Article 19: Peer reviews
agent:eu:nis2:art-19 · sha256 510bf85d7e766bf3
Turnover framework under the act
- Art. 34(4): at least the higher of EUR 10,000,000 / 2 % of worldwide annual turnover
- Art. 34(5): at least the higher of EUR 7,000,000 / 1.4 % of worldwide annual turnover
- The framework follows from article 34.
Affected roles
Not in the register yet.
Affected industries
Not in the register yet.
Obligations
Not in the register yet.
Article text
1. The Cooperation Group shall, on 17 January 2025, establish, with the assistance of the Commission and ENISA, and, where relevant, the CSIRTs network, the methodology and organisational aspects of peer reviews with a view to learning from shared experiences, strengthening mutual trust, achieving a high common level of cybersecurity, as well as enhancing Member States’ cybersecurity capabilities and policies necessary to implement this Directive. Participation in peer reviews is voluntary. The peer reviews shall be carried out by cybersecurity experts. The cybersecurity experts shall be designated by at least two Member States, different from the Member State being reviewed.
The peer reviews shall cover at least one of the following:
(a)
the level of implementation of the cybersecurity risk-management measures and reporting obligations laid down in Articles 21 and 23;
(b)
the level of capabilities, including the available financial, technical and human resources, and the effectiveness of the exercise of the tasks of the competent authorities;
(c)
the operational capabilities of the CSIRTs;
(d)
the level of implementation of mutual assistance referred to in Article 37;
(e)
the level of implementation of the cybersecurity information-sharing arrangements referred to in Article 29;
(f)
specific issues of cross-border or cross-sector nature.
Machine-readable formThe article in the registerChangesSource: NovaCopilot