Recital 49a (new)

4 would add wording.

1. 11 +Addition Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “To ensure that Directive (EU) 2022/2555 is applied consistently and proportionately across the Union and in line with the principle of administrative…” numbered 49a

   (49a)To ensure that Directive (EU) 2022/2555 is applied consistently and proportionately across the Union and in line with the principle of administrative simplification and the ‘report-once’ policy, duplicative or unclear reporting obligations or diverging national interpretations and additional obligations should be avoided. The Commission should, in cooperation with the Cooperation Group referred to in Article 14 of Directive (EU) 2022/2555 and the European Union Agency for Cybersecurity (ENISA), issue guidance on the harmonised interpretation and application of key obligations under that Directive.

   Rapporteurs

   Aura Salla and Marina Kaljurand

   Group

   Rapporteurs

   Targets

   Digital Omnibus proposal Recital 49a (new)

   Document

   ITRE–LIBE draft report

   Source

   Official text, page 16

   Printed header

   Recital 49 a (new)

   Links

   Link to this amendment
   Cite this amendment

2. 495 +Addition Julie Rechagneux +9ECR, PfE · ITRE–LIBE “The layered single-entry points structure should not result in the centralisation, within a single body, of the storage and processing of incident…” numbered 49a

   (49a)The layered single-entry points structure should not result in the centralisation, within a single body, of the storage and processing of incident notifications. In accordance with the principles of subsidiarity and proportionality, and in order to avoid creating a single point of failure that could itself become a target for cybersecurity threats, the single-entry point should be designed as a layered architecture. ENISA should provide a common interface enabling entities to submit a single notification, while the competent authorities designated under the relevant Union legal acts should remain responsible, at national level, for receiving, accessing and processing the information relating to incidents within their respective fields of competence. The EU entry point should accordingly act as a means of routing and interoperability between entities and the competent national authorities, building on the technical solutions and reporting systems already in place at national level, rather than as a centralised repository. The role of ENISA should be limited to the technical operation, routing and format check of the notifications, ENISA not being a recipient of the notifications for substantive purposes. Where ENISA receives information directly that may be relevant for the performance of the tasks of the competent national authorities, it should transmit such information without undue delay to the authorities concerned.

   Justification

   A single database of incident notifications would by its very nature be a target of the first order. The layered architecture preserves the proximity and expertise of national authorities while delivering, for reporting entities, the benefit of a single interface.

   Tabled by

   Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay

   Group

   ECR, PfE

   Targets

   Digital Omnibus proposal Recital 49a (new)

   Document

   ITRE–LIBE amendments 401–526 to the draft report

   Source

   Official text, pages 82–83

   Printed header

   Recital 49 a (new)

   Links

   Link to this amendment
   Cite this amendment

3. 496 +Addition Elena Sancho Murillo +7S&D · ITRE–LIBE “To ensure that Directive (EU) 2022/2555 is applied consistently and proportionately across the Union and in line with the principle of administrative…” numbered 49a

   (49a)To ensure that Directive (EU) 2022/2555 is applied consistently and proportionately across the Union and in line with the principle of administrative simplification and the ‘report-once’ policy, duplicative or unclear reporting obligations or diverging national interpretations and additional obligations should be avoided. The Commission should, in cooperation with the Cooperation Group referred to in Article 14 of Directive (EU) 2022/2555 and the European Union Agency for Cybersecurity (ENISA), issue guidance on the harmonised interpretation and application of key obligations under that Directive. These guidelines shall be developed under the relevant sectorial legislation.

   Justification

   The development of detailed guidance on sector-specific cybersecurity obligations should be addressed in the context of the revision of the Cybersecurity Act, which provides the appropriate framework for considering horizontal cybersecurity governance, certification and related guidance mechanisms. This approach ensures coherence between Directive (EU) 2022/2555 and the evolving Union cybersecurity framework, while allowing sector-specific legislation to define requirements reflecting the specific risks and operational characteristics of each sector. It also avoids duplication, divergent interpretations and additional administrative burdens for entities subject to multiple cybersecurity obligations.

   Tabled by

   Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Matthias Ecke, Lina Gálvez, Francisco Assis, Alex Agius Saliba

   Group

   S&D

   Targets

   Digital Omnibus proposal Recital 49a (new)

   Document

   ITRE–LIBE amendments 401–526 to the draft report

   Source

   Official text, pages 83–84

   Printed header

   Recital 49 a (new)

   Links

   Link to this amendment
   Cite this amendment

4. 497 +Addition Michael McNamara +5Renew · ITRE–LIBE “ENISA’s role in the reporting process is limited to establishing and operating the single-entry point portal and routing reports to the competent…” numbered 49a

   (49a)ENISA’s role in the reporting process is limited to establishing and operating the single-entry point portal and routing reports to the competent CSIRT(s) without having access to the content of incident reports. Responsibility for the management and follow-up of incident reports remains with the national CSIRTs or competent authorities to which ENISA directs them.

   Tabled by

   Michael McNamara, Irena Joveva, Sophie Wilmès, Oihane Agirregoitia Martínez, Bart Groothuis, Veronika Cifrová Ostrihoňová

   Group

   Renew

   Targets

   Digital Omnibus proposal Recital 49a (new)

   Document

   ITRE–LIBE amendments 401–526 to the draft report

   Source

   Official text, page 84

   Printed header

   Recital 49 a (new)

   Links

   Link to this amendment
   Cite this amendment