text: November 2019

text: November 2019

text: November 2019

text: November 2019

text: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016L1148&from=EN#d1e1386-1-1 2 Definition in Chapter 1 3 Definition in Chapter 1

text: November 2019

text: November 2019

text: November 2019

text: https://www.enisa.europa.eu/topics/csirts-in-europe/csirt-inventory/certs-by-country-interactive-map 5 https://www.enisa.europa.eu/publications/study-on-csirt-landscape-and-ir-capabilities-in-europe-2025

text: November 2019

text: Strategies for Incident Response and Cyber Crisis Cooperation, ENISA, August 2016. 7 Strategies for Incident Response and Cyber Crisis Cooperation, ENISA, August 2016.

text: November 2019

text: https://www.enisa.europa.eu/topics/csirts-in-europe/csirt-capabilities/baseline-capabilities 9 https://www.itu.int/en/ITU-D/Cybersecurity/Documents/GCIv3_documents/GCI%20V3%20Reference%20model.pdf https://ec.europa.eu/digital-single-market/en/network-and-information-security-nis-directive 11 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2016.194.01.0001.01.ENG&toc=OJ:L:2016:194:TOC 12 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2016.194.01.0001.01.ENG&toc=OJ:L:2016:194:TOC

text: November 2019

text: November 2019

text: November 2019

text: November 2019

text: November 2019

text: November 2019

text: Energy Electricity Oil Gas Transport Aviation Rail Water Road Banking and financial services Health Drinking water supply and distribution Financial market infrastructures Digital infrastructure

text: The national CSIRT A Sectoral CSIRT The OES A DSP Other NA The national CSIRT and the OES The Sectoral CSIRT and the OES

text: November 2019

text: Sectoral IR layout and set-up: centralised vs Hybrid models

text: France The Netherlands

text: Organisational Culture

text: French governance and society have been shaped Since 1848, the Netherlands has been a by a centuries-old trend towards centralization, decentralised unitary state. The central beginning under the French monarchs and government has trust in abilities of local and culminating in the French Revolution and the First 14 regional governments. The Minister of Interior Napoleonic Empire . At the end of the 20th affairs encourages decentralisation, especially with century, two major decentralisation Acts were regard to local government, and is bound to that adopted but these progressive measures are likely by the Municipalities Act (art. 117) but the central to take time to change this profoundly anchored 15 government guarantees the unity of state. governance culture.

text: Incident Response Model

text: Centralised: the national CSIRT is in charge of Hybrid: a national CSIRT and the sectoral CSIRTs handling incidents across the different sectors; it share the IR responsibilities and operations, which provides a centralised point for incident reporting may depend for example on the sector(s) impacted and analysis, decision making, response or the scale of the incident. coordination, and information dissemination.

text: National approach towards IR in NISD sectors

text: In 2013, a dedicated CIIP regulatory framework was established: the “CIIP law”. The law is The Dutch envision that every sector should set-up destined to apply to more than 200 public and their own CSIRT. One of the new ambitions of their private operators from 12 sectors already identified National Cyber Security Agenda is to create a as critical in France. network of cybersecurity partnerships, including sectoral and regional CSIRTs. Security requirements will apply only to the operators’ most “critical information systems”. NCSC-NL is the CSIRT for the central government ANSSI sets technical and organisational rules, and critical infrastructure providers / Operators of mostly basic cyber hygiene measures common to Essential Services (“Rijksoverheid”). Other all sectors. ANSSI can impose measures in case governmental bodies like provinces and of a major crisis, declared by the Prime Minister. It municipalities are responsible for their own lays down legal basis for action in the framework information security. of crisis management plans .

text: Centralization and Decentralization in French History, John Loughlin https://www.oecd.org/regional/regional-policy/Netherlands-experience.pdf The French national Cyber and Information security Agency https://www.ssi.gouv.fr/en/cybersecurity-in-france/ciip-in-france/

text: November 2019

text: Some sectors do not (yet) have a CSIRT but there are Information Sharing and Analysis Centre (ISACs) for more sectors than defined in the NISD.

text: Incident Response layout and operational set-up

text: Competent authorities in charge of Incident Response

text: OES are in charge of Incident Response for the The Agence Nationale de la Sécurité des Energy, Transport, Banking and financial services, Systèmes d’Information or ANSSI (and more the Drinking water supply and distribution, and the precisely CERT-FR, the national CSIRT) is in Financial market infrastructure sectors. charge of IR for the 12 NISD sectors identified. The Water, Health and Digital Infrastructure sectors have a sectoral CSIRT.

text: Sectoral CSIRT roles

text: Sectoral CSIRTs roles depend on the sector and There are no sectoral CSIRTs in France, but maturity of the CSIRT. NCSC-NL encourages mature sectors have created sectorial cyber sectoral CSIRTs to develop towards supplying all expertise groups. elements of the NISD-framework. All ISACs are mature and have been in operation for years.

text: Authority to which to report incidents

text: For the Energy, Transport, Banking and financial services, drinking water supply and distribution, and Financial market infrastructure sectors, For each sector, OES have to report incidents to incidents must be reported to the national CSIRT and the sectoral competent authority. the national CSIRT. For the Water, Health and Digital Infrastructure sectors, incidents must be reported to the Sectoral CSIRTs and the sectoral competent authority.

text: Main challenge identified for the implementation of the NIS Directive within sectors

text: Organisational challenge: find the right governance model between national and sectoral Organisational challenge: find the right actors. governance model between national and sectoral actors. Regulatory challenge: develop the right legal framework enabling the uptake of security requirements and the notification of incidents.

text: November 2019

text: Sectoral IR layout and set-up: Portugal

text: National CSIRT Mandate

text: The CERT.PT is a service integrated in the Portuguese National Cybersecurity Centre that coordinates

text: the response to incidents involving State entities, operators of essential services, digital service

text: providers and, in general, the national cyberspace, including any device belonging to a network or address block attributed to an operator of electronic communications, institution, collective or singular person based, or physically located, on Portuguese territory.

text: National CSIRT – Key resources

text:  Resources: The National Security Cabinet provides a budget to the Portuguese national CSIRT. The National Cybersecurity authority’s budget was not increased after the transposition of the NISD, which led to the delegation of certain tasks and responsibilities to sectoral authorities (such as the identification of OES).

text: National CSIRT services

text:  Incident Handling Coordination  Incident Reporting  On-Site Support  CSIRT Capability Building  Security Alerts

text: Incident Response Model - Distributed

text: The Portuguese National Cybersecurity Centre

text: The coordination of the response to incidents can be an initiative of the Portuguese National Cybersecurity Centre, for example in the case of a large-scale incident, or it may be requested through the established communication channels. In case of necessity or force majeure, the Portuguese National Cybersecurity Centre coordinates with other national authorities. The national CSIRT is in charge of:  Sorting incident notifications and technical forensic analysis;  Coordinating with the national and international entities involved;

text: http://www.digitaldebates.org/fileadmin/media/cyber/National_CSIRTs_and_Their_Role_in_Computer_Security_Incident_ Response__November_2015_--_Morgus__Skierka__Hohmann__Maurer.pdf Interview with the Czech National Cyber and Information Security Agency (NÚKIB)

text: November 2019

text:  Producing recommendations for the mitigation and/or resolving of incidents. The sectoral authorities are in charge of:  Identifying OES within their sectors;  Mapping dependencies;  Supervising cybersecurity. The sectoral CSIRTs are in charge of:  Incident Management;  Artefact analysis;  Information Assurance;  Situational awareness;  Communication/outreach. The OES in NISD sectors are in charge of:  Taking appropriate measures to prevent incidents affecting networks and information systems;  Reporting incidents to the national CSIRT.

text: IR in NISD sectors – Entity in charge

text:  The OESs’ CSIRT are in charge of IR in the Energy, Transport, Health, Drinking Water, Financial Market and Digital Infrastructure sectors (sectoral CSIRTs are planned in the Energy and transport sectors);  A sectoral CSIRT is in charge in the Banking sector.

text: Impact of the NIS Directive on IR layout

text: The NIS Directive led to the improvement of the CSIRT/IR national layout already in place but did not increase the national Cybersecurity authority’s budget, which is why the identification of OES was delegated to sectoral authorities.

text: https://www.cncs.gov.pt/en/certpt_en/ Survey Interviews with experts

text: November 2019

text: Yes No NA

text: Improved organisation and clarification of the 13 11 IR organisation and governance Better or increased collaboration with private sector 11 13 Clarification of the roles and responsibilities between the 15 9 different actors… Creation of new sectoral CSIRTs within national competent 5 19 authorities Creation of new CSIRTs within public and private 5 19 OES, and/ or DSP for OES Development of sector-specific cybersecurity 7 17 and IR procedures, processes and guidelines Increased budget available for 3 21 the development of IR capabilities Other. Please Specify 2 22

text: November 2019

text: November 2019

text: November 2019

text: Definitions and thresholds for identification of Operators of Essential Services in the United Kingdom maritime transport sector

text: Essential service Identification Thresholds

text: A shipping company which handles (a) over 5 million tonnes of total annual freight at UK ports; and (b) over 30% of the freight at any individual UK port which fulfils at least one of the following criteria: (I) handles more than 15% of UK total roll-on roll-off traffic; (II) handles more Shipping than 15% of UK total lift-on lift-off traffic; (iii) handles more than 10% of UK total liquid bulk traffic; or (iv) handles more than 20% of UK biomass fuel traffic; or A shipping company with over 30% of the annual passenger numbers at any individual UK port which has annual passenger numbers greater than 10 million.

text: A harbour authority (as defined in section 313(1) of the Merchant Shipping Act 1995) which (a) has annual passenger numbers greater than 10 million; or (b) fulfils at least Provision of services one of the following criteria: by a harbour authority (i) handles more than 15% of UK total roll-on roll-off traffic; (ii) handles more than 15% of UK total lift-on lift-off traffic; (iii) handles more than 10% of UK total liquid bulk traffic; or (iv) handles more than 20% of UK biomass fuel traffic.

text: (a) An operator of a port facility which handles passengers at a port which has annual passenger numbers greater than 10 million; or (b) An operator of a port facility at a port which fulfils at least one of the following criteria: Provision of services (i) handles more than 15% of UK total roll-on roll-off traffic; (ii) handles more by an operator of a than 15% of UK total lift-on lift-off traffic; (iii) handles more than 10% of UK port facility total liquid bulk traffic; or (iv) handles more than 20% of UK biomass fuel traffic; and where that port facility operator handles the same type of freight for which the port fulfils one of the criteria mentioned in sub-paragraphs (i)-(iv). "Port facility" has the same meaning as in regulation 2 of the Port Security Regulations 2009.

text: Operator of vessel traffic services at a port which (a) has annual passenger numbers greater than 10 million; or (b) fulfils at least one of the following criteria: (i) handles more than 15% of UK total roll-on roll-off traffic; (ii) handles more Vessel traffic services than 15% of UK total lift-on lift-off traffic; (iii) handles more than 10% of UK total liquid bulk traffic; or (iv) handles more than 20% of UK biomass fuel traffic. "Vessel traffic services" has the same meaning as in regulation 2(1) of the Merchant Shipping (Vessel Traffic Monitoring and Reporting Requirements) Regulations 20049.

text: November 2019

text: November 2019

text: NISD transposition into national legislation – extended scope of the sectors (examples)

text: Different and/or additional categories of OES Different and/or additional sectors identified included

text: Additional sectors considered: electronic communications, wastewater, food, government OES related to the additional sectors included. and national security/ emergency services and environmental.

text: Czech Republic

text: Additional sector considered: chemical industry. OES related to the additional sectors included.

text: Under the Estonian implementation legislation, Operators of Essential Services also include Electronic communication service providers, public broadcasting, providers of digital identification and digital signing service and district heating service providers. Additional sector considered: electronic communication, public media. Within the Health sector, small-scale medical clinics are included as OES.

text: Estonia goes further in its definition of important services and the setting the threshold for being considered OES, in addition to that provided for in the NIS Directive.

text: Finland has identified 7 vital societal Under Finnish national legislation industries such functions: leadership, international and EU affairs, as online marketplaces, search engines, cloud national defence, domestic security, economy, providers and other digital infrastructures are infrastructure and security of supply, services for considered OES. citizens, psychological resilience.

text: France has identified 12 sectors :

text: - Energy: as in the NIS;

text: - Transport: extended to guided transport and logistics:

text: - Finance: extended to insurance;

text: - Health: extended to pharmaceutical distribution network; Industries that are considered OES under French - Food industry: new sector; legislation include industries involved in state civil, judicial and military activities, food, electronic, - Water: extended to water treatment audio-visual and information communication, sector; space and research, and finance industries.

text: - Military activities of the State; - Judiciary activities of the State;

text: - Civilian activities of the State;

text: - Electronic communication, audio visual & information;

text: November 2019

text: - Space and research.

text: The bill proposes to expand to two new sets of entities: (i) "infrastructures of special public Germany’s Ministry of interior proposed a Draft Bill th interest"; and (ii) operators with "cyber-criticality". on March 27 , 2019 to extend the list of existing The definition of "infrastructures in the special critical infrastructure sectors (KRITIS) (currently public interest" covers companies in three different energy, water, information sectors: (i) defence; (ii) cultural and media sector; technology/telecommunications, food, health, and (ii) "companies of considerable economic finance/insurance and transportation/traffic) by importance". The explanatory memorandum also including waste management as an additional 24 mentions the automotive and chemical industry; KRITIS sector . However, these sectors are not included in the Draft Bill itself.

text: Additional sectors considered: industrial sector, chemical and nuclear sub-sector, state OES related to the additional sectors included. administration, civil safety, environmental, national defence and foreign and security affairs.

text: Additional sectors considered: heating and mining. OES related to the additional sectors included.

text: Additional sector considered: pharmaceutical/ chemical industry, public administration, electronic OES related to the additional sectors included. communication, postal service.

text: Additional sector considered: environmental OES related to the additional sectors included. protection industries.

text: OES also include Telecommunication Critical Additional sector considered: Telecommunications. operators.

text: The Netherlands

text: In the Netherlands, the list of OES also includes Additional sector considered: nuclear energy, essential operators of the additional sectors: telecommunications networks and water nuclear energy, telecommunications networks and regulation. water regulation.

text: https://www.jdsupra.com/legalnews/germany-s-draft-bill-on-it-security-2-0-55094/ Ibid

text: November 2019

text: November 2019

text: Financial Sector – A need for OES to collaborate at sectoral level nationally and regionally

text: November 2019

text: Guidelines to start a collective CSIRT 28 https://english.ncsc.nl/get-to-work/cooperation/i-would-like-to-strengthen-my-collaboration/csirt-maturity-toolkit

text: November 2019

text: November 2019

text: Services Areas Services Functions

text: Log and sensor management, Detection use Monitoring and detection case management, Contextual data

text: Information Security

text: Event Management

text: Analysing Correlation

text: Information security incident report receipt, Accepting information security Information security incident report triage and incident reports processing,

text: Information security incident triage (prioritization and categorization), Information Analysing information security collection, Coordinate any more detailed incidents analysis, Information security incident root cause analysis, Cross-incident correlation.

text: Media or surface analysis, Reverse Analysing artefacts and forensic engineering, Run time and/or dynamic evidence analysis, Comparative analysis

text: Information Security Incident Management

text: Establishing a response plan, Applying adhoc measures and containment, Returning all Mitigation and recovery systems back to normal operation, Supporting other information security entities,

text: Communication, Sending notifications, Information Security Incident Distributing relevant information, Coordinating Coordination activities, Reporting, Communicating with the media.

text: Distributing information to constituents, Supporting crisis management Reporting on cyber security status, Communicating strategic decisions

text: Vulnerability discovery based on information security incident management, Vulnerability Vulnerability Vulnerability discovery / discovery via public sources, Vulnerability Management research research, Vulnerability report intake, Vulnerability report receipt, Vulnerability report triage and processing

text: Vulnerability triage (prioritization and categorization), Vulnerability root cause Vulnerability analysis analysis, Vulnerability remediation development

text: Vulnerability notification/reporting, Vulnerability coordination Vulnerability stakeholder coordination

text: November 2019

text: Vulnerability Vulnerability disclosure announcement/communication/dissemination, Post vulnerability disclosure feedback

text: Vulnerability detection, Vulnerability Vulnerability response remediation

text: Policy aggregation, distillation, and guidance, Mappings of assets to functions, roles, Situational Awareness Data acquisition actions and key risks, Collection, Data processing and preparation

text: Projection and inference, Event detection Analyse and interpret (through alerting or hunting), Situational impact

text: Communication, Reporting and recommendations, Implementation, Communication Dissemination / integration / information sharing, Managing the sharing of information, Feedback

text: Research and information aggregation, Awareness building Development of reports and awareness materials, Outreach

text: Knowledge, skill, and ability requirements gathering, Development of educational and Training and education training materials, Delivery of content, Mentoring, CSIRT staff professional development

text: Knowledge Transfer

text: Requirements Analysis, Format and environment development, Scenario Exercises development, Executing exercises, Exercise outcome review

text: Risk Management Support, Business Technical and policy advisory Continuity and Disaster Recovery Planning Support, Policy Support, Technical Advice

text: RTIR - Request Tracker for Incident Response (RTIR) is the premier open source incident handling system targeted for computer security teams. We worked with over a dozen CERT and CSIRT teams around the world to help you handle the platforms and tools. ever-increasing volume of incident reports. RTIR builds on all the features of Request Tracker.

text: November 2019

text: National CSIRT, dedicated notification tools for OES (Belgium)

text: According to Belgian law, OES have to notify 3 or 4 different authorities:  The national CSIRT (CERT-BE);

text:  The Centre for Cyber Security Belgium (CCB);

text:  The Sectoral Authority;

text:  GDPR Authority (in case of data leak).

text: A Belgian regulation states that Belgian citizens should only have to report to one authority and not duplicate the notification to other administrative entities, which resulted in the creation of a dedicated portal for OES to centralise notifications and systematically transfer the incident notification to the other 3 authorities.

text: Notification tool for OES Description

text: The form is accessible online on the CSIRT-DSP Online dedicated portal for OES website and the notification is sent directly to both the CSIRT and the competent Authority;

text: Notification tool for all Description

text: A central email address is available on the CERT- BE website. The national CSIRT also offers to

text: Notification by email / encrypted email

text: send a secure message by using an encrypted message with PGP encryption.

text: CERT.BE uses the “Traffic Light Protocol” to facilitate and encourage the exchange of information in a safe manner. The protocol requires that the person sending information

text: Exchange of information on incidents based on

text: assigns it a colour code. This colour indicates if

text: Traffic Light Protocol (TLP)

text: and in what ways this information may be further disseminated. Someone who receives information and believes that it should be further disseminated must first ask for permission from the sender.

text: The form is accessible online on the CERT-BE Online notification form website and includes mandatory information to fill in.

text: The MISP threat sharing platform is a free and open source software helping information sharing of threat intelligence including cyber security indicators. A threat intelligence platform for gathering, sharing, storing and correlating Indicators of Compromise of targeted attacks, threat intelligence, financial fraud information, vulnerability information or even counterterrorism information. IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol (Github definition). https://www.cert.be/en/report-incident https://www.cert.be/en/traffic-light-protocol-tlp

text: November 2019

text: CSIRT for Digital Service Provider, notification tools (The Netherlands)

text: In November 2018, the NIS Directive was transposed into Dutch legislation under the Dutch law on the protection of networks and information systems. According to this national regulation, Digital Service providers are required to report incidents on their networks and information systems (duty to report), and to take security measures on their networks and information systems (duty of care) .

text: As a direct effect of the Directive, a CSIRT dedicated to DSP was created (CSIRT-DSP). In case of incident, according to the Dutch law, DSPs have to report to the CSIRT-DSP and to the Competent Authority, which, for the DSPs, is the Radio communications Agency. In order to do so, Digital Service Providers can use three different notification tools:

text: Notification tools Description

text: The form is accessible online on the CSIRT-DSP An online incident report form website and the notification is directly sent to both the CSIRT and the competent Authority;

text: A standard number is available on the CSIRT-DSP A telephone number website. However, the report over the phone will not be shared with the competent Authority;

text: An e-mail is available on the CSIRT-DSP website. An e-mail However, the report by email will not be shared with the competent Authority;

text: https//csirtdsp.nl/en/node/1 https://www.z-cert.nl/ https://www.z-cert.nl/nieuws

text: November 2019

text: https://www.z-cert.nl/en 39 https://www.z-cert.nl/en 40 ENISA Maturity Evaluation Methodology for CSIRTs

text: November 2019

text: ECB - TIBER-EU

text: TIBER-EU Context and Framework

text: TIBER-EU is the European framework for threat intelligence-based ethical red-teaming. It is the first EUwide guide on how authorities, entities, threat intelligence and red-team providers should work together to test and improve the cyber resilience of entities by carrying out a controlled cyberattack. TIBER-EU was jointly developed by the ECB and the EU national central banks, approved by the Governing Council of the ECB and published in May 2018. It was inspired by and takes into account the lessons learned from similar initiatives in the United Kingdom (CBEST) and the Netherlands (TIBER-NL). The TIBER-EU framework is currently (being) implemented in Belgium, Denmark, Ireland and the Netherlands, as well as by the ECB in its oversight capacity. Other jurisdictions are expected to follow soon.

text: TIBER-EU tests mimic the tactics, techniques and procedures of real-life attackers, based on bespoke threat intelligence. They are tailor-made to simulate an attack on the critical functions of an entity and its underlying systems, i.e. its people, processes and technologies. The outcome is not a pass or fail;

text: Bouveret, A., Cyber Risk for the Financial Sector: A Framework for Quantitative Assessment, 2018 42 https://www.imf.org/~/media/Files/Publications/WP/2018/wp18143.ashx 43 https://www.bankingsupervision.europa.eu/press/publications/newsletter/2017/html/ssm.nl170517_3.en.html 44 Ibid. 45 https://www.ecb.europa.eu/paym/cyber-resilience/html/index.en.html

text: November 2019

text: instead the test is intended to reveal the strengths and weaknesses of the tested entity, enabling it to reach a higher level of cyber maturity.

text: The main participants in a TIBER-EU test are assigned to one of five different teams depending on their role and responsibilities: Blue team – the people in the entity that is the subject of the test and whose prevention, detection and response capabilities are being tested without their foreknowledge Threat intelligence provider – the company that looks at the range of possible threats and carries out reconnaissance on the entity Red team provider – the company that carries out the simulated attack by attempting to compromise the critical functions of the entity by mimicking a cyber attacker White team – a small team within the target entity who are the only ones there who know a test is happening and that leads and manages the test in collaboration with the TIBER cyber team TIBER cyber team – the team within the authority that is responsible for overseeing the test and making sure it meets the requirements of the TIBER-EU framework, thus enabling mutual recognition of the test by relevant authorities.

text: November 2019

text: Information exchange initiatives at national level – sectoral illustrations & good practices

text: The Luxembourg Bankers’ Association (ABBL) has put in place the Trust and Cybersecurity Committee (TCS). The TCS Committee’s purpose is to promote Cybersecurity and Information Risk information across the banking sector, as well as to act as a connector between the various actors on the market. The members of the TCS Committee gather for quarterly plenary sessions at the Luxembourg House of Finance in order to openly exchange on the current threat landscape, regulatory and supervisory aspects and general market practices regarding cyber risks.

text: The Civil Aviation authority organise workshops to share good practices and lessons learned with its constituent. This information can also be share with the National CSIRT and at EU-level.

text: The Industrial Cybersecurity Centre (CCI) was created in in June 2013 to boost and improve industrial cybersecurity in Spain and Spanish-speaking Latin America, defining industrial cybersecurity as "the set of practices, processes and technologies, designed to manage cyberspace's risk associated to the management, process, storage and transmission of information used by industrial infrastructures, from the points of view of people, processes and technologies". The activities of the Centre, focused on provide maximum benefits to its members and sponsors are ruled by the following strategic objectives:  Conglomerate the main experts and actors in industrial cybersecurity in order to facilitate the exchange of experience and information and be kept up to date on the last technologies and improvements on this subject.

text: November 2019

text:  Provide awareness on the current state of cybersecurity, paying special attention to new threats and attack techniques.  Set communication channels with authorities and lawmakers in order to ease communication among the different actors involved in industrial cybersecurity (government, industrial associations, critical infrastructures, engineers, integrators, vendors, consulting firms, associations, standard and good practice developers and citizens).  Improve awareness among all the actors through courses, events, seminars, publications and a presence in the media.  Qualify professionals on industrial cybersecurity in order to facilitate hiring.  Improve and expand the Spanish and Latin American industrial cybersecurity market.

text: Information exchange initiatives at national level – trans-sectoral examples & good practices

text: Belgium – TIP & MiSP

text: The Belgian Threat Intel Platform (TIP) is a transversal information-exchange platform initially created for Law enforcement and Intelligence stakeholders to share threat intelligence and was later partially opened to OES. Within the TIP, OES from all sectors will have access (Belgium is still in the process of designating OES) to the TIP to receive threat intelligence about their sector. The Belgian Malware Formation Sharing Platform (MISP) is publicly accessible, but users can set up private dedicated sectoral communities to exchange information on sectoral incidents.

text: Poland – N6 Project

text: The n6 project was designed and developed entirely at CERT Polska as a platform for acquisition, processing and exchange of information regarding Internet threats. It is operational since February 2012. Within the n6 project, millions of security events are processed daily in an automated manner. The goal is efficient, reliable and fast delivery of large volumes of network incident data to interested parties: network owners, administrators and Internet Service Providers. The project disseminates information gathered from various security systems operated by security organizations, software vendors, independent researchers, etc. The core element of n6 is its engine responsible for sorting and managing flow of data. Sorting and delivering data to appropriate parties is made possible by a flexible tagging system, which defines categories of incoming data and addresses specific interest.

text: The Netherlands - NDN

text: The National Detection Network (NDN) is a partnership for better and faster detection of digital dangers and risks. By sharing information about threats, parties can take appropriate measures in a timely manner under their own responsibility, to limit or to prevent possible damage.

text: Interview with CERT-BE https://www.cert.pl/en/projekty/n6-network-secident-exchange/ Interview with NCSC-NL

text: November 2019

text: United Kingdom – CiSP

text: The Cyber Security Information Sharing Partnership (CiSP) is a joint industry and government initiative set up to exchange cyber threat information in real time, in a secure, confidential and dynamic environment, increasing situational awareness and reducing the impact on UK business.

text: Information exchange initiatives at European level (examples)

text: Initiatives Description

text: The CSIRT Network is a network composed of EU Member States’ appointed CSIRTs and CERT-EU (“CSIRTs Network members”). The European Commission participates in the network as an observer. ENISA is tasked to actively support the CSIRTs’ cooperation, provide the secretariat and active support for incident 51 coordination upon request. CSIRT Network The CSIRT Network provides a forum where members can cooperate, exchange information and build trust. Members will be able to improve the handling of cross-border incidents and even discuss how to respond in a coordinated manner to specific incidents.

text: The EGC group forms an informal association of governmental CERTs in Europe. Its members effectively co-operate on matters of incident response by building upon a fundament of mutual trust and understanding due to similarities in constituencies and problem sets. To achieve this goal, the EGC members:  Jointly develop measures to deal with large-scale or regional network security incidents European Government CERTs 52  Facilitate information sharing and technology exchange (EGC) group relating to IT security incidents and malicious code threats and vulnerabilities  Identify areas of specialist knowledge and expertise that could be shared within the group  Identify areas of collaborative research and development on subjects of mutual interest  Communicate common views with other initiatives and organizations

text: An EU Aviation ISAC is being created which will exist alongside two existing entities: ECCSA and the US Aviation ISAC. EU Aviation ISAC The need for a European-based Aviation ISAC was expressed by European industry members, OEMs and Airlines who saw a need to organise and collaborate in the realm of cyber security and in the field of intelligence and analysis sharing for the aviation sector.

text: https://www.ncsc.gov.uk/section/keep-up-to-date/cisp https://www.enisa.europa.eu/topics/csirts-in-europe/csirts-network http://www.egc-group.org/

text: November 2019

text: The FI-ISAC exists since 2008 as an independent organisation and is well integrated with European and MS banking institutions and EU organisations such as ENISA, Europol, the European Central Bank, European Payment Council and the European Commission. ENISA provides also a secretariat support. The mission of the European FI-ISAC is information exchange on e- and m-channel, cards, central systems and all ICT related topics 53 including: FI-ISAC  Cyber-criminal activity affecting the financial community  Vulnerabilities, technology trends and threats  Incidents and case-studies This information exchange helps each member and the banks in its member state, to raise awareness on potentials risks, and provides an early warning on new threats and Modus Operandi's.

text: The European Energy - Information Sharing & Analysis Centre (EE-ISAC) is an industry-driven, information sharing network of trust. Both private utilities and solution providers and (semi)public institutions such as academia, governmental and non-profit organizations share valuable information on cyber security & cyber resilience. EE-ISAC enables the European utility industry to:  Set up long lasting relationships of trust with partners 54 across the entire value chain EE-ISAC  Share both real-time data & analysis within small scale trust-circles  Learn from their peer's experiences with grid security incidents and cyber breaches  Compare & evaluate security solutions, both from a technical and operational viewpoint  Benefit from an open dialogue with industry partners and suppliers

text: https://www.enisa.europa.eu/topics/cross-cooperation-for-csirts/finance/european-fi-isac-a-public-private-partnership https://www.ee-isac.eu https://www.enisa.europa.eu/topics/csirts-in-europe/csirts-network https://tf-csirt.org/ https://www.first.org/

text: November 2019

text: 4% The CSIRT Network

text: The FIRST community

text: The European Government CERTs (EGC) group The TF-CSIRT

text: Other (specify in comments)

text: Do not know

text: November 2019

text: Description of the incident and IOCs Services affected Indicators to measure the nature and impact in addition to… Please specify Cross border impact Root cause Severity Current situation of the incident (actions taken or needed,… Lessons learnt Other. Please Specify 0 Yes No NA 12 24

text: November 2019

text: November 2019

text: November 2019

text: Good practices for Training at national level – Illustrations

text: Initiatives Description

text: Every year CERT-BE organises a training programme for federal officials. They launched a call for tenders for private companies CERT-BE annual training program that provides cybersecurity trainings. These trainings can cover a wide range of skills. CERT-BE organises the training programme and private companies send their trainers.

text: CIRCL.LU offers courses to its members and organisations based in Luxembourg. In their mission to improve information security, CIRCL shares its field experience through a set of training or technical courses. Due 61 to diversity of competences within the team, CIRCL is able to CIRCL.LU trainings . provide a large diversity of information security trainings. Courses target technical experts but also non-technical staff in the topics of incident handling, malware analysis, operational security and system forensics.

text: November 2019

text: Actors Description

text: Recommendations to ENISA

text: Collect deeper insights on both national and sectoral CSIRT maturity when Knowledge the NISD will have been fully implemented;

text: Cooperation Favour cross sectoral knowledge between the stakeholders;

text: Continue to collect available resources to enhance IRC & enhance Information sharing information-sharing and build a repository;

text: Develop a continuum for training activities which range from assessing Training sectors trainings needs, to promote the “train-the-trainers» approach, to continue developing sectoral trainings.

text: Recommendations to the IR Community

text: Publish a clear list of the sectors covered within NISD at national level (same Transparency as the NISD or extended);

text: Encourage the use of secure communication tools, common taxonomy and sharing of lessons learned after incident with peers and everywhere; Information sharing The responsible disclosure of vulnerabilities should be fostered by setting incentives;

text: Cooperation Build trust within communities and engage with OES and DSP;

text: The IR community should have adequate resources to conduct their Resources missions.

text: https://www.enisa.europa.eu/publications/stock-taking-of-information-security-training-needs-in-critical-sectors https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force

text: November 2019

text: Nature of information collected Data Collection

text: Summary of national approach towards IR in the

text: Identified in 14 MS

text: NISD sectors

text: All NISD Sectors competent authority/ies for 13

text: Competent authorities for NISD sectors

text: MS, partial data for 3 MS Existing/newly created or planned CSIRT or IR 31 Existing/newly created identified entities 2 planned identified

text: November 2019

text: Role of OES Identified for 23 MS Role of DSP Identified for 19 MS 24 respondents

text: IR processes and procedures (IR and reporting) Minimal data in 10 MS

text: Collaboration procedures with NISD sectors Minimal data in 8 MS Cross-border IR aspects Minimal data in 9 MS Operational Preparedness and capacities 5 identified Tools 4 identified Initiatives, communities, etc. 9 identified

text: November 2019

text: November 2019

text: November 2019

text: November 2019

text: November 2019

text: November 2019

text: November 2019

identifier: EU Member States incident response development status report

title: EU Member States incident response development status report

text: EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT Security and Resilience for NOVEMBER 2019 Smart Health Service and Infrastructures 0

text: EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity (ENISA) has been working to make Europe cyber secure since 2004. ENISA works with the EU, its member states, the private sector and Europe’s citizens to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of crossborder communities committed to improving network and information security throughout the EU. Since 2019, it has been drawing up cybersecurity certification schemes. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: CONTACT

text: For queries in relation to this study, please use: csirt-relations@enisa.europa.eu.

text: PGP Key ID: 31E777EC 66B6052A PGP

text: PGP Key Fingerprint: AAE2 1577 19C4 B3BE EDF7 0669 31E7 77EC 66B6 052A for media enquiries about this paper, please use press@enisa.europa.eu.

text: AUTHORS

text: Edgars Taurins, ENISA

text: ACKNOWLEDGEMENTS

text: ENISA performed this study with the help of contractor CEIS and with the input from Informal Expert Group on EU Member States Incident Response Development.

text: LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 2019/881

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2019 Reproduction is authorised provided the source is acknowledged.

text: Copyright for the image on the cover: © Shutterstock For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders. ISBN 978-92-9204-310-0, DOI 10.2824/74233

text: TABLE OF CONTENTS

text: 1. OVERVIEW AND SCOPE OF THE STUDY 7

text: 1.1 CONTEXT 7

text: 1.2 OBJECTIVE OF THE STUDY 7

text: 1.3 SCOPE OF THE WORK AND DEFINITIONS 8

text: 2. METHODOLOGY AND DATA COLLECTION 11

text: 2.1 OVERVIEW OF THE METHODOLOGY 11

text: 2.2 A SEVEN-STEP APPROACH 11

text: 2.2.1 Step 1 – Definition of the research focus for the data collection 11 2.2.2 Step 2 – Desktop research in open source on NISD Sectors IRC 12 2.2.3 Step 3 – Designing and validating the survey 12 2.2.4 Step 4 – Conducting the survey and complementary interviews 12 2.2.5 Step 5 – Collation of raw data 13 2.2.6 Step 6 – Analysis and identification of trends 13 2.2.7 Step 7 – Final report 13

text: 2.3 OVERALL ASSESSMENT OF THE DATA & INFORMATION AVAILABILITY 13

text: 2.3.1 Desktop research – Data collection assessment 13 2.3.2 Survey – data collection assessment 14 2.3.3 Interviews – data collection assessment 14

text: 3. KEY FINDINGS 15

text: 3.1 KEY FINDING #1 15

text: 3.1.1 Member States’ organisational culture and resources tend to shape IR layout and set-up 15 3.1.2 Lessons learned and recommendations 19

text: 3.2 KEY FINDING #2 20

text: 3.2.1 The NIS Directive has improved the IR organisation and governance by clarifying actors’ roles and responsibilities 20 3.2.2 Lessons learned and recommendations 21

text: 3.3 KEY FINDING #3 22

text: 3.3.1 The implementation of the Directive raises operational and regulatory challenges and highlights MS willingness to move forward by extending the scope and number of sectors targeted 22 3.3.2 Lessons learned and recommendations 26

text: 3.4 KEY FINDING #4 27

text: 3.4.1 A blend of bottom up and top down incentives could be the most efficient driver for the creation of sectorial CSIRTS, depending on MS IR layout maturity. 27 3.4.2 Lessons learned and recommendations 30

text: 3.5 KEY FINDING #5 31

text: 3.5.1 National CSIRTs have developed mature reporting processes and notification tools, as have sectoral CSIRTs who provide solutions specific to their sectors’ needs 31 3.5.2 Lessons learned and recommendations 37

text: 3.6 KEY FINDING #6 38

text: 3.6.1 There is a multiplication of information-exchange tools to facilitate cooperation at sectoral, national and EU/international level, but the quality of the exchange depends on both organisational and structural criteria 38 3.6.2 Lessons learned and recommendations 44

text: 3.7 KEY FINDING #7 45

text: 3.7.1 There is a growing interest in training to enhance and foster preparedness in NISD sectors at European level 45 3.7.2 Lessons learned and recommendations 47

text: 3.8 FINAL RECOMMENDATIONS 47

text: 4. PRESENTATION OF THE RAW DATA 48

text: 4.1 DESKTOP RESEARCH – SECTORAL IR SET-UP 48

text: 4.1.1 Data structuring and classification criteria 48 4.1.2 Overview of the Sectoral IR Set-up within the 28 Member States 48

text: 4.2 SURVEY AND INTERVIEWS – IR APPROACH AND SECTORAL CAPABILITIES 49

text: 4.2.1 Survey - Data structuring and classification criteria 49 4.2.2 Complementary Interviews – Rationale and key figures 50

text: 5. BIBLIOGRAPHY 52 A ANNEXES: 55

text: A.1 ANNEX 1 – LIST OF CRITERIA 55

text: A.2 ANNEX 2 – LIST OF FIGURES 55

text: A.3 ANNEX 3 – LIST OF TABLES 55

text: EXECUTIVE SUMMARY

text: Following the recent transposition of the NIS Directive (NISD) into European Member States (MS) legislation, this study aims to analyse the current operational Incident Response set-up within NISD sectors and identify the recent changes. The study provides a deeper insight into NISD sectoral Incident Response capabilities, procedures, processes and tools to identify the trends and possible gaps and overlaps.

text: Incident Response Capabilities (IRC) within NISD sectors is a growing concern to tackle potential incidents which could have a major impact on European societies and citizens. To assess IRC, the analysis framework for the research included the following aspects:

text:  Impact of the NIS Directive on national CSIRT/IR layout and operational set-up in the NISD sectors;  IR cooperation and operational models within the NISD sectors  IRC development in the NISD sectors  Lessons learned and recommendations.

text: A series of seven findings were identified while conducting the research activities.

text: Key Finding #1 – Member States’ organisational culture and resources tend to shape the overall IR layout and set-up

text: Depending on whether a Member State’s organisational culture is centralised or decentralised, the Incident Response layout and set-up is often structured in a similar manner, i.e. with a central authority or instead with shared responsibilities between different actors. The main entities in charge of Incident Response at national level, tend to be the national CSIRT and the Operator of essential Services (OES) . However, the mandate and the resources of the National CSIRT or national cybersecurity authority is another important element influencing a centralised or distributed incident response model.

text: Key Finding #2 – The Directive’s main positive impact was to clarify actors’ roles and responsibilities within the IR organisation

text: The main positive impact of the Directive was to improve the IR organisation and governance by clarifying actors’ roles and responsibilities. The data collected also suggest that the NISD had an unequal effect from one country to another. Indeed, this positive impact is less visible in Member States with a more mature layout and pre-existing national regulations to govern incident response in NISD sectors. However, the Directive has led/is leading to the formal identification of OES in countries who had not previously done so.

text: Key Finding #3 – The implementation of the NISD raises operational and regulatory challenges for the MS regulators and competent authorities

text: The implementation of the Directive raises operational and regulatory challenges, in particular for the definition of OES and competent authorities and the legal balance between sharing

text: information and respecting privacy regulations. The operational implementation of the Directive in the Member States also highlights MS willingness to move forward since most of them extended the number of sectors targeted and their scope.

text: Key Finding #4 – The success of demand or regulatory drivers for the creation of sectoral

text: IR entities and capabilities depends on IR layout maturity

text: The creation of sectoral IR entities and capabilities is driven by both operational demand and policy regulation. A blend of bottom-up and top-down incentives could be the most efficient driver to enhance capabilities, however an important element to take into account is the MS IR layout maturity. In countries with a very mature or centralised IR layout, there is less need for sectoral IRC. For all NISD sectors and/or sub-sectors, the main entities in charge of IR for 51% of the respondents are the national CSIRT and the OES

text: Key Finding #5 – Sectoral CSIRTs rely on similar notification and reporting tools as

text: National CSIRTs but provide sector-specific knowledge and expertise to their constituents

text: Both national CSIRTs and sectoral CSIRTs have developed mature reporting processes and notification tools. The main added value of sectoral CSIRTs is to provide services specific to their sectors’ needs, in particular a more in-depth knowledge of the threat and actor landscape, better adapted tools and solutions and operational expertise. Sector-specific regulations which include guidelines and requirements for reporting and management of incidents are crucial to enhance capabilities at the sectoral level. However, there is a lack of skilled staff, making it difficult for sectoral CSIRTs to reach full capacity.

text: Key Finding #6 – There is a growing number of sectoral cooperation and information-

text: exchange initiatives, yet they often lack visibility or resources to sustain their efficiency

text: There is a multiplication of information exchange tools and initiatives to facilitate cooperation at sectoral, national, regional and EU level. These initiatives can take various forms and be more or less formalised. This quantitative evolution is an encouraging sign but does not provide information on the quality and outcomes of the exchanges. The long-term benefits of these initiatives will depend on the presence of both organisational and structural elements to sustain the efficiency of the initiatives.

text: Key Finding #7 – Training at sectoral level is key to foster and enhance preparedness

text: Training is an area of constantly growing interest for sectoral CSIRTs and for other operational entities and it is considered as a crucial pillar of the cybersecurity value chain and IR actors’ preparedness and expertise. Interesting good practices to organise training have been gathered by national CSIRTs, which could provide an answer to the need for skilled personnel training opportunities.

text: Recommendations to ENISA

text:  Knowledge: Collect deeper insights on both national and sectoral CSIRT maturity when the NISD will have been fully practically implemented;  Cooperation: Bolster cross sectoral knowledge between the stakeholders;  Information sharing: Continue to collect available resources to enhance IRC & enhance information-sharing and build a repository;

text:  Training: Evaluate a possibility to develop a continuum for training activities which include assessing sectors trainings needs, promoting the “train-the-trainers» approach and developing basic sectoral trainings.

text: Recommendations to the IRC community (National and sectoral CSIRTs)

text:  Transparency: Publish a clear list of the sectors covered within NISD at national level (same as the NISD or extended);  Information sharing: Encourage the use of secure communication tools, common taxonomy and sharing of lessons learned after incident with peers and everywhere; The responsible disclosure of vulnerabilities should be fostered by setting incentives;  Cooperation: Build trust within communities and engage with OES and DSP;  Resources: the IR community should have adequate resources to conduct their missions.

text: 1. OVERVIEW AND SCOPE OF THE STUDY

text: 1.1 CONTEXT

text: In 2019, ENISA is assisting European Member States (EU MS) with their Incident Response Capabilities (IRC) by providing a state-of-the-art overview of the CSIRT landscape and development in Europe. This work aims to further develop and apply ENISA recommendations for CSIRT capability development.

text: ENISA’s public website features both a European CSIRT inventory with an interactive map,

text: OES in the seven

text: which gives an overview of the actual situation of publicly listed CSIRT teams in Europe and a

text: sectors identified

text: published Study on CSIRT landscape and IR capabilities in Europe 2025 . These two elements

text: in the NISD are

text: support an overall picture of current CSIRTs’ incident handling and response capabilities (IRC),

text: accelerating their

text: with initial facts on sectoral CSIRTs.

text: efforts to build or

text: Following the adoption of the NIS Directive, EU Member States (MS) transposed the different upgrade their measures and guidelines into national legislation, including those focusing on OES and critical IRC. infrastructure. For example, the NIS Directive requests MS to appoint at least one Computer Security Incident Response Team to monitor incidents at national level and facilitate collaboration at European level. Beyond national and/or governmental CSIRTs, operators of essential services (OES) in the seven sectors identified in the NISD are accelerating their efforts to build or upgrade their IRC. This effort includes the set-up of specific capabilities within the NISD sectors and the development of sector-specific IR collaboration mechanisms and fora at sectoral, national, EU and international level.

text: 1.2 OBJECTIVE OF THE STUDY

text: The objective of this study is to help ENISA gain a better understanding of and draw conclusions about the recent and current changes in the European Incident Response landscape based on NISD requirements. This study aims to dive deeper into IRC in NISD sectors and to study the procedures, processes and tools used either by designated CSIRTs in particular sectors or by an entity responsible for IR in these sectors in all EU MS and collect existing good practices from neighbouring countries.

text: The specific objectives of this study are:

text:  To collect and aggregate comprehensive data on current IRC of NISD sectors;  To analyse and evaluate the recent changes since the implementation of the NIS Directive;  To identify potential gaps, overlaps and challenges in national IR procedures, processes and tools.

text: To achieve these objectives a series of three research activities have been conducted in parallel, namely desktop research of open sources, a survey of EU national and sectoral CSIRTs (response received from 17 Member States and Norway) and complementary interviews with sectoral IRC experts and national CSIRTs.

text: Norway has also been included in the scope of the study because it provides interesting case studies within its financial sector. The country is highly digitalised and faced important cyberattacks targeting their operator of essential services in the past which led them to develop sectoral IRC before the publication of the NISD.

text: An overview of the methodology, an assessment and presentation of the data collection are presented in chapter 3 and 4.

text: 1.3 SCOPE OF THE WORK AND DEFINITIONS

text: This study provides data and analysis on the recent changes and evolutions of IR capabilities (IRC) within NISD sectors in Member States (and Norway).

text: The study focuses on:

text:  The impact of the NISD on the organisation and conduct (layout) of IR and on CSIRT operational set-up in all EU MS;  The cooperation models and the capabilities (including processes, procedures and tools) developed by MS for each NISD sector;  The way sectoral CSIRTs and other IR actors (private sector, OES) function in conjunction with the national CSIRT in crisis/large incident situations from communication processes to escalation procedures and incident management;  Good practices, lessons learned and key challenges in this area.

text: It was therefore important to agree on the definition of the key structuring concepts and elements of the study.

text: The following definitions have been used in this document and shared to define the scope and key concepts of the research:

text: Incident response (IR): The protection of an organisation's information by developing and implementing an IR process (e.g. plans, defined roles, training, communications, management oversight) in order to quickly discover an attack and effectively contain the damage, eradicate the attacker's presence, and restore the integrity of the network and systems.

text: Incident response capabilities (IRC): Incident response capabilities are the processes (e.g. plans, defined roles, training, communications, management oversight), procedures and tools (log analysis, Intrusion Detection Systems, Vulnerability scanners, Data Capture & Incident Response Forensics Tools, Patch management systems, etc.) used to respond to identify, respond and mitigate an attack, to restore continuity of service.

text: Incident response models: Within the survey, a typology of four Incident Response models have been defined:

text:  Centralised: the national CSIRT is in charge of handling incidents across the different sectors; it provides a centralised point for incident reporting and analysis, decision making, response coordination, and information dissemination.  Distributed: the national CSIRT has core responsibilities to handle incidents and works with a competent authority for each sector (e.g. national ministries or public agencies); the role of these actors may be to facilitate incident notification and information dissemination.

text:  Hybrid: a national CSIRT and the sectoral CSIRTs share the IR responsibilities and operations, which may depend for example on the sector(s) impacted or the scale of the incident.  Decentralised: a sectoral CSIRT is in charge of handling incidents in a given sector from incident detection to response coordination and decision making, including coordinating with other stakeholders.

text: National/Government (N/g) CSIRTs: Teams that serve a country’s government by helping to protect its critical information infrastructure. N/g CSIRTs play a key role in coordinating incident management with the relevant stakeholders at national level. They also bear responsibility for cooperation with other countries’ national and governmental teams.

text: Sectoral CSIRTs: Entities that respond to computer security or cybersecurity incidents affecting a specific sector. Sectoral CSIRTs are usually established in NISD sectors such as Healthcare, Public Utilities, and the Financial Sector. Unlike the National/Government CSIRTs who serve the public sector, sectoral CSIRTs provide services to constituents from a single sector only (in the context of this study, the Sectoral CSIRTs and sectors mentioned are mainly NISD sectors).

text: NIS Directive: The Directive on Security of Network and Information Systems (NISD) was adopted by the European Parliament on 6 July 2016 and entered into force in August 2016. The NISD provides legal measures to boost the overall level of cybersecurity in the EU.

text: NISD sectors: Sectors vital for the European Union’s society and economy and heavily dependent on ICT. Seven sectors are listed in the NIS Directive (NISD sectors), for which Member States have been requested to identify operators of essential services (OES). The seven sectors – and related sub-sectors - listed in the Directive are:

text:  Energy (electricity, oil, gas);  Transport (air, rail, water, road);  Banking;  Financial market infrastructures;  Health sector;  Drinking water supply and distribution;  Digital Infrastructure.

text: Operator of Essential Services (OES): Operators of essential services are private or public sector entities who play an important role in providing security in healthcare, transport, energy, banking and financial market infrastructure, digital infrastructure and water supply. According to the NIS Directive, the Member States should be responsible for determining which entities meet the criteria of the definition of operator of essential services .

text: Digital Service Provider (DSP): A digital service provider is an entity who provides one or more of the three types of digital service:

text:  Cloud computing services: digital services that enable access to a scalable and elastic pool of shareable computing resources.

text:  Online marketplaces: digital services that allow consumers to conclude online sales or service contracts with traders online using computing services provided by the online marketplace.  Online search engines: digital services that allow users to perform searches of, in principle, all websites or websites.

text: Figure 1: NISD sectors (Source ENISA)

text: 2. METHODOLOGY AND DATA COLLECTION

text: 2.1 OVERVIEW OF THE METHODOLOGY

text: The methodology to identify, collect and analyse data on Incident Response set-up and capabilities within the NISD sector is illustrated in the graphic below. It aggregates a succession of steps which are presented in this chapter. Figure 2: Overview of the methodology

text: 2.2 A SEVEN-STEP APPROACH 2.2.1 Step 1 – Definition of the research focus for the data collection

text: The research focus of the study was defined by building an analysis grid to be used to classify the information collected on Sectoral IRC, by defining a set of analysis criteria and theme. The list of criteria was defined according to elements of interest for ENISA and additional criteria pertaining to the specific data sought in the context of this study (e.g. cooperation aspects, recently created entities, etc.). The list of criteria defined are presented in Annex 1.

text: EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 2.2.2 Step 2 – Desktop research in open source on NISD Sectors IRC

text: This step consisted in conducting a literature review and open source research to collect data on sectoral IRC and recent trends in the field of IRC.

text: During this step, the research team used the pre-defined classification criteria to build an analysis grid. The purpose of this analysis grid was to facilitate the data collection by focusing the research work on the key topics of interest for ENISA and to present the raw data in a structured way.

text: During a preliminary data collection phase, the relevant data was gathered in the data classification grid by a first team of analysts. The preliminary data was then validated and further enriched by a second team of analysts.

text: 2.2.3 Step 3 – Designing and validating the survey

text: Publicly available information on Sectoral IRC procedures and tools was, as anticipated, not detailed enough to provide insightful input (see part 3.1.2). It was therefore planned early on to conduct a survey to collect comprehensive data from relevant parties.

text: Once the objective of the survey was defined, two categories of organisations were identified to participate to the survey:

text:  28 Member States’ national CSIRTs and Norway;  Additional sectoral CSIRTs from the 28MS and Norway.

text: Norway has also been included in the scope of the study because it provides interesting case studies within its financial sector including FinCERT, an entity involved in the IR for Financial sector also in other Nordic countries. The country is highly digitalised and faced important cyber-attacks targeting their operator of essential services in the past leading to the early creation of sectoral IRC, before the publication of the NISD.

text: The Project Team then drafted the survey which could be sent to both audiences considering aspects such as data protection, privacy and legal aspects, language, size and format, and structure.

text: 2.2.4 Step 4 – Conducting the survey and complementary interviews

text: The survey was sent by ENISA to the 28 national CSIRTs and additional sectoral CSIRTs CSIRTs that were recommended by CNW members. To maximise participation the survey included a presentation of the study and its context.

text: Targeted emails were sent to relevant contacts and followed-up on, to ensure answers from a maximum of Member States and sectors.

text: Following the survey, additional interviews were conducted to complement and further enrich the data collected with the survey and desktop research with both:

text:  National and sectoral CSIRTs who replied to the survey;  National and sectoral CSIRTs who did not reply to the survey.

text: A list of entities was drafted for each with a rationale for the interview which was validated by ENISA.

text: Once an organisation agreed to participate in the interview, a timeslot was scheduled and a list of 6 to 7 questions was sent to the interviewees ahead of the interview based on the answers provided in the short questionnaire or additional element to fill in information gaps.

text: 2.2.5 Step 5 – Collation of raw data

text: The raw data collected from the desktop research, the survey and the interviews, was gathered in structured tables in a collaborative tool.

text: The collaborative tool allowed the aggregation of all raw data, the generation of statistics and the identification of key input.

text: 2.2.6 Step 6 – Analysis and identification of trends

text: The methodology used in this step was a qualitative use of the Delphi Method, which ensures that the data collection team and the data analysis team benefit from and build on each other’s expertise, and that the final analysis addresses all aspects of the request presented in a concise, coherent and comprehensive way.

text: A first analysis of the raw data was made by the data collection team and the data analysis team to develop a draft set of key findings. Once analysis methods were applied, a first version of the key findings of the study was drafted and subjected to validation and further discussion.

text: At a second stage, a virtual workshop held via videoconference was organised with members of the ENISA Informal Expert Group on Sectoral Incident Response Capabilities .

text: Once the virtual workshop was held and all final comments received, a second version of the key findings of the study was drafted and subjected to validation and further discussion.

text: 2.2.7 Step 7 – Final report

text: This final step consisted in further developing findings of specific interest to ENISA and in drafting the final report of the study in collaboration with the member of the IEG.

text: 2.3 OVERALL ASSESSMENT OF THE DATA & INFORMATION AVAILABILITY

text: The identification of reliable and qualitative data was crucial throughout the study. For each of the three activities conducted during the study, namely the desktop research phase, the survey and the complementary interviews, an overall assessment the data and information availability was conducted, and several assumptions are noteworthy.

text: 2.3.1 Desktop research – Data collection assessment

text: During the open-source desktop research phase, information on IR layout and set-up were collected for 17 out 28 Member States.

text:  The clarity and level of information available on the national IR approach in NISD sectors was very different from one Member States to another and not all of them had information publicly available;  Information on procedures, processes and tools used by Sectoral IR teams were rarely, if ever, detailed in publicly available documents;  Publicly available information about cooperation models or cross-border procedures was not detailed;

text:  Qualitative information on information exchange communities and fora were rarely, if ever, detailed in publicly available documents.

text: 2.3.2 Survey – data collection assessment

text: The survey collected answers from 24 respondents: 18 National CSIRTs and 6 Sectoral CSIRTs from 17 Member States and Norway (knowing that the minimum planned requirement was responses from 15 MS).

text:  Efforts were made to cover all Member States, but the survey was conducted between June and August, a challenging moment to find available yet relevant respondents;  A majority of respondents were National CSIRTs, resulting in the collection of input

text: more focused on national approaches towards IR in NISD sectors rather than

text: sectoral approaches and capabilities;  18 out of 24 respondents provided one or several qualitative comments through the survey.

text: 2.3.3 Interviews – data collection assessment

text: In total, 8 complementary interviews were conducted: Two with national CSIRTs representatives and one with a Sectoral CSIRT representative who had replied to the survey. One with a sectoral expert who did not participate to the survey and four with experts from the Informal expert group.

text:  Efforts were made to collect additional inputs from sectoral stakeholders. It allowed to draft interesting case studies but not to develop an analysis at sectoral level;  The interviews allowed to get deeper insights on procedures, processes and tools used within the interviewees’ organisation.

text: 3. KEY FINDINGS

text: 3.1 KEY FINDING #1 3.1.1 Member States’ organisational culture and resources tend to shape IR layout and set-up

text: The sectoral Incident Response layout and set-up at national level across the EU is strongly impacted by the national organisational culture of each Member State. Countries with a very centralised state culture tend to have a centralised Incident Response model under the supervision of the national CSIRT, whereas decentralised countries tend to have more hybrid or decentralised models with sectoral CSIRTS in charge of Incident Response.

text: According to the survey and as illustrated in the graph below, the IR model is centralised or hybrid for 90% of the respondents and 100% of countries with centralised organisational culture have a centralised IR model.

text: Figure 3: Entity in charge of Incident Response by Sector

text: 0 6 12 18 24 EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

text: NB: The respondents to the survey could select the competent entity in charge of Incident Response within each sector and sub sectors. NA is the number of respondents who did not provide an answer for the sector or sub-sector. As an example, for the energy sector:

text:  The national CSIRT is the entity in charge or IR for the Energy sector for 8

text: respondents;  A Sectoral CSIRT is the entity in charge or IR for the Energy sector for 4 respondents;  The OES are the entities in charge or IR for the Energy sector for 6 respondents;  5 respondents did not provide answer to for this sector;  Both the national CSIRT and the OES are the entities in charge or IR for the Energy

text: sector for 1 respondent.

text: National CSIRTs

text: Based on Figure 1, all NISD sectors and/or sub-sector, the main entities in charge of incident

text: and OES are the

text: response for 51% of the respondent are the national CSIRT in cooperation with the OES.

text: entity in charge of IR for 51% of the respondents

text: Table 1: Case study - Sectoral IR layout and set-up: France vs The Netherlands

text: The national CSIRT’s mandates and financial resources also strongly impact the sectoral Incident Response layout and set-up.

text: Within each Member State, National CSIRTs can have different mandates, among others:

text:  Raising awareness on threats;  Identifying risks;  Protecting and hardening systems;  Deterring attacks;  Monitoring and detecting incidents;  Responding to incidents;  Recovering from incidents;  Integrating and disseminating lessons learned.

text: As an illustration, when building CERT-UK, the United Kingdom’s national CSIRT, the UK Cabinet Office identified 47 possible functions of a national CSIRT, but ultimately prioritised only four in the creation of CERT-UK .

text: Another interesting case to mention is the Czech Republic layout. The Czech governmental Sectoral IR CERT constituency is consists of owners of important information networks and providers of layout depends

text: essential services (energy, etc.). The national CSIRT provides Incident handling for all other strongly on the subjects within the sectors and some private subject have their own IR teams . Hence, there

text: national CSIRT

text: are no sectoral CSIRTs in the Czech Republic.

text: mandate and budget

text: The research highlighted that several national CSIRTs’ mandates do not include Incident Response, often because of a lack of resources. National CSIRTs tend to delegate functions such as identification of Operator of Essential Services (OES) and Incident Response activities to sectoral authorities and sectoral CSIRTs. Additionally, even if national CSIRTs do not include the IRC, they do include and are responsible for national Incident coordination.

text: Table 2: Case Study Sectoral IR layout and set-up: Portugal

text: EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.1.2 Lessons learned and recommendations

text:  The organisational culture of a country could be further taken into account when analysing

text: the Incident response model of European countries.  A deeper insight into MS national CSIRTs’ mandates would be an interesting topic to be

text: further studied by ENISA to better assess the overall IR layout. This could be done by using CSIRT maturity products .

text: EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.2 KEY FINDING #2 3.2.1 The NIS Directive has improved the IR organisation and governance by clarifying actors’ roles and responsibilities

text: The transposition of the NIS Directive into national legislation seems to be having a positive impact on the Incident Response (IR) landscape at national level, contributing to improved overall organisation and governance.

text: Figure 4: Main features of the changes following the NIS Directive

text: According to national CSIRTs, the Directive has led to a clarification of the roles and responsibilities of the various actors involved in IR at all levels, and the ongoing implementation is leading to significant organisational changes, including:

text:  The formal identification of OES;  The creation of sectoral CSIRTs.

text: The NISD has

text: This positive impact is less visible in countries with a more mature organisational layout. The

text: had a positive

text: data collected indeed suggest that the NISD had an unequal effect from one country to

text: impact on the

text: another.

text: clarification of

text: During the survey, respondents were asked about the impact of the NISD of the set-up of their the roles and IR capacities on a scale from 5 (high impact) to 0 (no impact). The replies show that: responsibilities

text: of IR

text:  10 out of 24 respondents thought that the NISD had an important impact (5 to 3);

text: stakeholders.

text:  13 out of 24 respondents thought that the NISD had a relatively small impact (2 to 0);  1 respondent did not provide an answer.

text: Figure 5: Evaluation of the changes on the CISRT/IR layout and operational set-up

text: 8 7 6 5 4 3 2 1 0 5 (highly) 4 3 2 1 0 (not at all) NA “The NISD didn’t

text: “Before the transposition of the NISD we had a law and strategy that already set this way. The

text: change much,

text: NISD was treated as an update to the previous law and continues the way of thinking.”

text: since we were

text: (National CSIRT)

text: working in the

text: According to the results of the survey, the countries who tend to be less impacted by the same way

text: Directive are the countries with a more mature landscape who already had a clear

text: before.”

text: governance and definition of roles and responsibilities.

text: (National CSIRT)

text: The evolution of the maturity of MS IR landscape could be an interesting area to further study by using the ENISA CSIRT Maturity Toolkit based on SIM3 (https://opencsirt.org/maturity/sim3/). These mixed results highlight the fact that there are still important differences between Member States’ cybersecurity landscape and IRC at large.

text: 3.2.2 Lessons learned and recommendations

text:  Based on received data, it would be interesting to have another round of analysis to evaluate the mid- and long-term impacts of the NIS Directive on IR layout once the NISD has been completely implemented in all the MS.

text: It would be useful to conduct a maturity assessment of sectoral CSIRT landscape within NISD sectors (using ENISA CSIRT Maturity Toolkit as a basis) and to identify future changes.

text: EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.3 KEY FINDING #3 3.3.1 The implementation of the Directive raises operational and regulatory challenges and highlights MS willingness to move forward by extending the scope and number of sectors targeted

text: Following the transposition of the Directive into national legislation, EU Member States are now in the process of implementing the regulation. The two main challenges raised by respondents and confirmed by sectoral experts are regulatory and operational.

text: Figure 6: Assessment of the challenges faced during the implementation of the NISD

text: 5 (strongly agree) 4 3 2 1 (not agree at all) Organisation challenge: find the right governance model 6 10 between national and sectoral actors Regulatory challenge: to develop the right legal framework enabling the 8 11 uptake of security requirements and the notification of… Operational challenge: to establish effective 6 10 response and trusted collaboration mechanisms among sectoral actors Capability challenge: to ensure that sectoral actors 8 12 have the necessary IR expertise and capacities Technical challenge: to develop and/or adopt 2 12 the relevant IR tools at a sectoral level 0 12 24

text: The legal and administrative definition of what constitutes an OES can pose a challenge

text: NISD

text: for the authority in charge of defining the list of OES within the NISD Sectors. There are two

text: implementation

text: issues in defining the OES:

text: poses regulatory

text:  The legal definition and threshold/criterion of what constitutes an OES; and operational  The administrative identity of the OES: Name, headquarter, VAT number, etc. challenges

text: The threshold and criterion to identify the OES are defined by the authority which can be the national cybersecurity authority, the sectoral authority or another competent authority. The Directive provides an initial list of entities, but each MS has to define the thresholds and criterion for the sectors which can be based on quantitative aspects (share of market, tons of freight, etc.).

text: Table 3: Case-study: Maritime transport OES definition & threshold (United Kingdom)

text: The identification of all the OES can be an operational challenge in sectors with an extended range of suppliers and service providers. Sectors which include various public and private actors can depend strongly on SMEs in their value chain. Should these SMEs be targeted by a cyberattack, this could impact the entire value chain. It is therefore complex for the

text: regulator and/or the entity in charge of listing OES (be it the national CSIRT, the Sectoral Authority or the sectoral CSIRT) to map the dependencies and identify all the OES within the sectors and set-up thresholds.

text: Finally, classifying OES can become complex in the case of large companies who have more than one activity/branch which falls under the scope of NISD (e.g. an IXP (OES) might also operate as a cloud provider (DSP)). This could result in a company reporting to several sectoral authorities in a decentralised IR model, generating overlaps and duplication between the competent authorities.

text: Regulatory challenge: information-sharing and incident notification

text: A regulatory challenge posed by the implementation of the Directive concerns informationsharing with third countries, especially when there is not an adequate legal basis under GDPR for such sharing. A national CSIRT analyst may find actionable information which could be of great help for another country, but he/she may not legally be able to share this information with that other country’s authority.

text: As an example, in order to mitigate relevant challenges, the transposition of the NISD into Dutch law allows the NCSC-NL (CISRT for government and OES in the Netherlands) to share actionable information outside of its mandate to third countries’ IR entities as long as the entity is a CSIRT and if it is believed that the entity has the capacity to use the information and will do so in a reasonable manner.

text: Moreover, it should be noted that in the case of a security breach involving personal data (as e.g. in the bank, finance or health sector), aside reporting to the national CSIRT, the national Data Protection Authorities (DPAs) should be notified, according to GDPR..

text: According to one of the interviewee, there may be a missing link between the national CSIRT and the national Data Protection Authority, and it would be therefore interesting to think of a communication channel between the two types of authorities covering the incidents where personal data is part of the security breach.

text: NISD

text: Extension of the scope and number of NISD sectors

text: implementation is leading to

text: As mentioned above, the implementation of the Directive is still in progress in some Member States, but the research highlights significant differences among national operational set-ups: significant

text: differences

text: While transposing the NIS Directive into national legislation, some Member States opted for among MS and, using the 7 sectors listed in the NIS Directive (see Section 3.1 Definition) while others decided in some MS, to to extend the scope and number of sectors covered:

text: an extension of the scope and

text:  12 out of 28 MS have extended the scope of NISD sectors and added entities not listed in

text: number of

text: the NISD as OES.

text: sectors covered

text: The sectors mostly added are electronic communications/telecommunication networks (for 7 out 12 MS) and chemical Industry.

text: Table 4: Extended scope of sectors and OES

text: EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.3.2 Lessons learned and recommendations

text:  An overview of all MS NISD sectors (including additional ones) should be published by ENISA

text: to allow MS or sectoral actors to leverage synergies between sectors;  MS who have already defined their OES could continue sharing their lessons learned and

text: good practices. This information should be made available to the authorities in charge of defining OES and identifying the OES if different.

text: EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.4 KEY FINDING #4 3.4.1 A blend of bottom up and top down incentives could be the most efficient driver for the creation of sectorial CSIRTS, depending on MS IR layout maturity.

text: The NIS Directive is one of the three key drivers for the creation of sectoral CSIRTs, along with lessons learned from past incidents and the lack of sector-specific knowledge of the national CSIRT, according to the respondents.

text: “[The creation of the sectoral CSIRT was driven by] a need to collaborate and coordinate Incident Response against ongoing cyberattacks” (Sectoral CSIRT)

text: Figure 7: Key drivers to create sectoral IR capabilities

text: The implementation of the NIS Directive 6 8 The lack of sector-specific knowledge or capacity of the National CSIRT Lessons learnt from past incidents 8 6 The difficulties of managing the cybersecurity 1 13 incidents in the NISD sectors The complexity of managing the high number 2 12 of OES in some of the NISD sectors Other. Please, specify 3 10 Yes No NA

text: Demand-driven

text: For 8 out of 24 respondents, the creation of sectoral IRC was driven by lessons learned from past incidents while for 6 out of 24 respondents it was the lack of either sector-specific knowledge or national CSIRT capacities. In other words, according to the survey, a bottom-up (demand-side) incentive favoured the creation of sectoral IRC.

text: In some of the cases, operators of essential services (public or private entities) created a sectoral CSIRT on their own initiative. This is also the case for non-EU sectoral CSIRTs such as the NordicFin CERT which provides a good illustration of a cross-border sectoral IRC set up prior to the publication of the NISD to respond to an operational need.

text: Table 5: Case Study NordicFin

text: A highly digitalised Financial sector in Nordic countries – vulnerable to cyber attacks

text: According to the Digital Economy and Society Index (DESI), the most digitalised countries in Europe are Denmark, Finland and Sweden . They adopted digital financial services such as online banking, digital investment services or online provision of credit early, as illustrated in the chart below.

text: According to The Bank of Finland Bulletin, “Not only have banks in the Nordic countries invested in digitalisation; the position of new FinTech actors is also better in the Nordic region

text: than in many other countries.”

text: This growing digitalisation of the Nordic financial sectors opened new vulnerabilities to cyber threats.

text: A need to collaborate to better respond to an increasing number of cyber attacks

text: From 2007 to 2016, Nordic countries experienced numerous attacks on their financial sector.

text: In 2007, Norway was targeted by their first internet banking malware attacks. Between 2008 and 2011, financial operators collaborated through both formal and informal schemes to respond to cyber incidents. In 2012, Sveriges Riksbank (central bank of Sweden) was hit by a Distributed Denial of Service (DDoS) attack which left its website offline for 5 hours. In 2014, a DDoS attack on seven large financial institutions in Norway resulted in suspended services for an entire day. In Finland, at the end of 2014, three banks (Op Pohjola, Danske Bank and Nordea) suffered DDoS attacks that rendered their online services unavailable and for one bank prevented customers from withdrawing cash and making card payments.

text: Lessons learned from incident called for IR cooperation at national level

text: In 2012, in Norway, while the National Cyber Security Strategy was in the process of being created, the country experienced a peak of attacks and decided to set up a national platform, FinansCERT, dedicated to responding to cyber threats targeting the financial sector. FinansCERT was created to formalise collaboration between relevant actors, and actively cooperates with the national CSIRT and with the law enforcement computer crime unit. FinansCERT Norway, based in Oslo, was operational from 2013 to 2017.

text: A demand from operators to create a cross-border capability to collaborate to fight cybercrime

text: In 2017, the largest banks operating in the Nordic countries, namely Nordea, Danske Bank and DNB worked on a project to set-up a single payment clearance system which would be operated by one company for all the Nordic countries. To secure this project and face a

text: growing number of attacks, Danske Bank, Nordea, DNB, Sparebank 1 and Eika Group, among other Nordic banks, decided to expand FinansCERT, to develop a collaboration platform to the entire Nordic region: Nordic Financial CERT (NordicFin CERT).

text: Nordic-Fin CERT mandate

text: The Nordic Financial CERT aims at fortifying the Nordic community in the face of cyber risks to customer assets and at providing a safety net for all financial institutions, big and small. It envisions a Nordic community in which the financial sector actively and responsively identifies, defends against and combats cyber risks. The collaboration will enable the banks to gather the best knowledge available about fighting cybercrime in the Nordic financial sector, and it will lead to synergies that will improve both the customers’ and the banks’ security.

text: Sources

text: https://www.bofbulletin.fi/en/2018/2/nordic-banks-go-digital/ Cyber Risk for the Financial Sector – IMF, A. Bouveret, 2018 https://www.nordea.com/en/press-and-news/news-and-press-releases/pressreleases/2017/04-10-08h00-nordic-banks-collaborate-on-fighting-cybercrime.html

text: Regulation-driven

text: For other Member States, the NIS Directive was the main reason for initiating such capacities. As a result, their sectoral capabilities are recent or still work in progress. In those cases, the NIS Directive and the GDPR were an opportunity to justify the need for additional resources to increase capabilities and create sectoral CSIRTs. However a major increase of financial resources was rarely noted according to the data collected.

text:  It was the implementation of the NIS Directive for 6 out of 24 respondents, which was the main driver for the creation of Sectoral capabilities.

text: As an illustration, Bulgaria is in the process of creating seven sectoral CSIRTs as a consequence of the transposition of the NISD in the national legislation.

text: In some cases, the creation of sectoral capacities is driven by both national authorities and operators. This is the case in The Netherlands, which features many sectoral CSIRTs although the national CSIRT (and cybersecurity agency) also play a proactive role.

text: The support of

text: The support of national CSIRTs to the development of sectoral CSIRTs and capabilities

text: national CSIRT to

text: tends to be of great added value because it capitalises on existing expertise.

text: develop and

text: A noteworthy initiative, pre-dating the NIS Directive, is that of the Dutch NCSC, which provided enhance Sectoral incentives and guidelines to support the creation of CSIRTs: IRC is key to

text: capitalise on

text:  Guidelines to start a collective CSIRT ;

text: existing

text:  Guidelines to operationalise a CSIRT: NCSC’ CSIRT Maturity Toolkit .

text: expertise

text: NCSC-NL also appointed a liaison officer whose mission was to follow the creation of sectoral CSIRTs. The liaison officer came to the sectoral CSIRT’s premises 2 days a week to support the newly created team.

text: It also worth mentioning that countries with a centralised Incident Response model tend not to have, nor to plan to develop specific sectoral CSIRT capabilities since the national CSIRT tend to have sectoral IR teams within its structure. In these countries, IR is directly managed by the OES and reported straight to the National CSIRT or governmental CSIRT such as in Czech Republic (see Key Finding 1).

text: 6 out of 24 respondents confirmed that there are no sectoral CSIRTs in their country.

text: “Currently we do not provide sectoral CSIRTs and there is no plan to create any” (National

text: CSIRT)

text: 100% of respondents with no sectoral CSIRT have a centralised IR model with national CSIRT as the competent authority for NISD sectors.

text: “We don’t tend to use sectoral CSIRTs but [the national CSIRT] ’s Engagements Team do maintain close contact with all NISD sectors.” (National CSIRT)

text: 3.4.2 Lessons learned and recommendations

text:  Sectoral actors could benefit from the experience and knowledge of national and other sectoral CSIRTs, for instance through the appointment of a liaison officer, sharing of knowhow, expert advice or tailored training.  ENISA should continue to collect available resources (guidelines and toolkits), for example by enabling a GitHub repository.

text: EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.5 KEY FINDING #5 3.5.1 National CSIRTs have developed mature reporting processes and notification tools, as have sectoral CSIRTs who provide solutions specific to their sectors’ needs

text: The nature of the capabilities developed and used by sectoral CSIRTs in contrast with national CSIRTs strongly depends on the range of services that both can provide to their constituents.

text: According to FIRST “CSIRT Services Framework ”, CSIRTs can provides various cyber

text: security services and functions:

text: Table 6: FIRST’CSIRT Services Framework V2.0

text: REPORTING TOOLS

text: Email-based reporting One of the most common services provided by both National CSIRT and Sectoral CSIRT tools (secured and/or according to the survey is information security incident reporting. To provide this specific encrypted), Secured service, both National CSIRTs and Sectoral CSIRT have developed and/or use mature networks/chats, Web reporting processes and notification tools to allow citizens, OES and other private or public- forms, notification sector organisations to report incidents. portals, collaboration portal, in-house Notification and reporting tools of national CSIRTs and sectoral CSIRTs developed tools (inhouse notification According to the survey, 83% of respondents use incident notification templates and 100% have portal). specific information-exchange tools to enable the notification of incidents.

text: OTHER TOOLS

text: The reporting tools used by both national CSIRT and sectoral CSIRT identified through the Early detection survey and the desktop research are: systems, monitoring systems, Industrial  Email-based reporting tools (secured and/or encrypted), Secured networks/chats, Web forms, control systems, notification portals, collaboration portal, in-house developed tools (in-house notification portal, Threat intels systems,

text: 30 Malware Information customized tool based on RTIR ). Sharing Platform (MISP), IntelIMQ,

text: 30 information sharing

text: The other tools identified are:

text:  Early detection systems, monitoring systems, Industrial control systems, Threat Intel systems,

text: Malware Information Sharing Platform (MISP) , IntelMQ , information sharing platforms and tools.

text: Table 7: Case study: CERT-BE, Belgium

text: Depending on their mandate, sectoral CSIRTs tend to offer the same range of incident reporting and notification services as the national CSIRT, including similar notification tools and reporting processes which rely mostly on web forms and email.

text: Table 8: Case study: DSP-CSIRT, The Netherlands

text: However, if sectoral CSIRTs appear to use reporting and notification tools and capabilities similar to the national CSIRTs’, they also provide services more adapted to the sector’s

text: specificities and needs.

text: Sectoral CSIRT specific capabilities and services

text: When asked about the main added value of sectoral CSIRT, respondents to the survey and sectoral experts raised the following:

text:  Better knowledge of specific sectors’ threat landscape;

text: By working on a more focused perimeter, sectoral CSIRTs gain robust knowledge of the specific risks and threats targeting their sectors. As an illustration, the Dutch Health sector CSIRT, Z- CERT , offers specialized services to healthcare institutions by publishing regular white papers on the specific threats targeting hospitals.

text:  Better knowledge of the entire sector value-chain and better relationship with vendors;

text: Sectoral CSIRTs tend to have more direct contact with sectoral operators. Operators can often register as participants to sectoral CSIRTs to better benefit from said CSIRT services. Hospitals (ranging from academic "UMCs", top clinical "STZ" to "general" hospitals) as well as mental healthcare institutions ("GGZ") can register with Z-CERT as participants (constituency) .

text:  More qualitative and operational information sharing, better sharing of good practices.

text: Sectoral CSIRTs provide or are used as information-exchange entities either to share identified vulnerabilities, incidents or lessons learned. Z-CERT, for instance, informs its constituency of any vulnerabilities detected in medical devices, medical networks and medical applications. To those participants affected by a vulnerability, Z-CERT provides advice on how best to deal with the situation. Z-CERT also sends out alerts regarding possible threats and current attacks. Z- CERT shares its knowledge (through the release of whitepapers, for example) with its participants, facilitates meetings for its participants, and hosts networking events and theme sessions .

text: Sectoral capabilities maturity assessment

text: When assessing the maturity of the tools and processes used by national and sectoral CSIRT, two specific factors must be taken into consideration.

text: First, the maturity of the CSIRT itself: a more mature (see ENISA Maturity Evaluation Methodology for CSIRTs) CSIRT will tend to have better developed tools and processes than others.

text: In The Netherlands, the national CSIRT appointed a liaison officer to follow the creation of the sectoral CSIRT and support their development and maturity. According to the liaison officer:

text: There is a

text: “They [Sectoral CSIRT] are growing in staff but it is challenging to find people with cyber shortage of

text: security skills. Besides, we have also seen growth in services, number of staff and

text: skilled staff to

text: expertise. Our CSIRT for Municipalities and the Health-CERT have been around a couple

text: conduct IR tasks

text: years now, grow in more mature CERTs every day, and expand their services from the

text: within both

text: traditional incident response activities to activities focused on tackling more long-term cybersecurity problems by writing advisory products and developing threat landscapes for national and

text: their constituency.” sectoral CSIRTs

text: The shortage of skilled staff for both national and sectoral CSIRT has been identified has a recurrent issue by IR experts.

text: Highly regulated sectors and maturity of IRC

text: Secondly, reporting processes and information exchange tend to be more mature in highly regulated sectors. As stated in the NIS Directive, requirements for notification of incidents can be part of normal supervisory practice in the highly regulated sectors or sectors ruled by a supervisory mechanism.

text: For example, the financial sector has particular regulations which require the notification of incidents impacting the network and information systems and call for specific IRC and monitoring tools.

text: “Financial institutions are particularly exposed to cyber risk due to their reliance on critical infrastructures and their dependence on highly interconnected networks. Critical financial market infrastructures include payment and settlement systems, trading platforms, central

text: securities depositories, and central counterparties.”

text: The Financial and banking sectors are targeted by increasingly frequent and sophisticated cyber-attacks. According to an IMF study on cyber risks (Cyber Risk for the Financial Sector: A Framework for Quantitative Assessment, WP/18/143, July 2018) , cyber-attacks targeting the financial sectors can have several effects:

text:  Business disruptions prevent firms from operating, resulting in loss revenue;  Fraud leads to direct financial losses;  Data breaches take more time to materialize, through reputational effects as well as litigation costs.

text: To tackle these risks and avoid cascading effects at European level, the European Central Bank (ECB) conducted a thematic review on cyber security risk in 2015 (prior to the NIS Directive) and targeted on-site inspection . In 2016, the ECB Banking supervision has implemented a

text: cyber-incident reporting framework as a pilot scheme which was rolled out to the

text: banking institutions in 2017 . All significant institutions from the 19 Eurozone countries have to report significant cyber incidents as soon as they detect them. This enables supervisors to identify and monitor trends in cyber incidents affecting significant institutions and to gain a deeper knowledge of the cyber threat landscape. It also allows for a swifter reaction to a potential crisis caused by a cyberattack .

text: Table 9: Case study: TIBER-EU - threat intelligence-based ethical red-teaming framework

text: EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.5.2 Lessons learned and recommendations

text:  Sector specific regulations tend to act as a key driver to enhance IRC. ENISA and sectoral

text: authorities should collaborate more if possible to streamline IRC-related guidelines or good practices within the future regulation.  The mitigation of the shortage of skilled staff for IR activities at both national and sectoral level

text: should be a priority for MS. Innovative methods to attract and retain skilled staff could be studied along with relevant incentives such as training building on existing practices within the Member States.

text: EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.6 KEY FINDING #6 3.6.1 There is a multiplication of information-exchange tools to facilitate cooperation at sectoral, national and EU/international level, but the quality of the exchange depends on both organisational and structural criteria

text: The importance of sharing information is widely recognised among Member States, highlighted by a growing number of initiatives to foster cooperation through information exchange at national, European and international level.

text: These initiatives can take very different forms:

text:  Cooperation agreements;  Cooperation and information platforms;  Dedicated fora, communities and networks;  ISACs and other information centres.

text: Sectoral initiatives at national level

text: There is a multiplication of initiatives such as ISACs, networks and fora at national level to foster information exchange and increase awareness among stakeholders within a sector. Certain fora and communities were created in the early 2000’s but a growing number are currently being created to respond to the need of information exchange.

text: Table 10: Information exchange initiatives at national level within sectors

text: Trans-sectoral initiatives at national level

text: According to the survey, 55% of respondents have a network of IR actors at a national or sectoral level to exchange good practices on cyber information exchange, capabilities, cooperation etc. to support the development of OES IRC.

text: National CSIRTs have developed dedicated platforms for information exchange and cooperation which are open to OES from all NISD sectors.

text: Table 11: Information exchange initiatives at national level cross-sectors

text: Initiatives at European / regional level

text: Several initiatives were identified at both European and regional level to support the creation and/or the uptake of tools facilitating the exchange of technical information about incidents.

text: Table 12: Information exchange initiatives at European level

text: According to the respondents of the survey, the three most used groups to exchange with peers

text: at European and international level are the CSIRT Network (27%), the TF CSIRT (23%) and the FIRST Community (22%).

text: Figure 8: Main groups use to exchange with peers

text: 12% 27% 23% 22% 12%

text: A discrepancy was identified between the quantitative data collected through the survey and complementary interviews on the use of the European Government CERTs (EGC) group. Only 12% of survey respondents (8 out the 17 National CSIRTs) use the EGC group to exchange IR good practices and experience, but the interviews with IR experts indicate that there are more frequent and qualitative exchange within this community which could be explained by the fact that not all EGC members have participated to the survey.

text: Cross-border initiatives

text: Cross-border cooperation relies mostly on information-sharing between MS (peer to peer exchange in regional communities) and cooperation agreements with other national CSIRTs.

text:  78% of respondents to the survey have specific measures in place to inform the relevant actors (national authorities and OES) in neighbouring countries about an incident that may impact them.

text: Figure 9: Assessment of the nature of specific measures to inform relevant actors in neighbouring countries about a cross-border incident

text: Quality and efficiency of information sharing in sustainable communities

text: The multiplication of networks and initiatives, however encouraging and a sign of rising awareness on the need to facilitate information exchange, must also be evaluated in terms of quality of the exchange within these fora.

text: Information-

text: Certain fora were created in response to legitimate sectoral needs. Yet these fora can lack the

text: sharing

text: organisational and structural means to sustain the efficiency of information-sharing, thus

text: communities and

text: undermining their raison d’être.

text: fora need

text: As an illustration, the European Cyber Security Organisation (ECSO) published a position paper resources to

text: 59 sustain the

text: on the creation of a European Energy ISAC which the paper claims lacks visibility among most European energy operators. In ECSO’s opinion, “EE-ISAC carries out many activities but the efficiency main outcomes and benefits of the organisation are not clear. In addition, EE-ISAC involves only a few energy operators whereas they should be strongly represented to drive the ISAC

text: activities according to the energy sector’s needs.”

text: Several factors are currently or could in the future jeopardise the quality and efficiency of the information-sharing initiatives such as:

text:  A lack of representativity and visibility within the sector: if there are multiple communities or platforms aiming the same objective within a given sector and if the communication and dissemination resources are not sufficient to raise awareness on the existence of the initiatives;  A lack of financial resources: If there is not enough budget to sustain the initiative on a long term;  A lack of trust between participants: within over-sized fora with too many stakeholders, it can be challenging to build trust to allow fruitful exchanges among participants;

text:  A fear of penalty for the voluntary reporting of incident caused by human error: when reporting human errors, stakeholders should be ensured not to be blamed or penalised to encourage sharing of lessons learned.

text: Finally, information sharing at sectoral level can also raise operational challenges:

text: According to one of the interviewees, “one of the difficulties is how to make sure the right

text: knowledge and information will reach all relevant organisations. On top of that, you want to

text: have a feedback loop where information flows from the national CSIRT to the sectoral CSIRT to

text: the individual organisations, it should not be a one-way-street.

text: Other challenges involve the fact that OES have a notification requirement to their Single Point of Contact and sectoral regulator, but not always to their sectoral CSIRT, which can sometimes

text: make the information sharing and notification duties a complex set of responsibilities. In addition, there is a risk of inefficiency.”

text: Finally, it can sometimes be challenging for Sectoral CSIRT and OES to assess when a threat or an incident can also have impact for other sectors and should be shared. In case a major incident which could have impacts in national security the National CSIRT would be in direct contact with the OES, and the Sectoral CSIRT in hybrid or distributed IR models. This situation could raise the question to delegate national security tasks to private sectoral CSIRTs.

text: This is why it seems like both a continuous exchange with national CSIRT and cross-sectors communication channel could be important to set-up or maintain at national level. This would

text: allow to share the work and avoid that several CSIRTs (national and sectoral) analyse the

text: same threat or event and does not share the analysis. Therefore, there it would mitigate the risk of doing double work with the already limited cyber security resources.

text: 3.6.2 Lessons learned and recommendations

text:  ENISA could further study the drivers to sustain information-sharing initiatives, develop a set of guidelines, user-friendly tools and enablers (such as “Secure Group Communications for incident response and operational communities” and “Proactive detection of network security incidents - incident response tools mapping” ) .  Dedicated collaboration schemes at MS level could avoid duplication of efforts and ensure that all relevant stakeholders are informed such as user-friendly cross-sectoral communication tools or channels between several authorities (NISD and GDPR authorities).  The anonymised voluntary reporting of human errors should be encouraged and supported to ensure that lessons learned are widely disseminated.  The promotion of responsible disclosure programs of vulnerabilities at sectoral level should be foster.

text: EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.7 KEY FINDING #7 3.7.1 There is a growing interest in training to enhance and foster preparedness in NISD sectors at European level

text: The NISD encourages MS to foster their preparedness by requiring the establishment of appropriate measures such as the creation of CSIRTs. Many MS have placed increasing cyber preparedness, in particular that of NISD sectors, as a priority in their national cyber security strategy.

text: Although, it was difficult to measure how this priority is concretely implemented at operational level, one of the key areas identified to increase preparedness is the set-up of training.

text: According to the FIRST CSIRTs services framework:

text: There is a need for sector-

text: “A training and education programme can help the CSIRT to establish relationships, and to

text: specific training

text: improve the overall cybersecurity posture of its constituency, including the ability to

text: to mitigate

text: prevent future incidents from happening. Such a programme can help maintain user awareness,

text: help the constituency understand the changing landscape and threats, train the shortage of

text: constituency on tools, processes and procedures related to security and incident skilled-staff

text: management.

text: This can be done through various types of activities including documenting the knowledge, skills and abilities (KSAs) required, developing educational and training materials, delivering content, mentoring, and professional and skill development. Each of these activities will collectively contribute to the constituency’s and the team’s capabilities.”

text: According to the survey, out of 24 respondents, sector-specific cybersecurity training activities are conducted:

text:  Regularly: 5 National CSIRT  Occasionally: 2 National CSIRT and 3 Sectoral CSIRT  No but planned in the future: 8 National CSIRT and 1 Sectoral CSIRT  No and not planned: 1 National CSIRT  Did not provide answer: 3 National CSIRT and 1 Sectoral CSIRT

text: Figure 10: Sector-specific training evaluation

text: Yes, regularly Yes, occasionally No, but planned No and not planned 17% 21% NA 4% 21% 38%

text: These answers indicate a significant interest from the sectoral CSIRT in training. It could be a concrete way to mitigate the shortage of skills highlighted in the previous findings.

text: Several initiatives already exist at both national and EU level to conduct trainings on Incident response procedures and tools.

text: Table 13: Case study: Good practices for training

text: EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.7.2 Lessons learned and recommendations

text:  ENISA should continue its efforts in the area of trainings and promote the training

text: programmes also within sectoral CSIRTs .  To mitigate the shortage of skilled staff and enhance IRC capabilities within sectors, raising

text: awareness in sectors about the added value of sector-specific training could be initiated.  Dedicated training could be created for sectoral actors. This could be done by first assessing

text: the sector-specific training needs with relevant stakeholders and identifying existing trainings (such as TRANSITS-I, TRANSITS-II, and the ones conducted by ENISA, FIRST, etc.) to build on their experience.  Sectoral CSIRTs might want to prioritize practical areas of IR:  Tools;  Taxonomy;  Responsible vulnerability disclosure;  Trust building;  Information sharing and developing skills and experience.

text: 3.8 FINAL RECOMMENDATIONS EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

text: 4. PRESENTATION OF THE RAW DATA

text: 4.1 DESKTOP RESEARCH – SECTORAL IR SET-UP

text: The objective of the desktop research was to identify Incident Response (IR) actors and bodies playing a role in NISD sectors across EU Member States.

text: This comprehensive analysis also focused on the distribution of responsibilities to present draft hypotheses on the emergence of new actors following the publication of the NIS Directive.

text: 4.1.1 Data structuring and classification criteria

text: The raw data gathered during the study was consolidated in an Excel table. It was first classified based on the 28 Member States.

text: Then, for each Member State, the following information was provided, when available:

text:  Summary of national approach towards IR in the NISD sectors  Incident Response general Set-up  NISD Sectors  Competent authorities;  Existing/newly created CSIRT or IR entities;  Role of OES;  Role of DSP.  Cooperation set-up & processes  IR processes and procedures (IR and reporting);  Collaboration procedures with NISD sectors;  Cross-border IR aspects.  Development of capabilities and other initiatives  Operational Preparedness and capacities;  Tools;  Initiatives, communities, etc.

text: 4.1.2 Overview of the Sectoral IR Set-up within the 28 Member States

text: 4.1.2.1 Desktop research – Key Figures

text: Table 14: Desktop research – Data Collection overview

text: EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT from 17 EU MS and Norway. 4.2 SURVEY AND INTERVIEWS – IR APPROACH AND SECTORAL CAPABILITIES

text: The objective of the survey and complementary interviews were to fill in the information gaps in the desktop research and gain deeper insight on IR set-up within the 28 Member States.

text: These activities also focused on the recent changes and evolution of Sectoral IRC and improve the knowledge on Sectoral CSIRTs processes, procedures and tools following the publication of the NIS Directive.

text: 4.2.1 Survey - Data structuring and classification criteria

text: The raw data gathered from the survey was consolidated in an Excel table. It was first classified based on the 28 Member States.

text: Then, for each Member State, the table was structured around the answers of each respondent according to the questions of the survey. Overview of the Sectoral IR Set-up within the 28 EU Member States

text: 4.2.1.1 Survey - Key Figures

text: The data collection relies on 24 responses from 17 EU Member States, and Norway. It also includes insights from another Member States who did not reply to the survey.

text: Figure 11: Respondents by countries 5 4 3 2 1 0

text: Two-thirds of respondents were national CSIRTs with IR teams of full-time equivalents ranging

text: from 4 to 90 people.

text: Figure 12: Respondents by entity

text: 25% 75% National CSIRT Sectoral CSIRT 4.2.2 Complementary Interviews – Rationale and key figures

text: The main objective of the survey was to collect main information of the IR set-up, along with quantitative assessment of recent changes and impact of the NISD. After reviewing the first results collected, complementary interviews were schedules with two different rationales:  Interviews with 2 national CSIRT and 1 sectoral CSIRTs who had already answered the survey to clarify some answers or collect additional and more qualitative inputs;  Interviews with other 1 sectoral CSIRTs to obtain deeper insight from the NISD sectors;  Interviews with 4 ENISA NIS Informal Experts Group to obtain deeper insight from their sectors.

text: Figure 13: Interviewees by organisation National CSIRT representative Sectoral CSIRT representative IEG experts

text: 25% 50% 25% EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

text: 5. BIBLIOGRAPHY

text: Bouveret, A., Cyber Risk for the Financial Sector, International Monetary Fund, 2018 ECSO, Position paper European Sector-Specific ISACs, European Cyber Security Organisation, December 2018 ENISA, Maturity Evaluation Methodology for CSIRTs, European Union Agency for Network and Information Security, 2019 ENISA, Strategies for Incident Response and Cyber Crisis Cooperation, European Union Agency for Network and Information Security, 2016 Loughlin, J., Centralization and Decentralization in French History, Subnational Government, 2007, pp. 25-44 NCSC, Guide to Starting a Collective CSIRT, National Cyber Security Centre, 2018

text: WEBSITES AND ONLINE PUBLICATIONS:

text: ANSSI, “The French CIIP Framework”, 2019. [Online]. Available: https://www.ssi.gouv.fr/en/cybersecurity-in-france/ciip-in-france/ Bank of Finland, Bulletin “Nordic banks go digital”, 2018. [Online]. Available: https://www.bofbulletin.fi/en/2018/2/nordic-banks-go-digital/ CERT-BE, “Report an incident”, 2019. [Online]. Available: https://www.cert.be/en/report-incident CERT-BE, “Traffic Light Protocol (TLP)”, 2019. [Online]. Available: https://www.cert.be/en/traffic-light-protocol-tlp CIRCL, “Training and Technical Courses”, 2018. [Online]. Available: https://www.circl.lu/services/training/ CNCS, “CERT.PT”, 2019. [Online]. Available: https://www.cncs.gov.pt/en/certpt_en/ CSIRT-DSP, “Duty to report incidents for digital service providers”, 2019. [Online]. Available: https://csirtdsp.nl/en/node/1 ECS, Position Paper “European Sector-Specific ISACs”, 2018. [Online]. Available: https://ecs-org.eu/documents/publications/5c0a6a3aac673.pdf European Central Bank, “What is TIBER-EU?”, 2019. [Online]. Available: https://www.ecb.europa.eu/paym/cyber-resilience/tiber-eu/html/index.en.html European Central Bank, “What is cyber resilience?”, 2019. [Online]. Available: https://www.ecb.europa.eu/paym/cyber-resilience/html/index.en.html ENISA, “History”, 2019. [Online]. Available: https://www.enisa.europa.eu/topics/csirts-in-europe/csirt-capabilities/baseline-capabilities

text: EUR-Lex, “The Directive on security of network and information systems (NIS Directive)”, 2016. [Online]. Available: https://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=uriserv:OJ.L_.2016.194.01.0001.01.ENG&toc=OJ:L:2016:194:TOC

text: FIRST, “FIRST CSIRT Framework V0.2”, 2019. [Online]. Available: https://www.first.org/education/csirt_services_framework_v2.0

text: GitHub, “CERT Tools”, 2019. [Online]. Available: https://github.com/certtools/

text: GitHub, “Digital Forensics and Incident Response (DFIR) Resources”, 2019. [Online]. Available: https://github.com/The-Art-of-Hacking/h4cker/tree/master/dfir

text: GPPi, New America, “National CSIRTs and Their Role in Computer Security Incident Response”, 2015. [Online]. Available: http://www.digitaldebates.org/fileadmin/media/cyber/National_CSIRTs_and_Their_Role_in_Computer_Security_Incide nt_Response__November_2015_--_Morgus__Skierka__Hohmann__Maurer.pdf

text: Industrial Cybersecurity Center, “The center”, 2019. [Online]. Available: https://www.cci-es.org/en/mision

text: ITU/BDT, “Cyber Security Programme: Global Cybersecurity Index (GCI)”, 2018. [Online]. Available: https://www.itu.int/en/ITUD/Cybersecurity/Documents/GCIv3_documents/GCI%20V3%20Refere nce%20model.pdf

text: JDSUPRA, “Germany’s Draft Bill on IT Security 2.0 – Extended BSI Authorities, Stricter Penalties and New Obligations on Providers”, 2019. [Online]. Available: https://www.jdsupra.com/legalnews/germany-s-draft-bill-on-it-security-2-0-55094/

text: MISP Threat Sharing, “Features of MISP, the open source threat sharing platform”, Date? [Online]. Available: https://www.misp-project.org/features.html

text: NCSC, “CiSP”. [Online]. Available: https://www.ncsc.gov.uk/section/keep-up-to-date/cisp

text: NCSC, “CSIRT Maturity Toolkit”, 2018. [Online]. Available: https://english.ncsc.nl/get-to-work/cooperation/i-would-like-to-strengthen-my-collaboration/csirt-maturity-toolkit

text: Nordea, “Nordic banks collaborate on fighting cybercrime”, 2017. [Online]. Available: https://www.nordea.com/en/press-and-news/news-and-press-releases/press-releases/2017/04- 10-08h00-nordic-banks-collaborate-on-fighting-cybercrime.html

text: OECD, “The Netherland’s experience with decentralisation”. [Online]. Available: https://www.oecd.org/regional/regional-policy/Netherlands-experience.pdf

text: Open CSIRT Foundation, “SIM3 and references “. [Online]. Available: https://opencsirt.org

text: SGDSN, “La sécurité des activités d’importance vitale”, 2016. [Online]. Available: http://www.sgdsn.gouv.fr/uploads/2016/10/plaquette-saiv.pdf

text: Z-CERT, Expertise center for Cybersecurity in Healthcare “Home”, 2019. [Online]. Available: https://www.z-cert.nl/en Z-CERT, Expertise center for Cybersecurity in Healthcare “News”, 2019. [Online]. Available: https://www.z-cert.nl/nieuws

text: A ANNEXES:

text: A.1 ANNEX 1 – LIST OF CRITERIA

text:  Summary of national approaches towards IR in the NISD sectors  Incident Response general set-up o NISD sectors: o Competent authorities; o Existing/newly created CSIRT or IR entities; o Role of OES; o Role of DSP.  Cooperation set-up & processes o IR processes and procedures (IR and reporting); o Collaboration procedures within NISD sectors; o Cross-border IR aspects.  Development of capabilities and other initiatives  Operational preparedness and capacities;  Tools;  Initiatives, communities, etc.

text: A.2 ANNEX 2 – LIST OF FIGURES

text:  Figure 1: NIS Sectors (Source ENISA)  Figure 2: Overview of the methodology  Figure 3: Entity in charge of Incident Response by Sector  Figure 4: Main features of the changes following the NIS Directive  Figure 5: Evaluation of the changes on the CISRT/IR layout and operational set-up  Figure 6: Assessment of the challenges faced during the implementation of the NISD  Figure 7: Key drivers to create sectoral IRC  Figure 8: Main groups use to exchange with peer  Figure 9: Assessment of the nature of specific measures to inform relevant actors in neighbouring countries about a cross-border incident  Figure 10: Sector-specific training evaluation  Figure 11: Respondents by countries  Figure 12: Respondents by entity  Figure 13: Interviewees by organisation

text: A.3 ANNEX 3 – LIST OF TABLES

text:  Table 1: Case study - Sectoral IR layout and set-up: France vs The Netherlands  Table 2: Case Study Sectoral IR layout and set-up: Portugal  Table 3: Case-study: Maritime transport OES definition & threshold (United Kingdom)  Table 4: Extended scope of sectors and OES  Table 5: Case Study NordicFin  Table 6: FIRST’CSIRT Services Framework  Table 7: Case study: CERT-BE, Belgium  Table 8: Case study: DSP-CSIRT, The Netherlands  Table 9: Case study: TIBER-EU - threat intelligence-based ethical red-teaming framework  Table 10: Information exchange initiatives at national level within sectors  Table 11: Information exchange initiatives at national level cross-sectors  Table 12: Information exchange initiatives at European level

text:  Table 13: Case study: Good practices for training  Table 14: Desktop research – Data Collection overview

text: -0 -310 4 0 2 -9 -92 978

text: ABOUT ENIS A

text: The European Union Agency for Cybersecurity (ENISA) has been working to make Europe cyber secure since 2004. ENISA works with the EU, its member states, the private sector and Europe’s citizens to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. Since 2019, it has been drawing up cybersecurity certification schemes. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: ISBN 978-92-9204-310-0 DOI: 10.2824/74233