Cyberresiliensakten, Article 17, EU

1. ENISA may submit to the European cyber crisis liaison organisation network (EU-CyCLONe) established under Article 16 of Directive (EU) 2022/2555 information notified pursuant to Article 14(1) and (3) and Article 15(1) and (2) of this Regulation if such information is relevant for the coordinated management of large-scale cybersecurity incidents and crises at an operational level. For the purpose of determining such relevance, ENISA may consider technical analyses performed by the CSIRTs network, where available.

2. Where public awareness is necessary to prevent or mitigate a severe incident having an impact on the security of the product with digital elements or to handle an ongoing incident, or where disclosure of the incident is otherwise in the public interest, the CSIRT designated as coordinator of the relevant Member State may, after consulting the manufacturer concerned and, where appropriate, in cooperation with ENISA, inform the public about the incident or require the manufacturer to do so.

3. ENISA, on the basis of the notifications received pursuant to Article 14(1) and (3) and Article 15(1) and (2) of this Regulation, shall prepare, every 24 months, a technical report on emerging trends regarding cybersecurity risks in products with digital elements and submit it to the Cooperation Group established pursuant to Article 14 of Directive (EU) 2022/2555. The first such report shall be submitted within 24 months of the date of application of the obligations laid down in Article 14(1) and (3) of this Regulation. ENISA shall include relevant information from its technical reports in its report on the state of cybersecurity in the Union pursuant to Article 18 of Directive (EU) 2022/2555.

4. The mere act of notification in accordance with Article 14(1) and (3) or Article 15(1) and (2) shall not subject the notifying natural or legal person to increased liability.

5. After a security update or another form of corrective or mitigating measure is available, ENISA shall, in agreement with the manufacturer of the product with digital elements concerned, add the publicly known vulnerability notified pursuant to Article 14(1) or Article 15(1) of this Regulation to the European vulnerability database established pursuant to Article 12(2) of Directive (EU) 2022/2555.

6. The CSIRTs designated as coordinators shall provide helpdesk support in relation to the reporting obligations pursuant to Article 14 to manufacturers and in particular manufacturers that qualify as microenterprises or as small or medium-sized enterprises.

Official source

Version: a623fe42c8323f2d

SHA-256: sha256:a623fe42c8323f2d0725d106ae180eab6de0c75c3b89c62b873757056ea68bf0

• Article 1
• Article 2
• Article 3
• Article 4
• Article 5
• Article 6
• Article 7
• Article 8
• Article 9
• Article 10
• Article 11
• Article 12
• Article 13
• Article 14
• Article 15
• Article 16
• Article 18
• Article 19
• Article 20
• Article 21
• Article 22
• Article 23
• Article 24
• Article 25
• Article 26
• Article 27
• Article 28
• Article 29
• Article 30
• Article 31
• Article 32
• Article 33
• Article 34
• Article 35
• Article 36
• Article 37
• Article 38
• Article 39
• Article 40
• Article 41
• Article 42
• Article 43
• Article 44
• Article 45
• Article 46
• Article 47
• Article 48
• Article 49
• Article 50
• Article 51
• Article 52
• Article 53
• Article 54
• Article 55
• Article 56
• Article 57
• Article 58
• Article 59
• Article 60
• Article 61
• Article 62
• Article 63
• Article 64
• Article 65
• Article 66
• Article 67
• Article 68
• Article 69
• Article 70
• Article 71

Geographical article agents

Source: NovaCopilot