Article 23a – Incident reporting information point

ENISA shall develop and maintain an incident reporting information point to support the identification and fulfilment of the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so (‘incident reporting information point’).

The incident reporting information point shall:

be designed to allow, on the basis of relevant information provided, the identification of the applicable reporting obligations referred to in paragraph 1 and the direction to the appropriate national entry point referred in Article 23b, and (c) make available simplified and documented information on incident notification processes in the different Member States. (3) When developing the incident reporting information point, ENISA shall consult the relevant national competent authorities under the relevant Union legal acts, the Cooperation Group, the CSIRT Network and other relevant bodies or groups established at Union level under relevant Union legal acts. ENISA shall establish structured communication channels to ensure that information available on the incident reporting information point is swiftly and effectively updated. Member States shall communicate to ENISA all relevant and necessary information for the purpose of paragraph 1a. (4) The incident reporting information point shall not enable the submission, transmission, storage or processing of any incident notification or related data, and shall not collect any information allowing the identification of the notifying entity or of any incident. (5) After establishing the incident reporting information point and in cooperation with the Cooperation Group, ENISA shall explore the possibility to extend the incident reporting information point by providing a report on:

regulatory mapping of relevant EU legal acts imposing cybersecurity risk management measures;

national measures, including transposition measures, implementing relevant Union legal acts imposing cybersecurity risk management obligations;

content to support entities in complying with obligations, in particular regarding entity registration, and cybersecurity risk-management.