the whole job

CER Directive: the whole job, in order

The CER Directive asks the operators a member state names as critical to keep their essential services running through any hazard: physical, natural, human or cyber. Here is the job as a plan for an entity that has received its notice: five phases, in the order that holds up, with who carries each step, what it produces and the proof it leaves.

last checked 2 November 2026

how to read this plan

Each step has an owner, a kind of work and two outputs. The kinds of work are different jobs: choices that someone with authority signs, things the organisation builds, and checks that someone keeps running. The clock starts with the notice from your state: the risk assessment is due within nine months of it, and the resilience duties apply ten months after it. Most of the plan is the directive's own text; where it is not, the note under the step says practice. If you are not a critical entity, the last phase shows what your critical customers will ask of you.

  • decide and documentchoices, policies and records that someone with authority signs
  • build and configuresystems, settings and procedures that make the choice real
  • prove and operatechecks, logs and records that show it keeps working
01

confirm your status and your dates

Know whether you are a critical entity, which duties apply and from when, and who speaks for you.

  1. check the notice and the annex

    Find out whether your state has notified you that it identified you as a critical entity. If it has, file the notice: it states your duties and the date they apply from. If it has not, check whether your activity falls in a category of the annex, because states review their lists.

    • owner legal or DPO
    • decide and document
    what it produces
    a status note with the notice attached, or the reasons you are out
    the proof it leaves
    the notice and the note, dated

    basis CER Art. 2(1); CER Art. 6(3)

  2. write down your dates and your national rules

    From the date of the notice, mark the risk assessment due within nine months and the resilience duties that apply after ten. Find your national act, your competent authority and the penalty rules your state set.

    • owner board
    • decide and document
    what it produces
    a date sheet with the national act and the authority named
    the proof it leaves
    the sheet and its sources, approved by management

    the work page

    basis CER Art. 6(3); CER Art. 12(1); CER Art. 22

  3. check which rules take precedence for you

    If you are in banking, financial market infrastructure or digital infrastructure, the resilience duties do not apply, unless national measures add them. If a sector-specific law already requires equivalent resilience measures, record what your state recognised. Note that NIS2 applies to you as a critical entity, whatever your size.

    • owner legal or DPO
    • decide and document
    what it produces
    an overlap note listing which law governs which duty
    the proof it leaves
    the note, reviewed when a law or the notice changes

    basis CER Art. 1(3); CER Art. 8; NIS2 Art. 2(3)

  4. name a liaison officer

    Designate a liaison officer or equivalent as your point of contact with the competent authorities, and a deputy. Tell the authority who it is.

    • owner board
    • decide and document
    what it produces
    a board decision naming the liaison officer and a deputy
    the proof it leaves
    the decision and the message to the authority

    basis CER Art. 13(3)

  5. check whether you serve six or more member states

    If you provide essential services to or in six or more member states, tell your competent authority which services and which states. The Commission may then treat you as a critical entity of particular European significance.

    • owner legal or DPO
    • decide and document
    what it produces
    a list of services and the states they reach
    the proof it leaves
    the list and the message to the authority, or a note that the test is not met

    basis CER Art. 17(2)

you are done with this phase when you can show the notice, a date sheet, the overlap with NIS2 and a named liaison officer.
02

assess the risks to your essential services

Have a critical entity risk assessment that covers all hazards and your dependencies, done on time and kept current.

  1. collect the state's risk assessment and your existing ones

    Ask your authority or its single point of contact for the relevant parts of the member state risk assessment. Gather the risk assessments you already made under other laws, NIS2 included, because you may reuse them.

    • owner legal or DPO
    • build and configure
    what it produces
    a source pack for the assessment
    the proof it leaves
    the pack with the date each piece was received

    basis CER Art. 5(3); CER Art. 12(2)

  2. assess all relevant hazards

    Assess every relevant risk that could disrupt your essential services: natural and man-made, accidents, natural disasters, public health emergencies, hybrid and other antagonistic threats including terrorism, and cross-border risks. Bring operations, facilities, IT and HR to the same table.

    • owner everyone
    • build and configure
    what it produces
    a critical entity risk assessment with owners per risk
    the proof it leaves
    the assessment, dated and approved by management

    the work pagethe control: risk-register

    basis CER Art. 12(1), 12(2)

  3. map your dependencies both ways

    List the essential services you depend on, such as power, water, telecoms and transport, and the sectors that depend on you, including across borders. Mark single points of failure.

    • owner procurement
    • build and configure
    what it produces
    a dependency map attached to the assessment
    the proof it leaves
    the map with its date and sources

    the work pagethe control: supplier-management

    basis CER Art. 12(2)

  4. ask the authority to accept what already complies

    Where an existing assessment or existing measures already address what the directive asks, show the authority how. It may declare them compliant, in whole or in part, which saves duplicate work.

    • owner legal or DPO
    • decide and document
    what it produces
    a mapping from existing documents to the CER duties
    the proof it leaves
    the mapping and any reply from the authority

    basis CER Art. 12(2); CER Art. 13(2)

you are done with this phase when you can show a dated risk assessment, a dependency map and a review date within four years.
03

put the resilience measures in place

Take appropriate and proportionate measures for each area the directive lists, and describe them in a resilience plan.

  1. prevent incidents and protect the site

    Take measures that prevent incidents, with disaster risk reduction and climate adaptation in mind. Protect premises and critical infrastructure physically, for example with fencing, barriers, perimeter monitoring, detection equipment and access controls.

    • owner adviser or integrator
    • build and configure
    what it produces
    a site protection plan per location
    the proof it leaves
    the plan, inspection records and access logs

    basis CER Art. 13(1)(a), 13(1)(b)

  2. set up crisis management and alerting

    Write the risk and crisis management procedures, protocols and alert routines that let you respond to, resist and limit an incident. Name who leads, who decides and who is called at night.

    • owner board
    • build and configure
    what it produces
    a crisis procedure and an alert routine
    the proof it leaves
    the procedure, the call list and a test of the alert

    the control: incident-management

    basis CER Art. 13(1)(c)

  3. plan recovery and alternative supply

    Build business continuity measures that let you resume the essential service, and identify alternative supply chains for what you cannot do without.

    • owner head of IT
    • build and configure
    what it produces
    a continuity plan with recovery steps and alternative suppliers
    the proof it leaves
    the plan and the results of a recovery test

    the work pagethe control: backup-recovery

    basis CER Art. 13(1)(d)

  4. manage the people in critical functions

    Set the categories of staff who exercise critical functions, counting the staff of external service providers. Set access rights to premises, critical infrastructure and sensitive information. Decide which roles need background checks under your national rules, and the training and qualifications each role needs.

    • owner HR
    • build and configure
    what it produces
    a role register for critical functions with access rights and check requirements
    the proof it leaves
    the register and the access review records

    the work pagethe control: access-reviews

    basis CER Art. 13(1)(e); CER Art. 14(1)

  5. train and exercise

    Make the relevant staff aware of the measures through training courses, information materials and exercises.

    • owner HR
    • build and configure
    what it produces
    a training and exercise plan
    the proof it leaves
    attendance records and exercise reports

    the work pagethe control: awareness-training

    basis CER Art. 13(1)(f)

  6. write the resilience plan

    Describe the measures in a resilience plan or equivalent documents, and apply it. Documents you already keep under other laws can form part of it.

    • owner board
    • decide and document
    what it produces
    a resilience plan approved by management
    the proof it leaves
    the signed plan with a version history

    basis CER Art. 13(2)

you are done with this phase when you can show a resilience plan that covers prevention, protection, response, recovery, people and awareness, with an owner for each.
04

be able to report an incident

Send the initial notification within 24 hours and the detailed report on time, and keep the CER and NIS2 reports apart.

  1. agree what counts as a significant disruption

    Write down, for your own services, when a disruption is significant: the number and share of users affected, how long it lasts and the area it hits. Decide who may judge this at any hour, because the clock starts when you become aware.

    • owner legal or DPO
    • decide and document
    what it produces
    a one-page reporting rule with named decision makers
    the proof it leaves
    the rule, approved by management

    basis CER Art. 15(1)

  2. prepare the initial notification and the detailed report

    Prepare a template for the initial notification, due no later than 24 hours after becoming aware unless you are operationally unable, and one for the detailed report that follows where relevant within one month. Include nature, cause, possible consequences and any cross-border impact.

    • owner legal or DPO
    • build and configure
    what it produces
    two templates and the authority's reporting channel
    the proof it leaves
    the templates and a test submission or written confirmation of the channel

    the work pagethe control: incident-management

    basis CER Art. 15(1), 15(2)

  3. line up the CER and NIS2 reports

    A cyber incident that disrupts an essential service can trigger both reports, on different clocks and possibly to different authorities. Build one intake that decides for each event which reports go where, and ask your authorities whether they share a channel.

    • owner head of IT
    • build and configure
    what it produces
    a combined reporting map for CER and NIS2
    the proof it leaves
    the map and the authorities' answers

    basis CER Art. 15(1); NIS2 Art. 23(4)

  4. rehearse a report

    Run an exercise with an invented outage, for example a power or supply failure at one site. See whether the right people can decide and send the initial notification inside 24 hours. Write down what broke and who fixes it.

    • owner everyone
    • prove and operate
    what it produces
    a rehearsal report with actions and owners
    the proof it leaves
    the report and the action list, closed or dated

    basis working practice. No legal text sets this.

you are done with this phase when you can show a reporting rule, templates, the authority's channel and a rehearsal record.
05

be ready for supervision, and pass the duties down

Keep evidence an inspector can check, review on a cycle, and agree with your suppliers what the directive makes you need from them.

  1. keep an evidence file for inspections and audits

    The authority can inspect on site, supervise remotely and run or order audits, and can ask for evidence that your measures work, including an audit by a qualified outside auditor that you select and pay for. Keep the assessment, the plan, test results and training records where you can hand them over.

    • owner legal or DPO
    • prove and operate
    what it produces
    an evidence file indexed to the duties
    the proof it leaves
    the file with a last-reviewed date

    basis CER Art. 21(1), 21(2)

  2. review the assessment and the plan on a cycle

    Repeat the risk assessment whenever necessary and at least every four years, and update the resilience plan when the assessment, your sites or your services change.

    • owner board
    • prove and operate
    what it produces
    a review calendar with triggers
    the proof it leaves
    board minutes of each review

    basis CER Art. 12(1); CER Art. 13(2)

  3. agree terms with suppliers whose staff have access

    Supplier staff can hold critical functions and can be subject to background checks where they have direct or remote access to premises, information or control systems. Put access, vetting, continuity and incident notice into the contracts of those suppliers.

    • owner procurement
    • build and configure
    what it produces
    standard contract terms for suppliers with access
    the proof it leaves
    the terms and the list of contracts that carry them

    the work pagethe control: supplier-management

    basis CER Art. 13(1)(e); CER Art. 14(1)

  4. if you supply a critical entity, prepare your answers

    If you are not on the list yourself but supply a critical entity, expect questions on who of your staff can reach its sites and systems, whether they can be vetted, and how you keep supplying in a crisis. Prepare one pack with those answers.

    • owner legal or DPO
    • build and configure
    what it produces
    a customer answer pack, versioned
    the proof it leaves
    the pack and a log of the questions customers asked

    basis CER Art. 13(1)(d), 13(1)(e)

you are done with this phase when you can show an evidence file, a review calendar and supplier terms on staff, access and continuity.

who carries what

The same steps, grouped by the person who has to act.

legal or DPO

board

everyone

procurement

adviser or integrator

head of IT

HR

controls you will need

Each control has its own page: what it is, what to look for, where it goes wrong and the proof it leaves.

    check it yourself

    your next step

    Find the notice from your state, or confirm that there is none, and write down the two dates that follow from it.

    see the dates