Article 23a – Incident reporting information point

ENISA shall develop and maintain an incident reporting information point to support the obligation to report incidents and related events under the Union legal acts where those Union legal acts provide so (‘ incident reporting information point’).

The incident reporting information point shall: (a) enable the identification of applicable obligations to report incidents and related events referred to in paragraph 1; (b) be designed to allow, on the basis of relevant information provided, to identify the applicable reporting obligations and to be redirected to the appropriate national entry point referred in Article 23b; (c) make available simplified and documented information on incident notification processes in the different Member States, such as help guides or tutorials.

When developing the incident reporting information point, ENISA shall consult the relevant national competent authorities under the relevant Union legal acts, the NIS Cooperation Group and the CSIRT Network. ENISA shall establish structured communication channels ensuring that information available on the single-information point is swiftly and effectively updated. Member States shall communicate to ENISA all relevant and necessary information for the purpose of paragraph 2a.

The incident reporting information point shall not enable the submission, transmission, storage or processing of any incident notification or related data, and shall not collect any information allowing the identification of the notifying entity or of any incident.

After establishing the incident reporting information point and in cooperation with the NIS Cooperation Group, ENISA shall explore the possibility to extend the incident reporting information point by providing a report on: (a) regulatory mapping of relevant EU legal acts imposing cybersecurity risk management measures; (b) national measures, including transposition measures, implementing relevant Union legal acts imposing cybersecurity risk management obligations; (c) content to support entities in complying with obligations, in particular regarding entity registration, and cybersecurity risk-management.