Article 23a

Single-entryEuropean point of entry for incident reporting

(1) ENISA shall develop and maintain a single-entry point to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so (‘single-entry point’).ENISA may develop and maintain a point of entry to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so (‘Union point of entry’). ENISA shall act as the single European coordination point between the national single points of entry established or appointed by the Member States, while guaranteeing their interoperability and the secure routing of notifications; it shall not function as a centralised point for the actual receipt, transmission or storage of notifications. Without prejudice to Article 16 of Regulation (EU) 2024/2847 of the European Parliament and of the Council, ENISA may ensure that coordination between the single-entrynational pointpoints of entry builds on the single reporting platform established for the Member States under that Regulation.

(2) ENISA shall take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the single-entry point and the information submitted or disseminated via the single-entry point. ENISA shall take into account the sensitivity of information submitted or disseminated pursuant to the Union legal acts referred to in paragraph (1), including information concerning vulnerabilities, mitigation measures, ransomware demands, payment information or other commercially or legally sensitive information, and shall ensure that such information is subject to appropriate confidentiality, professional secrecy, access-control and data minimisation safeguards, while ensuring that competent authorities under those Union legal acts have access to and process the information as required under those Union legal acts.

Justification

Sensitive incident information, including information related to vulnerabilities, mitigation measures and ransomware, must be protected by strong confidentiality and access-control safeguards. This is necessary to build trust in the single-entry point and to avoid underreporting by entities operating across the Single Market.

(2) ENISA and the national points of entry, each within their respective responsibilities, shall take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the single-entry point and the information submitted or disseminated via the single-entrythis point. ENISA and the national points of entry shall take into account the sensitivity of information submitted or disseminated pursuant to the Union legal acts referred to in paragraph (1) and ensure that competent authorities under those Union legal acts have access to and process the information as required under those Union legal acts.

(3) ENISA shall provide and implement the specifications on the technical, operational and organisational measures regarding the establishment, maintenance and secure operation of the single-entry point. ENISA shall develop the specifications in cooperation with the Commission, the CSIRTs network, the national single points of entry and the competent authorities under the Union legal acts referred to in paragraph (1). The specifications shall ensure that:

Justification

Businesses need proof of compliance and clarity on where their report has gone.

(f) a single notification of information submitted by an entity via the single-entry point can be used to fulfil reporting obligations as set out under any of the other Union legal acts which provide for incident reporting to the single-entry point and shall, to the greatest extent possible, enable entities to comply with existing reporting obligations under Union law, including Regulation (EU) 2022/2554 (DORA) and without requiring the resubmission of information already provided under other reporting frameworks.

Justification

As companies and organisations are currently integrating NIS2 requirements into their processes as part of the ongoing national implementation, companies should be able to fulfil existing reporting obligations through the same mechanism, to avoid creating additional administrative burden or duplicate reporting requirements

(f) a single notification of information submitted by an entity via the single-entry point canshould be used to fulfil reporting obligations as set out under any of the other Union legal acts which provide for incident reporting to the single-entry point.

Justification

‘Can be used’ is too weak. The whole political point is that one report should legally count as one report.

Justification

Avoids gold-plating and ensures the single-entry point does not become the 28th portal on top of 27 national ones.

(4) Unless provided for in the Union legal acts referred to in paragraph (1) of this, ENISA shall not have access to the notifications submitted through the single-entrynational pointsingle points of entry. The notifications shall be received and handled substantively at the level of the national competent authorities.

(5) Within [18] months from the entry into force of this Regulation, ENISA shall pilot the functioning of the single-entrynational pointsingle points of entry for each added Union legal act, including testing that takes into account the specificities and requirements for the notifications set out by each respective Union legal act, and after consulting the Commission and the relevant competent authorities under the respective Union legal acts. ENISA shall enable the notification of incidents under each Union legal act referred to in paragraph (1) only after piloting the functioning and after the Commission published a notice pursuant to paragraph 6.