{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/cer-directive","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/cer-directive/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/cer-directive/"},"term":{"en":"CER Directive","da":"CER-direktivet"},"aka":{"en":["Critical Entities Resilience Directive","Directive (EU) 2022/2557"],"da":["direktivet om kritiske enheders modstandsdygtighed","direktiv (EU) 2022/2557"]},"domain":["security"],"cluster":"compliance","layer":"governance","status":"current","era":2022,"summary":{"en":"The EU law that makes the operators of vital services like power and water able to withstand floods, sabotage and other physical threats.","da":"EU-direktivet, der skal gøre dem, der driver vitale tjenester som strøm og vand, modstandsdygtige over for sabotage, storm og oversvømmelse."},"body":{"formal":{"en":"Directive (EU) 2022/2557, under which each member state names the critical entities in 11 sectors by 17 July 2026; those entities must assess their risks, take physical and organisational measures and report serious disruptions within 24 hours. Member states had to write it into national law by 17 October 2024; the Danish law applies from 1 July 2025.","da":"Direktiv (EU) 2022/2557, hvorefter hvert medlemsland senest 17. juli 2026 udpeger de kritiske enheder i 11 sektorer; enhederne skal vurdere deres risici, træffe fysiske og organisatoriske tiltag og indberette alvorlige forstyrrelser inden for 24 timer. Medlemslandene skulle skrive det ind i national lov senest 17. oktober 2024; den danske lov gælder fra 1. juli 2025."},"plain":{"en":"Protecting a dam is not only about who knows the control-room code - it is also the fence, the spare generator and the plan for the day the river rises.","da":"At beskytte en dæmning handler ikke kun om, hvem der kender koden til kontrolrummet - det handler også om hegnet, nødgeneratoren og planen for den dag, åen stiger."},"inPractice":{"en":"A Danish energy company named as a critical entity maps risks such as storms and sabotage, adds fences, cameras and backup power at its key sites, screens staff in sensitive roles and rehearses restoring supply after a site is hit.","da":"Et dansk energiselskab, der er udpeget som kritisk enhed, kortlægger risici som storm og sabotage, sætter hegn, kameraer og nødstrøm op ved sine transformerstationer, baggrundstjekker medarbejdere i følsomme stillinger og øver, hvordan strømmen kommer tilbage, hvis et anlæg rammes."},"whyItMatters":{"en":"Society grinds to a halt when power, water, transport or hospitals fail, and a cut cable or a flooded pumping station does as much damage as a hacker; cyber rules alone leave that side uncovered.","da":"Samfundet går i stå, når strøm, vand, transport eller hospitaler svigter, og et overskåret kabel eller en oversvømmet pumpestation gør lige så stor skade som en hacker; cyberregler alene dækker ikke den side."}},"deepDive":{"en":"Directive (EU) 2022/2557 was adopted on 14 December 2022 alongside NIS2 (Directive (EU) 2022/2555) and repeals Directive 2008/114/EC, the old European Critical Infrastructure directive that covered only energy and transport assets and was widely seen as ineffective because it protected installations rather than the entities operating them. CER shifts the unit of regulation from the asset to the operator: a \"critical entity\" is an entity in one of the eleven Annex sectors (energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, public administration, space, food production, distribution and processing) that provides an essential service, operates on the member state's territory and for which an incident would have a significant disruptive effect under the Article 7 criteria (number of users, dependency of other sectors, market share, geographic spread, availability of alternatives).\n\nThe obligations cascade in a fixed order. Each member state had to adopt a national resilience strategy (Art. 4) and carry out a national risk assessment (Art. 5), and then identify its critical entities by 17 July 2026 (Art. 6) and notify them within one month. From notification, the entity has nine months to perform its own all-hazards risk assessment (Art. 12), repeated when necessary and at least every four years, and ten months to implement resilience measures under Art. 13(1)(a)-(f): prevention including disaster risk reduction and climate adaptation, physical protection of premises (fencing, barriers, perimeter monitoring), response and crisis management, recovery through business continuity and alternative supply chains, personnel security management, and awareness and training. These measures must be documented in a resilience plan. Art. 14 lets member states provide for background checks on staff in sensitive roles, and Art. 15 requires notification of significant incidents within 24 hours of awareness, followed where relevant by a detailed report within one month.\n\nThe boundary with NIS2 is explicit and often misread. Under Art. 8, entities identified in the banking, financial market infrastructure and digital infrastructure sectors are exempt from Art. 11 and Chapters III, IV and VI, because DORA and NIS2 already cover their resilience; conversely, every CER critical entity is treated as an essential entity under NIS2, so its cyber measures follow NIS2 Art. 21 while its physical and organisational resilience follows CER. Entities that provide the same or similar essential services to or in six or more member states can be designated as of particular European significance (Art. 17) and may receive Commission advisory missions (Art. 18).\n\nIn Denmark the directive is transposed by the CER-loven (lov om kritiske enheders modstandsdygtighed), in force since 1 July 2025, with Styrelsen for Samfundssikkerhed coordinating and sector authorities identifying and supervising entities. A practical failure mode is treating CER as a security-guard exercise: auditors look for a risk assessment that traces from hazard scenarios (flood, sabotage, supply-chain loss, pandemic absenteeism) to specific measures and tested continuity plans, not just fences and cameras.","da":"Direktiv (EU) 2022/2557 blev vedtaget 14. december 2022 sammen med NIS2 (direktiv (EU) 2022/2555) og ophæver direktiv 2008/114/EF, det gamle direktiv om europæisk kritisk infrastruktur, der kun dækkede energi- og transportanlæg og blev anset for virkningsløst, fordi det beskyttede anlæg frem for de enheder, der driver dem. CER flytter reguleringens omdrejningspunkt fra aktivet til operatøren: en \"kritisk enhed\" er en enhed i en af de elleve sektorer i bilaget (energi, transport, bankvirksomhed, finansielle markedsinfrastrukturer, sundhed, drikkevand, spildevand, digital infrastruktur, offentlig forvaltning, rummet samt produktion, forarbejdning og distribution af fødevarer), som leverer en væsentlig tjeneste, driver virksomhed i medlemslandet, og hvor en hændelse ville få en betydelig forstyrrende virkning efter kriterierne i artikel 7 (antal brugere, andre sektorers afhængighed, markedsandel, geografisk udbredelse og alternativer).\n\nForpligtelserne følger en fast rækkefølge. Hvert medlemsland skulle vedtage en national strategi (art. 4) og gennemføre en national risikovurdering (art. 5) og dernæst udpege sine kritiske enheder senest 17. juli 2026 (art. 6) og underrette dem inden for en måned. Fra underretningen har enheden ni måneder til sin egen risikovurdering, der dækker alle farer (art. 12) og gentages efter behov og mindst hvert fjerde år, og ti måneder til at indføre modstandsdygtighedsforanstaltninger efter art. 13, stk. 1, litra a-f: forebyggelse inklusive katastroferisikoreduktion og klimatilpasning, fysisk beskyttelse af lokaliteter (hegn, barrierer, perimeterovervågning), reaktion og krisestyring, genopretning via forretningskontinuitet og alternative forsyningskæder, personalesikkerhed samt oplysning og træning. Foranstaltningerne skal dokumenteres i en plan for modstandsdygtighed. Art. 14 giver medlemslandene mulighed for baggrundstjek af medarbejdere i følsomme funktioner, og art. 15 kræver, at væsentlige hændelser indberettes inden for 24 timer efter kendskab, om nødvendigt fulgt af en detaljeret rapport inden for en måned.\n\nGrænsen til NIS2 er udtrykkelig og misforstås ofte. Efter art. 8 er enheder udpeget i sektorerne bankvirksomhed, finansielle markedsinfrastrukturer og digital infrastruktur undtaget fra art. 11 og kapitel III, IV og VI, fordi DORA og NIS2 allerede dækker deres modstandsdygtighed; omvendt regnes enhver kritisk enhed efter CER som væsentlig enhed efter NIS2, så dens cybertiltag følger NIS2 art. 21, mens den fysiske og organisatoriske modstandsdygtighed følger CER. Enheder, der leverer samme eller lignende væsentlige tjenester til eller i seks eller flere medlemslande, kan anses for at være af særlig europæisk betydning (art. 17) og kan få rådgivningsmissioner fra Kommissionen (art. 18).\n\nI Danmark er direktivet gennemført ved CER-loven (lov om kritiske enheders modstandsdygtighed), der har gældt siden 1. juli 2025; Styrelsen for Samfundssikkerhed koordinerer, mens sektormyndighederne udpeger og fører tilsyn med enhederne. En typisk fejl er at behandle CER som en vagtopgave: tilsynet leder efter en risikovurdering, der kan spores fra scenarier (oversvømmelse, sabotage, bortfald af leverandører, sygefravær under en pandemi) til konkrete foranstaltninger og afprøvede kontinuitetsplaner - ikke kun hegn og kameraer."},"edges":[{"type":"requires","to":"security/critical-assets","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/eu-directive","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/nis2","why":{"en":"Adopted the same day as twins - NIS2 protects network and information systems, CER protects the physical ability of critical entities to keep running. Entities named under CER count as essential under NIS2.","da":"Vedtaget samme dag som tvillinger - NIS2 beskytter net- og informationssystemer, CER beskytter kritiske enheders fysiske evne til at holde driften i gang. Enheder udpeget efter CER regnes som væsentlige efter NIS2."},"confidence":"high","strength":"primary"},{"type":"mandates","to":"security/risk-assessment","why":{"en":"Critical entities must carry out their own assessment of every relevant risk, natural or caused by people, and repeat it at least every four years.","da":"Kritiske enheder skal selv vurdere alle relevante risici, både naturskabte og menneskeskabte, og gentage vurderingen mindst hvert fjerde år."},"confidence":"high","strength":"primary"},{"type":"mandates","to":"security/physical-security","why":{"en":"The measures must include physical protection of sites, such as fences, barriers and detection tools.","da":"Foranstaltningerne skal omfatte fysisk beskyttelse af anlæg, fx hegn, barrierer og detektionsudstyr."},"confidence":"high","strength":"primary"},{"type":"mandates","to":"security/incident-reporting","why":{"en":"Incidents that seriously disrupt a vital service must be reported to the authority, first within 24 hours.","da":"Hændelser, der alvorligt forstyrrer en vital tjeneste, skal indberettes til myndigheden, første gang inden for 24 timer."},"confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"Directive (EU) 2022/2557 on the resilience of critical entities","url":"https://eur-lex.europa.eu/eli/dir/2022/2557/oj","tier":"standard","publisher":"European Union"},{"title":"Tre nye love styrker Danmarks beredskab og sikkerhed i kritisk infrastruktur","url":"https://samsik.dk/artikler/2025/07/tre-nye-love-traeder-i-kraft-nis-2-cer-tele/","tier":"official-doc","publisher":"Styrelsen for Samfundssikkerhed"}],"draft":true}