Article 23b – National entry point for incident reporting

Member States shall establish and maintain a national entry point for the reporting of incidents and related events under the Union legal acts where those Union legal acts provide so. The national entry point shall enable entities to fulfil their notification obligations through a single notification at national level which reaches all relevant competent authorities.

Member States shall retain flexibility to configure their national entry point in accordance with their existing competent authority structures and the allocation of competences among authorities, including by connecting existing systems and enabling the sharing, routing or distribution of relevant information.

Member States shall design their national entry point with a view to make the national entry points interoperable with the national entry points of the other Member States.

ENISA shall, by [12 months from the date of entry into force of this amending Regulation], in consultation with the CSIRTs network, the Cooperation Group and competent authorities under the relevant Union legal acts, provide guidelines to support Member States in the establishment, maintenance and secure operation of their respective national entry point. Those guidelines shall address technical, operational and organisational measures, taking into account experiences and lessons learned from existing reporting structures. Those guidelines shall include the technical specifications necessary to ensure interoperability between all Member States’ national entry points as referred to in paragraph 3 and to facilitate the alignment of incident notifications submitted via their respective national entry point with cross-border reporting obligations.