Article 13, NIS 2 Directive (Proposal 16.12.2020).
CSIRTs network
1. In order to contribute to the development of confidence and trust and to promote swift and effective operational cooperation among Member States, a network of the national CSIRTs is established.
2. The CSIRTs network shall be composed of representatives of the Member States’ CSIRTs and CERT–EU. The Commission shall participate in the CSIRTs network as an observer. ENISA shall provide the secretariat and shall actively support cooperation among the CSIRTs.
3. The CSIRTs network shall have the following tasks:
(a) exchanging information on CSIRTs’ capabilities;
(b) exchanging relevant information on incidents, near misses, cyber threats, risks and vulnerabilities;
(c) at the request of a representative of the CSIRT network potentially affected by an incident, exchanging and discussing information in relation to that incident and associated cyber threats, risks and vulnerabilities;
(d) at the request of a representative of the CSIRT network, discussing and, where possible, implementing a coordinated response to an incident that has been identified within the jurisdiction of that Member State;
(e) providing Member States with support in addressing cross–border incidents pursuant to this Directive;
(f) cooperating and providing assistance to designated CSIRTs referred to in Article 6 with regard to the management of multiparty coordinated disclosure of vulnerabilities affecting multiple manufacturers or providers of ICT products, ICT services and ICT processes established in different Member States;
(g) discussing and identifying further forms of operational cooperation, including in relation to:
(i) categories of cyber threats and incidents;
(ii) early warnings;
(iii) mutual assistance;
(iv) principles and modalities for coordination in response to cross–border risks and incidents;
(v) contribution to the national cybersecurity incident and crisis response plan referred to in Article 7 (3);
(h) informing the Cooperation Group of its activities and of the further forms of operational cooperation discussed pursuant to point (g), where necessary, requesting guidance in that regard;
(i) taking stock from cybersecurity exercises, including from those organised by ENISA;
(j) at the request of an individual CSIRT, discussing the capabilities and preparedness of that CSIRT;
(k) cooperating and exchanging information with regional and Union-level Security Operations Centres (SOCs) in order to improve common situational awareness on incidents and threats across the Union;
(l) discussing the peer-review reports referred to in Article 16(7);
(m) issuing guidelines in order to facilitate the convergence of operational practices with regard to the application of the provisions of this Article concerning operational cooperation.
4. For the purpose of the review referred to in Article 35 and by 24 months after the date of entry into force of this Directive, and every two years thereafter, the CSIRTs network shall assess the progress made with the operational cooperation and produce a report. The report shall, in particular, draw conclusions on the outcomes of the peer reviews referred to in Article 16 carried out in relation to national CSIRTs, including conclusions and recommendations, pursued under this Article. That report shall also be submitted to the Cooperation Group.
5. The CSIRTs network shall adopt its own rules of procedure.
Note: This is not the final text of the NIS 2 Directive. This is the text of the NIS 2 Directive Proposal of 16.12.2020.