acts.- Tabled by
- Virginie Joron
- Group
- PfE
- Targets
- NIS2 Directive Article 23a
- Document
- IMCO amendments 329–532 to the draft opinion
- Source
- Official text, page 109
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a (new) – paragraph 1 – point 2
506 ~Alternative Virginie JoronPfE · IMCO “the national single points of entry”
(3) ENISA shall provide and implement the specifications on the technical, operational and organisational measures regarding the establishment, maintenance and secure operation of the single-entry point. ENISA shall develop the specifications in cooperation with the Commission, the CSIRTs network, the national single points of entry and the competent authorities under the Union legal acts referred to in paragraph (1). The specifications shall ensure that:
- Tabled by
- Virginie Joron
- Group
- PfE
- Targets
- NIS2 Directive Article 23a
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23 a – paragraph 1 – point 3
508 ~Alternative Sophia KircherEPP · IMCO “and shall, to the greatest extent possible, enable entities to comply with existing reporting obligations under Union law, including Regulation (EU)…”
(f) a single notification of information submitted by an entity via the single-entry point can be used to fulfil reporting obligations as set out under any of the other Union legal acts which provide for incident reporting to the single-entry point and shall, to the greatest extent possible, enable entities to comply with existing reporting obligations under Union law, including Regulation (EU) 2022/2554 (DORA) and without requiring the resubmission of information already provided under other reporting frameworks.
Justification
As companies and organisations are currently integrating NIS2 requirements into their processes as part of the ongoing national implementation, companies should be able to fulfil existing reporting obligations through the same mechanism, to avoid creating additional administrative burden or duplicate reporting requirements
- Tabled by
- Sophia Kircher
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 1 – point f
509 ~Alternative Morten Løkkegaard +3Renew · IMCO “a single notification of information submitted by an entity via the single-entry point should be used to fulfil reporting obligations as set out…”
(f) a single notification of information submitted by an entity via the single-entry point
canshould be used to fulfil reporting obligations as set out under any of the other Union legal acts which provide for incident reporting to the single-entry point.Justification
‘Can be used’ is too weak. The whole political point is that one report should legally count as one report.
- Tabled by
- Morten Løkkegaard, Svenja Hahn, Jeannette Baljeu, Sandro Gozi
- Group
- Renew
- Targets
- NIS2 Directive Article 23a
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 1 – point f
513 ~Alternative Virginie JoronPfE · IMCO “The notifications shall be received and handled substantively at the level of the national competent authorities.”
(4) Unless provided for in the Union legal acts referred to in paragraph (1) of this, ENISA shall not have access to the notifications submitted through the
single-entrynationalpointsingle points of entry. The notifications shall be received and handled substantively at the level of the national competent authorities.- Tabled by
- Virginie Joron
- Group
- PfE
- Targets
- NIS2 Directive Article 23a
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23 a – paragraph 1 – point 4
514 ~Alternative Virginie JoronPfE · IMCO “Within [18] months from the entry into force of this Regulation, ENISA shall pilot the functioning of the national single points of entry for each…”
(5) Within [18] months from the entry into force of this Regulation, ENISA shall pilot the functioning of the
single-entrynationalpointsingle points of entry for each added Union legal act, including testing that takes into account the specificities and requirements for the notifications set out by each respective Union legal act, and after consulting the Commission and the relevant competent authorities under the respective Union legal acts. ENISA shall enable the notification of incidents under each Union legal act referred to in paragraph (1) only after piloting the functioning and after the Commission published a notice pursuant to paragraph 6.- Tabled by
- Virginie Joron
- Group
- PfE
- Targets
- NIS2 Directive Article 23a
- Document
- IMCO amendments 329–532 to the draft opinion
- Source
- Official text, page 114
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23 a – paragraph 1 – point 5
1736 −Deletion François-Xavier BellamyEPP · ITRE–LIBE Deletes the proposed article
[...]- Tabled by
- François-Xavier Bellamy
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1565–1740 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a
1737 ~Alternative Katri KulmuniRenew · ITRE–LIBE “single-entry points and interoperability”
Single-entry point for incident reportingNational single-entry points and interoperability for incident reporting/data breachesJustification
Businesses in the EU are subject toseveral reporting mechanisms forsecurity incidents under NIS2, CRA,GDPR, and DORA, creating undesirableoverlap and double work. For example, different bumpers exist for securityincidents in the CRA, DORA and NIS2,and different reports are required for thesame event due to divergingrequirements in the various acts. Thereporting deadlines are alsoinconsistent. Uploading to the reportingplatform is merely the final step in alonger process. To achieve an actualreduction in administrative burdens forEuropean businesses it is necessary toharmonise all steps within the securityincident reporting process. Work towardsgreater alignment of reportingrequirements, including timelines (96hours) and trigger points, to reduceunnecessary administrative burden andduplication.
- Tabled by
- Katri Kulmuni
- Group
- Renew
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1565–1740 to the draft report
- Source
- Official text, page 146
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – title
1738 ~Alternative Alice Teodorescu Måwe +1EPP · ITRE–LIBE “single-entry points and interoperability”
Single-entry point for incident reportingNational single-entry points and interoperability for incident reporting/data breaches- Tabled by
- Alice Teodorescu Måwe, Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1565–1740 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – title
1739 ~Alternative Henrik DahlEPP · ITRE–LIBE “single-entry points and interoperability”
Single-entry point for incident reportingNational single-entry points and interoperability for incident reporting/data breaches- Tabled by
- Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1565–1740 to the draft report
- Source
- Official text, page 147
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – title
1740 ~Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “points established or designated by the Member States, ensuring their interoperability and the secure routing of notifications; it shall not…”
(1) ENISA
shallmay develop and maintainaansingle-entryEU entry point to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so (‘EU entry-point'). ENISA shall act as the single European point of coordination between the national single-entry points established or designated by the Member States, ensuring their interoperability and the secure routing of notifications; it shall not constitute a centralised point’)for the substantive receipt, transmission or storage of notifications. Without prejudice to Article 16 of Regulation (EU) 2024/2847 of the European Parliament and of the Council, ENISA may ensure that thesingle-entrycoordinationpointbetween national points of entry builds on the single reporting platform established by the Member States under that Regulation.Justification
Member States establish a single national entry point for the submission of notifications. The simplification sought for reporting entities is achieved through a single national interface, not through the transfer to a Union body of competences exercised at national level. A single Union database of incident notifications would by its very nature constitute a target of the first order and a single point of vulnerability.
- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1565–1740 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 1
1741 ~Alternative Katri KulmuniRenew · ITRE–LIBE “Member States shall ensure the establishment of a national single-entry point for the notification of incidents under Union legal acts providing for…”
(1)
ENISA shall develop and maintain a single-entry point to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so (‘single-entry point’).Member States shall ensure the establishment of a national single-entry point for the notification of incidents under Union legal acts providing for such obligations.Without prejudice to Article 16 of Regulation (EU) 2024/2847 of the European Parliament and of the Council, ENISA may ensure that the single-entry point builds on the single reporting platform established under that Regulation.Justification
Deliver a European harmonized secureinteroperable technical infrastructure toconnect national established Single-Entry Points (SEPs) for reporting thatfacilitates entities in scope of multiplelegal incident reporting obligations tosubmit one report to be compliant withall applicable rules. See example ofLuxembourg and Denmark. We supportthe settingup of one integrated reportingportal per Member State, covering allstatutory reporting obligations, coupledwith full EU interoperability throughuniform technical and functionalstandards; and automated and securetransmission where crossborder notifications are required. Companies inall sectors should be allowed to leveragetheir country of main establishment asthe primary interface (single entry point)for cybersecurity incident reportingunder relevant EU legislation, providedthat this is combined with commontemplates, definitions and deadlines,and with automated, securetransmission to competent authorities inMember States via national single entrypoints where cross border notificationsare required. ENISA’s role should besupportive and focus on standardisation,interoperability and quality assurance.
- Tabled by
- Katri Kulmuni
- Group
- Renew
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 3
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 1
1742 ~Alternative Henrik DahlEPP · ITRE–LIBE “Member States shall ensure the establishment of a national single-entry point for the notification of incidents under Union legal acts providing for…”
(1)
ENISA shall develop and maintain a single-entry point to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so (‘single-entry point’).Member States shall ensure the establishment of a national single-entry point for the notification of incidents under Union legal acts providing for such obligations.Without prejudice to Article 16 of Regulation (EU) 2024/2847 of the European Parliament and of the Council, ENISA may ensure that the single-entry point builds on the single reporting platform established under that Regulation.- Tabled by
- Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, pages 3–4
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 1
1743 ~Alternative Alice Teodorescu Måwe +1EPP · ITRE–LIBE “Member States shall ensure the establishment of a national single-entry point for the notification of incidents under Union legal acts providing for…”
(1)
ENISA shall develop and maintain a single-entry point to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so (‘single-entry point’).Member States shall ensure the establishment of a national single-entry point for the notification of incidents under Union legal acts providing for such obligations.Without prejudice to Article 16 of Regulation (EU) 2024/2847 of the European Parliament and of the Council, ENISA may ensure that the single-entry point builds on the single reporting platform established under that Regulation.- Tabled by
- Alice Teodorescu Måwe, Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 4
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 1
1744 ~Alternative Markus BuchheitESN · ITRE–LIBE “may, at the request of one or more Member States”
(1)
ENISA shall develop and maintain a single-entry point to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so (‘single-entry point’). Without prejudice to Article 16 of Regulation (EU) 2024/2847 of the European Parliament and of the Council, ENISA may ensure that the single-entry point builds on the single reporting platform established under that Regulation.ENISA may, at the request of one or more Member States, develop and maintain technical support tools for the notification of cross-border or Union-wide systemic incidents and related events, where this is expressly provided for in the relevant Union legal acts and without prejudice to national reporting channels.- Tabled by
- Markus Buchheit
- Group
- ESN
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, pages 4–5
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 1
1745 ~Alternative Bart Groothuis +8Renew · ITRE–LIBE “ENISA shall develop and maintain a single-entry point to support the obligation to report incidents and related events under the Union legal acts…”
(1) ENISA shall develop and maintain a single-entry point to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so (‘single-entry point’). Without prejudice to Article 16 of Regulation (EU) 2024/2847 of the European Parliament and of the Council, ENISA
mayshall ensure that the single-entry point builds on the single reporting platform established under that Regulation.- Tabled by
- Bart Groothuis, Ivars Ijabs, Morten Løkkegaard, Sophie Wilmès, Nikola Minchev, Svenja Hahn, Andreas Glück, João Cotrim De Figueiredo, Ana Vasconcelos
- Group
- Renew
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 5
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 1
1746 ~Alternative Michael McNamara +5Renew · ITRE–LIBE “ENISA shall develop and maintain a single-entry point to support the obligation to report incidents and related events under the Union legal acts…”
(1) ENISA shall develop and maintain a single-entry point to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so (‘single-entry point’). Without prejudice to Article 16 of Regulation (EU) 2024/2847 of the European Parliament and of the Council, ENISA
mayshall ensure that the single-entry point builds on the single reporting platform established under that Regulation.- Tabled by
- Michael McNamara, Irena Joveva, Sophie Wilmès, Oihane Agirregoitia Martínez, Bart Groothuis, Veronika Cifrová Ostrihoňová
- Group
- Renew
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 6
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive 2022/2555 / Article 23a – paragraph 1
1750 ~Alternative Henrik DahlEPP · ITRE–LIBE “ENISA shall make a definition of what constitutes a significant incident that should be reported to the national single-entry point.”
(2)
ENISA shall take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the single-entry point and the information submitted or disseminated via the single-entry point.ENISA shall make a definition of what constitutes a significant incident that should be reported to the national single-entry point.ENISA shall take into account the sensitivity of information submitted or disseminated pursuant to the Union legal acts referred to in paragraph (1) and ensure that competent authorities under those Union legal acts have access to and process the information as required under those Union legal acts.- Tabled by
- Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 8
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 2
1751 ~Alternative Katri KulmuniRenew · ITRE–LIBE “ENISA shall make a definition of what constitutes a significant incident that should be reported to the national single-entry point.”
(2)
ENISA shall take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the single-entry point and the information submitted or disseminated via the single-entry point.ENISA shall make a definition of what constitutes a significant incident that should be reported to the national single-entry point.ENISA shall take into account the sensitivity of information submitted or disseminated pursuant to the Union legal acts referred to in paragraph (1) and ensure that competent authorities under those Union legal acts have access to and process the information as required under those Union legal acts.- Tabled by
- Katri Kulmuni
- Group
- Renew
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, pages 8–9
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 2
1752 ~Alternative Alice Teodorescu Måwe +1EPP · ITRE–LIBE “ENISA shall make a definition of what constitutes a significant incident that should be reported to the national single-entry point.”
(2)
ENISA shall take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the single-entry point and the information submitted or disseminated via the single-entry point.ENISA shall make a definition of what constitutes a significant incident that should be reported to the national single-entry point.ENISA shall take into account the sensitivity of information submitted or disseminated pursuant to the Union legal acts referred to in paragraph (1) and ensure that competent authorities under those Union legal acts have access to and process the information as required under those Union legal acts.- Tabled by
- Alice Teodorescu Måwe, Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 9
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 2
1753 ~Alternative Diego Solier +2ECR · ITRE–LIBE “The Commission, ENISA and the Cooperation Group shall develop harmonised reporting templates, reporting guidance and coordinated supervisory criteria…”
(2) ENISA shall take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the single-entry point and the information submitted or disseminated via the single-entry point. ENISA shall take into account the sensitivity of information submitted or disseminated pursuant to the Union legal acts referred to in paragraph (1) and ensure that competent authorities under those Union legal acts have access to and process the information as required under those Union legal acts. The Commission, ENISA and the Cooperation Group shall develop harmonised reporting templates, reporting guidance and coordinated supervisory criteria for incidents that may trigger obligations under more than one Union cybersecurity instrument. Member States shall ensure that entities can submit the required information through a single-entry point.”
- Tabled by
- Diego Solier, Sebastian Tynkkynen, Elena Donazzan
- Group
- ECR
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 2
1754 ~Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “each, within their respective responsibilities”
(2) ENISA and the national points of entry shall each, within their respective responsibilities, take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the single-entry point and the information submitted or disseminated via
the single-entry pointit. ENISA and the national points of entry shall take into account the sensitivity of information submitted or disseminated pursuant to the Union legal acts referred to in paragraph (1) and ensure that competent authorities under those Union legal acts have access to and process the information as required under those Union legal acts.- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – Paragraph 2
1757 ~Alternative Henrik DahlEPP · ITRE–LIBE “maintain an incident reporting information point to support”
(3)
ENISA shall provide and implement the specifications on the technical, operational and organisational measures regarding the establishment, maintenance and secure operation of the single-entry point. ENISA shall develop the specifications in cooperation with the Commission, the CSIRTs network and the competent authorities under the Union legal acts referred to in paragraph (1).ENISA shall develop and maintain an incident reporting information point to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so.The specifications shall ensure that:- Tabled by
- Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3
1758 ~Alternative Alice Teodorescu Måwe +1EPP · ITRE–LIBE “maintain an incident reporting information point to support”
(3)
ENISA shall provide and implement the specifications on the technical, operational and organisational measures regarding the establishment, maintenance and secure operation of the single-entry point. ENISA shall develop the specifications in cooperation with the Commission, the CSIRTs network and the competent authorities under the Union legal acts referred to in paragraph (1).ENISA shall develop and maintain an incident reporting information point to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so.The specifications shall ensure that:- Tabled by
- Alice Teodorescu Måwe, Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 14
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3
1759 ~Alternative Katri KulmuniRenew · ITRE–LIBE “maintain an incident reporting information point to support”
(3)
ENISA shall provide and implement the specifications on the technical, operational and organisational measures regarding the establishment, maintenance and secure operation of the single-entry point. ENISA shall develop the specifications in cooperation with the Commission, the CSIRTs network and the competent authorities under the Union legal acts referred to in paragraph (1).ENISA shall develop and maintain an incident reporting information point to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so.The specifications shall ensure that:- Tabled by
- Katri Kulmuni
- Group
- Renew
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3
1760 ~Alternative Aura Salla +4EPP · ITRE–LIBE “following a prior public consultation with the relevant stakeholders”
(3) ENISA shall provide and implement, in a timely manner, the specifications on the technical, operational and organisational measures regarding the establishment, maintenance and secure operation of the single-entry point. ENISA shall develop the specifications, following a prior public consultation with the relevant stakeholders in cooperation with the Commission, the CSIRTs network and the competent authorities under the Union legal acts referred to in paragraph (1). The specifications shall ensure that:
- Tabled by
- Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Eva Maydell, Christian Ehler
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 15
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a (new) – paragraph 3
1761 ~Alternative Damian Boeselager +1Greens/EFA · ITRE–LIBE “as established according to paragraph 8”
(3) ENISA shall
provide andimplement the specifications on the technical, operational and organisational measures regarding the establishment, maintenance and secure operation of the single-entry point as established according to paragraph 8. ENISA shalldevelopsupport the Commission in developing the specifications, incooperationconsultation withthe Commission,the CSIRTs network and the competent authorities under the Union legal acts referred to in paragraph (1). The specifications shall ensure that:- Tabled by
- Damian Boeselager, Markéta Gregorová on behalf of the Verts/ALE Group
- Group
- Greens/EFA
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3
1762 ~Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “the national single-entry points”
(3) ENISA shall provide and implement the specifications on the technical, operational and organisational measures regarding the establishment, maintenance and secure operation of the single-entry point. ENISA shall develop the specifications in cooperation with the Commission, the CSIRTs network, the national single-entry points, and the competent authorities under the Union legal acts referred to in paragraph (1). The specifications shall ensure that:
- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – Paragraph 3
1763 −Deletion Alice Teodorescu Måwe +1EPP · ITRE–LIBE Deletes the proposed article
(a) the necessary capability for interoperability with regard to other relevant reporting obligations referred to in paragraph (1) is ensured;- Tabled by
- Alice Teodorescu Måwe, Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 17
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3
1764 ~Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “and between the national points of entry”
(a) the necessary capability for interoperability with regard to other relevant reporting obligations referred to in paragraph (1) and between the national points of entry is ensured;
- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 17
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3
1765 −Deletion Alice Teodorescu Måwe +1EPP · ITRE–LIBE Deletes the proposed article
(b) technical arrangements for the relevant entities and authorities under the Union legal acts referred to in paragraph (1) to access, submit , retrieve, transmit or otherwise process information from the single-entry point, are in place and, provide technical protocols and tools that allow the entities and authorities to further process the receive information within their systems;- Tabled by
- Alice Teodorescu Måwe, Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3 – point b
1766 ~Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “through their national point of entry”
(b) technical arrangements for the relevant entities and authorities under the Union legal acts referred to in paragraph (1) to access, submit , retrieve, transmit or otherwise process information through their national point of entry from the single-entry point, are in place and, provide technical protocols and tools that allow the entities and authorities to further process the receive information within their systems;
- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 18
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3 – point b
1767 −Deletion Alice Teodorescu Måwe +1EPP · ITRE–LIBE Deletes the proposed article
(c) the specificities of the incident reporting requirements set out under the Union legal acts referred to in paragraph (1) are duly taken into account;- Tabled by
- Alice Teodorescu Måwe, Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3 – point c
1768 −Deletion Alice Teodorescu Måwe +1EPP · ITRE–LIBE Deletes the proposed article
(d) where relevant, the single-entry point is interoperable and compatible with European Business Wallets referred to in [Proposal for a Regulation: Insert title of the proposal] and that the European Business Wallets can be used at least to identify and authenticate entities using the single-entry point;- Tabled by
- Alice Teodorescu Måwe, Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 19
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3 – point d
1769 ~Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “national points of entry and the EU entry”
(d) where relevant, the
single-entrynational points of entry and the EU entry pointisare interoperable and compatible with European Business Wallets referred to in [Proposal for a Regulation: Insert title of the proposal] and that the European Business Wallets can be used at least to identify and authenticate entities using the single-entry point;- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3 – point d
1770 −Deletion Alice Teodorescu Måwe +1EPP · ITRE–LIBE Deletes the proposed article
(e) entities using the single-entry point can retrieve and supplement information that they have previously submitted via the single-entry point;- Tabled by
- Alice Teodorescu Måwe, Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 20
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3 – point e
1771 ~Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “entities using a national point of entry can retrieve and supplement information that they have previously submitted via the single-entry point;”
(e) entities using
theasingle-entrynational point of entry can retrieve and supplement information that they have previously submitted via the single-entry point;- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3 – point e
1772 −Deletion Alice Teodorescu Måwe +1EPP · ITRE–LIBE Deletes the proposed article
(f) a single notification of information submitted by an entity via the single-entry point can be used to fulfil reporting obligations as set out under any of the other Union legal acts which provide for incident reporting to the single-entry point.- Tabled by
- Alice Teodorescu Måwe, Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 21
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3 – point f
1773 ~Alternative Aura Salla +4EPP · ITRE–LIBE “In line with the principle of administrative simplification and the ‘report-once’ policy, it is necessary to avoid duplicative reporting obligations…”
(f) a single notification of information submitted by an entity via the single-entry point can be used to fulfil reporting obligations as set out under any of the other Union legal acts which provide for incident reporting to the single-entry point, and shall, to the greatest extent possible, enable entities to comply with existing reporting obligations under Union law, including Regulation (EU) 2022/2554 (DORA) and without requiring the resubmission of information already provided under other reporting frameworks.. In line with the principle of administrative simplification and the 'report-once' policy, it is necessary to avoid duplicative reporting obligations for financial entities that are already subject to stringent operational resilience requirements. Where a financial entity submits an incident report under Regulation (EU) 2022/2554 [DORA], that submission should be considered sufficient to satisfy the reporting requirements under the Regulation (EU) 2024/2847 [CRA]. This approach ensures regulatory coherence, legal clarity and reduces the compliance burden on the financial sector.
- Tabled by
- Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Paulo Cunha, Christian Ehler
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3 – point f
1774 ~Alternative Damian Boeselager +1Greens/EFA · ITRE–LIBE “authorities provided that the report is submitted within the applicable legal deadline”
(f) a single notification of information submitted by an entity via the single-entry point
canshallbeconstituteusedtimely submission tofulfilallreportingcompetentobligationsauthorities provided that the report is submitted within the applicable legal deadline as set out under any of the other Union legal acts which provide for incident reporting to the single-entry point.- Tabled by
- Damian Boeselager, Markéta Gregorová on behalf of the Verts/ALE Group
- Group
- Greens/EFA
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 22
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3 – point f
1779 +Addition Michael McNamara +5Renew · ITRE–LIBE “notifications submitted in English are allowed, at least for the first notification (fb) the single entry-point has the ability to save a partially…”
(3a) In Article 23a, paragraph 3, the following points are added
(fa)notifications submitted in English are allowed, at least for the first notification
(fb)the single entry-point has the ability to save a partially completed notification as a draft, allows for multi-user colloberative access, and offers an automated notification systems to alert reporting entities of upcoming compliance deadlines.'
- Tabled by
- Michael McNamara, Irena Joveva, Sophie Wilmès, Oihane Agirregoitia Martínez, Bart Groothuis, Veronika Cifrová Ostrihoňová
- Group
- Renew
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 25
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3 – points fa and fb
1783 ~Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “The substantive receipt and processing of notifications shall take place at the level of the competent national authorities.”
(4) Unless provided for in the Union legal acts referred to in paragraph (1) of this, ENISA shall not have access to the notifications submitted through
thenational single-entrypointpoints. The substantive receipt and processing of notifications shall take place at the level of the competent national authorities.- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 27
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – Paragraph 4
1784 ~Alternative Henrik DahlEPP · ITRE–LIBE “of their Member State of main establishment”
(4)
Unless provided for in the Union legal acts referred to in paragraph (1) of this, ENISA shall not have access to the notifications submitted through the single-entry point.Entities shall submit incident notifications within 96 hours to the national singleentry point of their Member State of main establishment.- Tabled by
- Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 27
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 4
1785 ~Alternative Alice Teodorescu Måwe +1EPP · ITRE–LIBE “of their Member State of main establishment”
(4)
Unless provided for in the Union legal acts referred to in paragraph (1) of this, ENISA shall not have access to the notifications submitted through the single-entry point.Entities shall submit incident notifications within 96 hours to the national single entry point of their Member State of main establishment.- Tabled by
- Alice Teodorescu Måwe, Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 4
1789 ~Alternative Henrik DahlEPP · ITRE–LIBE “The competent authorities, including CSIRTs, shall process the notifications and, where required under Union law, transmit relevant information to…”
(5)
Within [18] months from the entry into force of this Regulation, ENISA shall pilot the functioning of the single-entry point for each added Union legal act, including testing that takes into account the specificities and requirements for the notifications set out by each respective Union legal act, and after consulting the Commission and the relevant competent authorities under the respective Union legal acts.The competent authorities, including CSIRTs, shall process the notifications and, where required under Union law, transmit relevant information to ENISA.ENISA shall enable the notification of incidents under each Union legal act referred to in paragraph (1) only after piloting the functioning and after the Commission published a notice pursuant to paragraph 6.Entities shall not be required to report directly to ENISA.- Tabled by
- Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 30
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 5
1790 ~Alternative Alice Teodorescu Måwe +1EPP · ITRE–LIBE “The competent authorities, including CSIRTs, shall process the notifications and, where required under Union law, transmit relevant information to…”
(5)
Within [18] months from the entry into force of this Regulation, ENISA shall pilot the functioning of the single-entry point for each added Union legal act, including testing that takes into account the specificities and requirements for the notifications set out by each respective Union legal act, and after consulting the Commission and the relevant competent authorities under the respective Union legal acts.The competent authorities, including CSIRTs, shall process the notifications and, where required under Union law, transmit relevant information to ENISA.ENISA shall enable the notification of incidents under each Union legal act referred to in paragraph (1) only after piloting the functioning and after the Commission published a notice pursuant to paragraph 6.Entities shall not be required to report directly to ENISA.- Tabled by
- Alice Teodorescu Måwe, Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 5
1791 ~Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “Within [18] months from the entry into force of this Regulation, ENISA shall pilot the functioning of the EU and national single-entry points for…”
(5) Within [18] months from the entry into force of this Regulation, ENISA shall pilot the functioning of the EU and national single-entry
pointpoints for each added Union legal act, including testing that takes into account the specificities and requirements for the notifications set out by each respective Union legal act, and after consulting the Commission and the relevant competent authorities under the respective Union legal acts. ENISA shall enable the notification of incidents under each Union legal act referred to in paragraph (1) only after piloting the functioning and after the Commission published a notice pursuant to paragraph 6.- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 31
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 5
1792 ~Alternative Alice Teodorescu Måwe +1EPP · ITRE–LIBE “ensure interoperability between national single-entry points”
(6)
The Commission shall, in cooperation with ENISA, assess the proper functioning, reliability, integrity and confidentiality of the single-entry point.Member States shall ensure interoperability between national single-entry points, including secure and automated transmission of information where crossborder notifications are required.When the Commission, after consultation of the CSIRTs network and the competent authorities under the Union legal acts referred to in paragraph 1, finds that the single-entry point ensures the proper functioning, reliability, integrity and confidentiality, it shall publish a notice to that effect in the Official Journal of the European Union.- Tabled by
- Alice Teodorescu Måwe, Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 6
1793 ~Alternative Henrik DahlEPP · ITRE–LIBE “ensure interoperability between national single-entry points”
(6)
The Commission shall, in cooperation with ENISA, assess the proper functioning, reliability, integrity and confidentiality of the single-entry point.Member States shall ensure interoperability between national single-entry points, including secure and automated transmission of information where crossborder notifications are required.When the Commission, after consultation of the CSIRTs network and the competent authorities under the Union legal acts referred to in paragraph 1, finds that the single-entry point ensures the proper functioning, reliability, integrity and confidentiality, it shall publish a notice to that effect in the Official Journal of the European Union.- Tabled by
- Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 32
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 6
1794 ~Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “The Commission shall, in cooperation with ENISA, assess the proper functioning, reliability, integrity and confidentiality of the EU and national…”
(6) The Commission shall, in cooperation with ENISA, assess the proper functioning, reliability, integrity and confidentiality of the EU and national single-entry
pointpoints. When the Commission, after consultation of the CSIRTs network and the competent authorities under the Union legal acts referred to in paragraph 1, finds that the single-entry point ensures the proper functioning, reliability, integrity and confidentiality, it shall publish a notice to that effect in the Official Journal of the European Union.- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 33
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 6
1795 ~Alternative Michael McNamara +5Renew · ITRE–LIBE “The Commission shall, in cooperation with ENISA, assess the proper functioning, reliability, integrity, availability and confidentiality of the…”
(6) The Commission shall, in cooperation with ENISA, assess the proper functioning, reliability, integrity, availability and confidentiality of the single-entry point. When the Commission, after consultation of the CSIRTs network and the competent authorities under the Union legal acts referred to in paragraph 1, finds that the single-entry point ensures the proper functioning, reliability, integrity and confidentiality, it shall publish a notice to that effect in the Official Journal of the European Union.
- Tabled by
- Michael McNamara, Irena Joveva, Sophie Wilmès, Oihane Agirregoitia Martínez, Bart Groothuis, Veronika Cifrová Ostrihoňová
- Group
- Renew
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 6
1796 ~Alternative Henrik DahlEPP · ITRE–LIBE “and convergence by developing common technical standards and promoting a harmonised reporting template aligned”
(7)
Where the Commission finds in its assessment that the single-entry point does not ensure the proper functioning, reliability, integrity or confidentiality, ENISA shall take, in cooperation with the Commission and without undue delay, all necessary corrective measures to ensure the proper functioning, reliability, integrity or confidentiality without delay and inform the Commission of the results.ENISA shall support interoperability and convergence by developing common technical standards and promoting a harmonised reporting template aligned with international standards.Thereafter, the Commission shall reassess the proper functioning, reliability, integrity or confidentiality of the single-entry point and shall publish a notice in accordance with paragraph 6.- Tabled by
- Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 34
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 7
1797 ~Alternative Alice Teodorescu Måwe +1EPP · ITRE–LIBE “and convergence by developing common technical standards and promoting a harmonised reporting template aligned”
(7)
Where the Commission finds in its assessment that the single-entry point does not ensure the proper functioning, reliability, integrity or confidentiality, ENISA shall take, in cooperation with the Commission and without undue delay, all necessary corrective measures to ensure the proper functioning, reliability, integrity or confidentiality without delay and inform the Commission of the results.ENISA shall support interoperability and convergence by developing common technical standards and promoting a harmonised reporting template aligned with international standards.Thereafter, the Commission shall reassess the proper functioning, reliability, integrity or confidentiality of the single-entrypoint and shall publish a notice in accordance with paragraph 6.- Tabled by
- Alice Teodorescu Måwe, Henrik Dahl
- Group
- EPP
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 7
1798 ~Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “Where the Commission finds in its assessment that the EU and national single-entry points do not ensure the proper functioning, reliability…”
(7) Where the Commission finds in its assessment that the EU and national single-entry
pointpointsdoesdo not ensure the proper functioning, reliability, integrity or confidentiality, ENISA shall take, in cooperation with the Commission and without undue delay, all necessary corrective measures to ensure the proper functioning, reliability, integrity or confidentiality without delay and inform the Commission of the results. Thereafter, the Commission shall reassess the proper functioning, reliability, integrity or confidentiality of the single-entry point and shall publish a notice in accordance with paragraph 6.- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- NIS2 Directive Article 23a
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 35
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 7
New points in paragraph 1Establishment and purpose of ENISA’s reporting point3 amendments
507 +Addition Morten Løkkegaard +3Renew · IMCO “entities using the single-entry point receive an electronic confirmation of submission and, where appropriate, information on the competent…”
(ea)entities using the single-entry point receive an electronic confirmation of submission and, where appropriate, information on the competent authorities to which the notification has been transmitted;
Justification
Businesses need proof of compliance and clarity on where their report has gone.
- Tabled by
- Morten Løkkegaard, Svenja Hahn, Jeannette Baljeu, Sandro Gozi
- Group
- Renew
- Targets
- NIS2 Directive Article 23a – paragraph 1 – point e a (new)
- Document
- IMCO amendments 329–532 to the draft opinion
- Source
- Official text, page 110
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 1 – point e a (new)
1776 +Addition Bart Groothuis +7Renew · ITRE–LIBE “notifications submitted in English are allowed, at least for the first notification.'”
(fa) In Article 23a, paragraph 1, the following point is inserted
(fa)notifications submitted in English are allowed, at least for the first notification.'
- Tabled by
- Bart Groothuis, Ivars Ijabs, Morten Løkkegaard, Nikola Minchev, Svenja Hahn, Andreas Glück, João Cotrim De Figueiredo, Ana Vasconcelos
- Group
- Renew
- Targets
- NIS2 Directive Article 23a – paragraph 1 – point fa (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 23
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 1 – point fa (new)
1777 +Addition Bart Groothuis +7Renew · ITRE–LIBE “the single entry-point has the ability to save a partially completed notification as a draft, allows for multi-user colloberative access, and offers…”
(fb) In Article 23a, paragraph 1, the following point is added
(fa)the single entry-point has the ability to save a partially completed notification as a draft, allows for multi-user colloberative access, and offers an automated notification systems to alert reporting entities of upcoming compliance deadlines.'
- Tabled by
- Bart Groothuis, Ivars Ijabs, Morten Løkkegaard, Nikola Minchev, Svenja Hahn, Andreas Glück, João Cotrim De Figueiredo, Ana Vasconcelos
- Group
- Renew
- Targets
- NIS2 Directive Article 23a – paragraph 1 – point fb (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 1 – point fb (new)
New points in paragraph 3Technical specifications for the single-entry point1 amendment
1775 +Addition Damian Boeselager +1Greens/EFA · ITRE–LIBE “technical measures include at least: i. end-to-end encryption; ii. zero-trust architecture; iii. compartmentalisation; iv. mandatory audits and…”
(fa)In Article 23, paragraph 3, the following point is added:
technical measures include at least:
i.end-to-end encryption;
ii.zero-trust architecture;
iii.compartmentalisation;
iv.mandatory audits and penetration testing;
- Tabled by
- Damian Boeselager, Markéta Gregorová on behalf of the Verts/ALE Group
- Group
- Greens/EFA
- Targets
- NIS2 Directive Article 23a – paragraph 3 – point fa (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3 – point fa (new)
New paragraphs15 amendments
76 +Addition Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “The Commission shall, by means of implementing acts, develop a common notification template for the single-entry point covering the Union acts…” numbered 3a
(3a)The Commission shall, by means of implementing acts, develop a common notification template for the single-entry point covering the Union acts referred to in paragraph 1 that provide for notification through that single-entry point. It shall enable entities to submit a single notification to fulfil multiple reporting obligations. When preparing the draft implementing acts, the Commission shall consult ENISA, the Cooperation Group, the network of computer security incident response teams (CSIRTs Network) and, where relevant, other competent authorities responsible for the Union legal acts concerned;
- Rapporteurs
- Aura Salla and Marina Kaljurand
- Group
- Rapporteurs
- Targets
- NIS2 Directive Article 23a – paragraph 3a (new)
- Document
- ITRE–LIBE draft report
- Source
- Official text, page 50
- Printed header
- Article 6 – paragraph 1 – point 1 (new) / Directive (EU) 2022/2555 / Article 23a – paragraph 3 a (new)
1747 +Addition Julie Rechagneux +8ECR, PfE · ITRE–LIBE “The EU entry point shall build on existing national reporting systems and shall ensure the secure routing and interoperability of notifications…” numbered 1a
(1a) In Article 23a, the following paragraph is inserted:
The EU entry point shall build on existing national reporting systems and shall ensure the secure routing and interoperability of notifications between reporting entities and the competent national authorities, without centralising the storage of those notifications within a single body. The role of ENISA is limited to the technical operation, routing and format and completeness check of the notifications; ENISA is not a recipient of the notifications for substantive purposes.'
- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- NIS2 Directive Article 23a – Paragraph 1a (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, pages 6–7
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – Paragraph 1a (new)
1748 +Addition Michael McNamara +5Renew · ITRE–LIBE “ENISA shall forward the information submitted or disseminated via the single-entry point according to the relevant Union legal acts to the competent…” numbered 1a
(1a) In Article 23a, the following paragraph is inserted:
ENISA shall forward the information submitted or disseminated via the single-entry point according to the relevant Union legal acts to the competent authorities in the relevant Member State or Member States.'
- Tabled by
- Michael McNamara, Irena Joveva, Sophie Wilmès, Oihane Agirregoitia Martínez, Bart Groothuis, Veronika Cifrová Ostrihoňová
- Group
- Renew
- Targets
- NIS2 Directive Article 23a – Paragraph 1a (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 7
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 1a (new)
1749 +Addition Michael McNamara +5Renew · ITRE–LIBE “ENISA should take into account existing such national technical solutions when developing the specifications on the technical, operational and…” numbered 1b
(1b) In Article 23a, the following paragraph is inserted:
ENISA should take into account existing such national technical solutions when developing the specifications on the technical, operational and organisational measures necessary to establish, maintain and securely operate the single-entry point to ensure continuity and interoperability.'
- Tabled by
- Michael McNamara, Irena Joveva, Sophie Wilmès, Oihane Agirregoitia Martínez, Bart Groothuis, Veronika Cifrová Ostrihoňová
- Group
- Renew
- Targets
- NIS2 Directive Article 23a – paragraph 1b (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, pages 7–8
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 1b (new)
1755 +Addition Michael McNamara +4Renew · ITRE–LIBE “The Commission shall, by means of delegated act, develop one European notification template for the single-entry point. The European notification…”
(2a) In Article 23a, the following paragraph is inserted:
The Commission shall, by means of delegated act, develop one European notification template for the single-entry point. The European notification template shall:
(a)enable entities to submit a single notification to fulfil multiple reporting obligations;
(b)harmonize reporting timelines, deadlines, thresholds and, where possible, other data relevant to the reporting obligations covered in, at leat, Directive (EU) 2022/2555 (NIS2), Regulation (EU) 2016/679 (GDPR, Directive (EU) 2022/2557 (CER), Regulation (EU) No 910/2014 (eIDAS), Regulation (EU) 2022/2554 (DORA), Regulation (EU) 2024/2847 (Cyber Resilience Act);
(c)consist of a core section of data points applicable across all reporting obligations from relevant Union legal acts under point (b), that may be complemented by modular extensions that incorporate sectoral or other data fields specific to a particular Union legal act.
In preparing the template, the Commission shall carry out a mapping of the Union’s reporting timelines, deadlines, thresholds and other data points relevant to the reporting obligations under point (b), in coopreration with ENISA, the CSIRTs Network and, where relevant, other competent authorities responsible for the Union legal acts concerned. The mapping shall provide an analysis of the extent to which reporting timelines, deadlines, thresholds and other data points relevant to the reporting obligations can be harmonized.'
- Tabled by
- Michael McNamara, Irena Joveva, Sophie Wilmès, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová
- Group
- Renew
- Targets
- NIS2 Directive Article 23a – paragraph 2a (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 2a (new)
1756 +Addition Bart Groothuis +9Renew · ITRE–LIBE “The Commission shall, by means of delegated act, develop one European notification template for the single-entry point. The European notification…”
(2a) In Article 23a, the following paragraph is inserted:
The Commission shall, by means of delegated act, develop one European notification template for the single-entry point. The European notification template shall:
(a)enable entities to submit a single notification to fulfil multiple reporting obligations;
(b)harmonize reporting timelines, deadlines, thresholds and, where possible, other data relevant to the reporting obligations covered in, at leat, Directive (EU) 2022/2555 (NIS2), Regulation (EU) 2016/679 (GDPR, Directive (EU) 2022/2557 (CER), Regulation (EU) No 910/2014 (eIDAS), Regulation (EU) 2022/2554 (DORA), Regulation (EU) 2024/2847 (Cyber Resilience Act), Regulation (EU) 2024/1689 (AI Act);
(c)consist of a core section of data points applicable across all reporting obligations from relevant Union legal acts under point (b), that may be complemented by modular extensions that incorporate sectoral or other data fields specific to a particular Union legal act.
In preparing the template, the Commission shall carry out a mapping of the Union’s reporting timelines, deadlines, thresholds and other data points relevant to the reporting obligations under point (b), in coopreration with ENISA, the CSIRTs Network and, where relevant, other competent authorities responsible for the Union legal acts concerned. The mapping shall provide an analysis of the extent to which reporting timelines, deadlines, thresholds and other data points relevant to the reporting obligations can be harmonized.'
- Tabled by
- Bart Groothuis, Ivars Ijabs, Morten Løkkegaard, Sophie Wilmès, Nikola Minchev, Svenja Hahn, Andreas Glück, Katri Kulmuni, João Cotrim De Figueiredo, Ana Vasconcelos
- Group
- Renew
- Targets
- NIS2 Directive Article 23a – paragraph 2a (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 2a (new)
1778 +Addition Elena Sancho Murillo +7S&D · ITRE–LIBE “The Commission should, by means of implementing acts, develop a common notification template for the single-entry point covering the Union Acts…” numbered 3a
(3a) In Article 23a, the following paragraph is inserted:
The Commission should, by means of implementing acts, develop a common notification template for the single-entry point covering the Union Acts referred to in paragraph (1) that provide for notification through this single-entry point. It shall enable entities to submit a single notification to fulfil multiple reporting obligations, including, where technically feasible, through interoperable reporting channels designed to reduce duplication of reporting obligations. In preparing the draft implementing acts, the Commission shall cooperate with ENISA, the Cooperation Group, the CSIRTs Network and, where relevant, other competent authorities responsible for the Union legal acts concerned.'
- Tabled by
- Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Matthias Ecke, Lina Gálvez, Francisco Assis, Alex Agius Saliba
- Group
- S&D
- Targets
- NIS2 Directive Article 23a – paragraph 3a (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3a (new)
1780 +Addition Katri KulmuniRenew · ITRE–LIBE “Entities shall submit incident notifications within 96 hours to the national single-entry point of their Member State of main establishment.'” numbered 3a
(3a) In Article 23a, the following paragraph is inserted:
Entities shall submit incident notifications within 96 hours to the national single-entry point of their Member State of main establishment.'
- Tabled by
- Katri Kulmuni
- Group
- Renew
- Targets
- NIS2 Directive Article 23a – paragraph 3a (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3a (new)
1781 +Addition Katri KulmuniRenew · ITRE–LIBE “Member States shall ensure interoperability between national single-entry points, including secure and automated transmission of information where…” numbered 3b
(3b) In Article 23a, the following paragraph is inserted:
Member States shall ensure interoperability between national single-entry points, including secure and automated transmission of information where cross-border notifications are required.'
- Tabled by
- Katri Kulmuni
- Group
- Renew
- Targets
- NIS2 Directive Article 23a – paragraph 3b (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 26
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3b (new)
1782 +Addition Katri KulmuniRenew · ITRE–LIBE “ENISA shall support interoperability and convergence by developing common technical standards and promoting a harmonised reporting template aligned…” numbered 3c
(3c) In Article 23a, the following paragraph is inserted:
ENISA shall support interoperability and convergence by developing common technical standards and promoting a harmonised reporting template aligned with international standards.'
- Tabled by
- Katri Kulmuni
- Group
- Renew
- Targets
- NIS2 Directive Article 23a – paragraph 3c (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 26
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 3c (new)
Show 5 more amendments
1787 +Addition Damian Boeselager +1Greens/EFA · ITRE–LIBE “Where the same incident triggers notification obligations under more than one Union legal act, the Member states shall designate a coordinating…” numbered 4a
(4a) In Article 23a, the following paragraph is inserted:
Where the same incident triggers notification obligations under more than one Union legal act, the Member states shall designate a coordinating competent authority responsible for coordinating requests for additional information and ensuring coherent communication with the reporting entity. The coordinating competent authority will be notified to ENISA and be included in the single-entry point system.'
- Tabled by
- Damian Boeselager, Markéta Gregorová on behalf of the Verts/ALE Group
- Group
- Greens/EFA
- Targets
- NIS2 Directive Article 23a – paragraph 4a (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 4a (new)
1788 +Addition Damian Boeselager +1Greens/EFA · ITRE–LIBE “ENISA in cooperation with the coordinating competent authorities shall create a database of cases and where relevant publish at least anonymised…” numbered 4b
(4b) In Article 23a, the following paragraph is inserted:
ENISA in cooperation with the coordinating competent authorities shall create a database of cases and where relevant publish at least anonymised threat intelligence, lessons learned, mitigation advice.'
- Tabled by
- Damian Boeselager, Markéta Gregorová on behalf of the Verts/ALE Group
- Group
- Greens/EFA
- Targets
- NIS2 Directive Article 23a – paragraph 4b (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 29
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 4b (new)
1799 +Addition Damian Boeselager +1Greens/EFA · ITRE–LIBE “The Commission shall adopt implementing acts establishing a common Union incident reporting data model and interoperable technical specifications for…” numbered 7a
(7a) In Article 23a, the following paragraph is added:
The Commission shall adopt implementing acts establishing a common Union incident reporting data model and interoperable technical specifications for all reporting obligations covered by this Regulation. The implementing act shall include a EU-wide incident taxonomy including common incident categories, common severity levels, common terminology.'
- Tabled by
- Damian Boeselager, Markéta Gregorová on behalf of the Verts/ALE Group
- Group
- Greens/EFA
- Targets
- NIS2 Directive Article 23a – paragraph 7a (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 36
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 7a (new)
1802 +Addition François-Xavier BellamyEPP · ITRE–LIBE “ENISA shall develop and maintain a single point of contact to provide an overview of regulatory obligations regarding incident reporting, and to…” numbered 1a
1a.ENISA shall develop and maintain a single point of contact to provide an overview of regulatory obligations regarding incident reporting, and to direct users to the various national reporting platforms.
This incident reporting information point shall identify the applicable reporting obligations, the direction to the appropriate national entry point, and make available simplified and documented information on incident notification processes in the different Member States.
The incident reporting information point shall not collect any information allowing the identification of the notifying entity or of any incident. Member States shall endeavour to design their national entry point with a view to making the national entry points interoperable with the national entry points of other Member States, to facilitate the alignment of incident notifications with cross-border reporting obligations.
- Tabled by
- François-Xavier Bellamy
- Group
- EPP
- Targets
- NIS2 Directive Article 23a – Paragraph 1a (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 a (new) / Directive (EU) 2022/2555 / Article 23a – paragraph 1a (new)
1805 +Addition François-Xavier BellamyEPP · ITRE–LIBE “By 6 months after the entry into force of this Regulation, the Commission shall submit a report to the European Parliament and to the Council…” numbered 1b
1b.By 6 months after the entry into force of this Regulation, the Commission shall submit a report to the European Parliament and to the Council outlining common elements and differences in definitions, thresholds, deadlines, formats and procedures applying to Article 23 of Directive (EU) 2022/2555, Article 19a (1a), Article 24 (2a) and Article 45a (3a) of Regulation (EU) 910/2014, Article 33 (1) of Regulation (EU) 2016/679, Article 19 (1) and (2) of Regulation (EU) 2022/2554, and Article 15(1) of Directive (EU) 2022/2557.
The report shall in particular consider concrete steps and a timeline for introducing the unified approach to incident reporting under the Union legal acts.
- Tabled by
- François-Xavier Bellamy
- Group
- EPP
- Targets
- NIS2 Directive Article 23a – paragraph 1b (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 6 – paragraph 1 – point 1 b (new) / Directive (EU) 2022/2555 / Article 23a – paragraph 1b (new)
New points3 amendments
510 +Addition Sophia KircherEPP · IMCO “The Commission should, by means of implementing acts, develop a common notification template for the single-entry point covering core elements…” numbered 3a
(3a)The Commission should, by means of implementing acts, develop a common notification template for the single-entry point covering core elements re-quired under Union legal acts that provide for notification through this single-entry point. It shall enable entities to submit a single notification to fulfil multiple reporting obligations. In preparing the draft implementing acts, the Commission shall cooperate with ENISA, the Cooperation Group, the CSIRTs Network and, where relevant, other competent authorities responsible for the Union legal acts concerned.
- Tabled by
- Sophia Kircher
- Group
- EPP
- Targets
- NIS2 Directive Article 23a – paragraph 1 – point 3 a (new)
- Document
- IMCO amendments 329–532 to the draft opinion
- Source
- Official text, page 112
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 1 – point 3 a (new)
511 +Addition Morten Løkkegaard +2Renew · IMCO “Member States shall not require entities to submit the same information through additional national reporting channels, portals or formats where that…” numbered 3a
(3a)Member States shall not require entities to submit the same information through additional national reporting channels, portals or formats where that information has been submitted through the single-entry point in accordance with this Article, unless strictly necessary for reasons of national security and duly justified.
Justification
Avoids gold-plating and ensures the single-entry point does not become the 28th portal on top of 27 national ones.
- Tabled by
- Morten Løkkegaard, Svenja Hahn, Sandro Gozi
- Group
- Renew
- Targets
- NIS2 Directive Article 23a – paragraph 1 – point 3 a (new)
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – paragraph 1 – point 3 a (new)
1786 +Addition Aura Salla +3EPP · ITRE–LIBE “The establishment and operation of a single-entry point represent a critical technical milestone for the Union’s cybersecurity related incidents…” numbered 4a
(4a) In Article 23a, the following paragraph is inserted:
4a.The establishment and operation of a single-entry point represent a critical technical milestone for the Union’s cybersecurity related incidents notification framework. To ensure that the specifications developed by ENISA are technically robust, future-proof, and operationally viable, it is essential that the drafting process remains open and transparent. Therefore, ENISA should consult not only with national authorities but also with relevant industry representatives.'
- Tabled by
- Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Christian Ehler
- Group
- EPP
- Targets
- NIS2 Directive Article 23a – point 4a (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 28
- Printed header
- Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23a – point 4a (new)