Article 23b – National entry point for incident reporting

Member States shall establish and maintain a national entry point for the reporting of incidents and related events under the Union legal acts where those Union legal acts provide so. The national entry point shall allow for at least one of the following tasks, depending on national organisational arrangements: (a) enabling the submission of notifications at national level; (b) receiving and processing notifications submitted by entities; (c) ensuring or facilitating access to such notifications for the competent authorities under the relevant Union act; (d) transmitting or making available relevant information to other national authorities, where foreseen under Union or national law;

The national entry point may also carry out the following tasks: (a) supporting coordination among competent authorities in relation to reported incidents or information; (b) providing guidance or assistance to entities regarding notification procedures; (c) performing any other function necessary to facilitate the effective management and sharing of notifications at national level.

Member States shall retain flexibility to configure their national entry point in accordance with their existing national structures and the allocation of competences among authorities, including by connecting existing systems and enabling the sharing, routing or distribution of relevant information.

Member States shall endeavor to design their national entry point with a view to making the national entry points interoperable with the national entry points of other Member States.

ENISA shall, by [12 months from the date of entry into force of this amending Regulation], in consultation with the CSIRTs network, the Cooperation Group and other relevant bodies or groups established at Union level under relevant Union legal acts[VH1] provide non-binding recommendations to support Member States in the establishment, maintenance and secure operation of their respective national entry point. Those recommendations shall address technical, operational and organisational measures, taking into account experiences and lessons learned from existing reporting structures. Those recommendations shall include technical specifications to ensure interoperability between all Member States’ national entry points as referred to in paragraph 3 and to facilitate the alignment of incident notifications submitted via their respective national entry point with cross-border reporting obligations.

ENISA shall, by [18 months from the date of entry into force of this amending Regulation], in cooperation with Member States, develop an open-source solution that may be used by Member States in setting up their national entry point in accordance with paragraph 1, with the objective of strengthening interoperability between national systems and enable faster, more effective cross-border data sharing when a situation requires coordinated action.