EU Implements New Critical Infrastructure Risk System
The European Union has reached a crucial milestone in the implementation of a new risk mitigation system for critical infrastructure, which begins this month.
By July 17, member nations of the EU are supposed to have identified owners and organizations which are responsible for operating systems which can be considered critical to the running of essential services. Following designation, operators are then responsible for drawing up an assessment of vulnerabilities, and how they can be monitored and mitigated.
Examples in the maritime area which could be considered critical infrastructure are undersea trunk internet connectors, oil and gas pipelines, electricity interconnectors, LNG terminals and docks upon which there is high dependency. Some of these assets at first look might be considered out of scope – for example, undersea cables. They become of interest to the maritime community when risk monitoring and mitigation is considered – a ship lingering for days over an undersea cable under this new system would need to be spotted, scrutinized and if necessary tipped to a national maritime agency with the power to investigate further.
For critical infrastructure operators, this places increasing emphasis on continuous maritime domain awareness and intelligence-led threat monitoring. For maritime intelligence companies who already offer such services on a 24/7 basis, the new EU directive will expand the market for their services. New techniques will no doubt also be needed to identify suspicious behaviour.
A single European Critical Infrastructure Directive (Directive 2008/114/EC) is being replaced by two sets of regulations, one focused on cybersecurity and information systems security, and the second – the Critical Entities Resilience Directive (CER) – expanding the scope of what must be done to protect against all forms of hazards, particularly in the energy and transport sectors. Enthusiasm for implementing the new directives will vary among the 27 nations of the Union, with countries like Germany (after the Nord Stream pipeline attack) and the Baltics being keener to implement than some of the southern EU states. The UK introduced a similar comprehensive approach last year, in a single set of Network and Information Systems Regulations.
Within the EU system, once an organization has been notified that it has been designated, within 10 months it must have completed its survey, assessment, monitoring and response plan. Thereafter, it is required to refresh its plan every four years, has incident reporting obligations, and is subject to review by the industry’s regulatory authority. The EU directive also requires national regulatory authorities to be up-gunned to take on these new responsibilities.
that matters most
Get the latest maritime news delivered to your inbox daily.
Within the EU, some nations will plead that the cost is too high to implement the measures at the speed required. It often takes an incident where non-compliance has been a factor in a failure to prevent to spur implementation of similar such regulations at national level, just as building regulations tend not to be observed until there is an earthquake.
But in most regards, the measures are practical common sense, and any well-managed and risk-aware company operating in the maritime sector is likely to have already implemented something similar at a corporate level.
