Recommendation 2017/1584 - Coordinated response to large-scale cybersecurity incidents and crises - Main contents

EN

Official Journal of the European Union

L 239/36

The use of and dependence on information and communication technologies have become fundamental aspects in all sectors of economic activity as our companies and citizens are more interconnected and interdependent across sectors and borders than ever before. A cybersecurity incident affecting organisations in more than one Member State or even the entire Union with potential serious disruptions to the internal market and more broadly to the network and information systems on which the Union economy, democracy and society rely is a scenario that Member States and EU institutions have to be well-prepared for.

A cybersecurity incident may be considered a crisis at Union level when the disruption caused by the incident is too extensive for a concerned Member State to handle on its own or when it affects two or more Member States with such a wide-ranging impact of technical or political significance that it requires timely coordination and response at Union political level.

Cybersecurity incidents can trigger a broader crisis, impacting sectors of activity beyond network and information systems and communication networks; any appropriate response must rely upon both cyber and non-cyber mitigation activities.

Cybersecurity incidents are unpredictable, often occur and evolve within very short periods of time and therefore affected entities and those with responsibilities as regards responding to and mitigating the effects of the incident must coordinate their response quickly. Furthermore, cybersecurity incidents are often not contained with any specific geographical area and may occur simultaneously or spread instantly across many countries.

An effective response to large-scale cybersecurity incidents and crises at the EU level requires swift and effective cooperation amongst all relevant stakeholders and relies on the preparedness and capabilities of individual Member States as well as coordinated joint action supported by Union capabilities. Timely and effective response to incidents relies therefore on the existence of previously established and, to the extent possible, well-rehearsed cooperation procedures and mechanisms having clearly defined the roles and responsibilities of the key actors at national and Union level.

In its conclusions (1) on Critical Information Infrastructure Protection of 27 May 2011, the Council invited the EU Member States to ‘strengthen collaboration among Member States and contribute, on the basis of national crisis management experiences and results and in cooperation with ENISA to the development of European cyber incident cooperation mechanisms to be tested in the framework of the next Cyber Europe exercise in 2012’.

The 2016 Communication ‘Strengthening Europe's Cyber Resilience System and Fostering a Competitive and Innovative Cybersecurity Industry’ (2) encouraged Member States to make the most out of the NIS Directive (3) cooperation mechanisms and to enhance cross-border cooperation related to preparedness for a large-scale cyber incident. It added that a coordinated approach to crisis cooperation across the various elements of the cyber ecosystem to be set out in a ‘blueprint’ would increase preparedness and that such a blueprint should also ensure synergies and coherence with existing crisis management mechanisms.

In the Council Conclusions (4) on the aforementioned Communication, Member States called on the Commission to submit such a blueprint for consideration by the bodies and other relevant stakeholders. However the NIS Directive does not provide for a Union cooperation framework in case of large-scale cybersecurity incidents and crises.

The Commission, consulted with Member States in two separate consultation workshops held in Brussels on 5 April and 4 July 2017 with Member States representatives from Computer Security Incident Response Teams (CSIRTs), the Cooperation Group established by the NIS Directive and the Council Horizontal Working Party on Cyber Issues as well as representatives from the European External Action Service (EEAS), ENISA, Europol/EC3 and the General Secretariat of the Council (GSC).

The present Blueprint for coordinated response to large-scale cybersecurity incidents and crises at the Union level, annexed to this Recommendation, is the outcome of the aforementioned consultations and complements the Communication on ‘Strengthening Europe's Cyber Resilience System and Fostering a Competitive and Innovative Cybersecurity Industry’.

The Blueprint describes and sets out the objectives and modes of cooperation between the Member States and EU institutions, bodies, offices and agencies (hereafter referred to as ‘EU institutions’) in responding to large-scale cybersecurity incidents and crises and how existing Crisis Management mechanisms can make full use of existing cybersecurity entities at EU level.

In responding to a cybersecurity crisis in the sense of recital 2, coordination of the response at political Union level in the Council will use the Integrated Political Crisis Response (IPCR) arrangements (5); the Commission will use the ARGUS (6) high-level cross-sectoral crisis coordination process. If the crisis entails an important external or Common Security and Defence Policy (CSDP) dimension, the European External Action Service (EEAS) Crisis Response Mechanism (CRM) (6) will be activated.

In certain areas, sectoral crisis management mechanisms at EU level provide for cooperation in case of cybersecurity incidents or crisis. For example, in the framework of the European Global Navigation Satellite System (GNSS), Council Decision 2014/496/CFSP (7) already defines the respective roles of the Council, the High Representative, the Commission, the European GNSS Agency and the Member States within the chain of operational responsibilities set up in order to react to a threat to the Union, to the Member States or to the GNSS, including in case of cyber-attacks. Therefore, this recommendation should be without prejudice to such mechanisms.

Member States have the primary responsibility for the response in case of large-scale cybersecurity incidents or crises affecting them. The Commission, the High Representative and other EU institutions or services have however an important role, stemming from Union law or from the fact that cybersecurity incidents and crises may impact all sections of economic activity within the single market, the security and international relations of the Union, as well as the institutions themselves.

At Union level, the key actors involved in response to cybersecurity crises include the newly established NIS Directive structures and mechanisms, namely the Computer Security Incident Response Teams (CSIRTs) network, as well as the relevant agencies and bodies namely the European Union Agency for Network and Information Security (ENISA), the European Cybercrime Centre at Europol (Europol/EC3), the EU Intelligence Analysis Centre (INTCEN), EU Military Staff Intelligence Directorate (EUMS INT) and Situation Room (Sitroom) working together as SIAC (the Single Intelligence Analysis Capacity), the EU Hybrid Fusion Cell (based in INTCEN), the Computer Emergency Response Team for the EU institutions (CERT-EU) and the Emergency Response Coordination Centre in the European Commission.

Cooperation amongst Member States in responding to cybersecurity incidents at technical level is provided by the CSIRTs Network established by the NIS Directive. ENISA provides the secretariat for the Network and actively supports the cooperation among the CSIRTs. The national CSIRTs and the CERT-EU cooperate and exchange information on a voluntary basis including, when necessary, in response to cybersecurity incidents that affect one or more Member States. At the request of a representative of a Member State's CSIRT, they may discuss and, where possible, identify a coordinated response to an incident that has been identified within the jurisdiction of that same Member State. Relevant procedures will be set out in CSIRTs Network's Standard Operating Procedures (SOPs) (8).

The CSIRTs network is also tasked with discussing, exploring and identifying further forms of operational cooperation, including in relation to categories of risks and incidents, early warnings, mutual assistance, principles and modalities for coordination, when Member States respond to cross-border risks and incidents.

The Cooperation Group established by Article 11 of the NIS Directive is tasked with providing strategic guidance for the activities of the CSIRTs network and discussing capabilities and preparedness of the Member States, and, on a voluntary basis, evaluating national strategies on the security of network and information systems and the effectiveness of CSIRTs, and identifying best practice.

A dedicated work stream within the Cooperation Group is preparing incident notification guidelines, pursuant to Article 14(7) of the NIS Directive, concerning the circumstances in which operators of essential services are required to notify incidents pursuant to Article 14(3) and the format and procedure for such notifications (9).

Awareness and understanding of the real-time situation, risk posture, and threats gained through reporting, assessments, research, investigation, and analysis, is vital to enable well-informed decisions This ‘situational awareness’ — by all relevant stakeholders — is essential for an effective coordinated response. Situational awareness includes elements about the causes as well as the impact and origin of the incident. It is recognised that this depends on exchange and sharing of information between relevant parties in a suitable format, using a common taxonomy to describe the incident and in an appropriately secure manner.

Responding to cybersecurity incidents may take many forms, ranging from identifying technical measures which may entail two or more entities jointly investigating the technical causes of the incident (e.g. malware analysis) or identifying ways through which organisations may assess whether they have been affected (e.g. indicators of compromise), to operational decisions on applying such measures and, at the political level, deciding on the use of other instruments such as the Framework for a Joint response to malicious cyber activities (10) or the EU operational protocol for countering hybrid threats (11), depending on the incident.

European citizens' and businesses' trust in digital services is essential for a flourishing digital single market. Therefore, crisis communication plays a particularly important role in mitigating the negative effects of cybersecurity incidents and crises. Communication may also be used in the context of the Framework for a Joint Diplomatic Response as a means to influence the behaviour of (potential) aggressors acting from third countries. Aligning the public communication to mitigate the negative effects of cybersecurity incidents and crises and the public communication to influence an aggressor is essential for a political response to be effective.

Providing the public with information on how they can mitigate at user and organisational level the effects of an incident (for example by applying a patch or taking complementary actions to avoid the threat, etc.) could be an effective measure to mitigate a large-scale cybersecurity incident or crisis.

The Commission, through the Connecting Europe Facility (CEF) cybersecurity Digital Service Infrastructure, is developing a Core Service Platform cooperation mechanism, known as MeliCERTes, between participating Member States CSIRTs to improve their levels of preparedness, cooperation and response to emerging cyber threats and incidents. The Commission, through competitive calls for proposals for grant awards under CEF is co-funding CSIRTs in the Member States with a view to improving their operational capacities at national level.

Cybersecurity exercises at EU level are essential to stimulate and improve cooperation among the Member States and the private sector. To this end, since 2010, ENISA organises regular pan-European cyber incident exercises (‘Cyber Europe’).

The Council Conclusions (12) on the Implementation of the Joint Declaration by the President of the European Council, the President of the European Commission and the Secretary-General of the North Atlantic Treaty Organisation calls for the strengthening cooperation in cyber exercises through reciprocal staff participation in respective exercises, including in particular Cyber Coalition and Cyber Europe.

The constantly evolving threat landscape and recent cybersecurity incidents are an indication of the increasing risk faced by the Union, Member States should act on the present recommendation without further delay and in any case by the end of 2018,

Member States and EU institutions should establish an EU Cybersecurity Crisis Response Framework integrating the objectives and modalities of cooperation presented in the Blueprint following the guiding principles described therein.

The EU Cybersecurity Crisis Response Framework should in particular identify the relevant actors, EU institutions and Member State authorities, at all necessary levels — technical, operational, strategic/political — and develop, where necessary, standard operating procedures that define the way in which these cooperate within the context of EU crisis management mechanisms. Emphasis should be placed on enabling the exchange of information without undue delay and coordinating the response during large-scale cybersecurity incidents and crises.

To this end, Member States' competent authorities should work together towards further specifying information-sharing and cooperation protocols. The Cooperation Group should exchange experiences on these matters with relevant EU institutions.

Member States should ensure that their national crisis management mechanisms adequately address cybersecurity incident response as well as provide necessary procedures for cooperation at EU level within the context of the EU Framework.

As regards existing EU crisis management mechanisms, in line with the Blueprint, Member States should, together with Commission services and the EEAS, establish practical implementation guidelines as regards the integration of their national crisis management and cybersecurity entities and procedures into existing EU crisis management mechanisms, namely the IPCR and EEAS CRM. In particular, Member States should ensure that appropriate structures are in place to enable the efficient flow of information between their national crisis management authorities and their representatives at EU level in the context of EU crisis mechanisms.

Member States should make full use of the opportunities offered by the Cybersecurity Digital Service Infrastructures (DSI) programme of the Connecting Europe Facility (CEF), and cooperate with the Commission to ensure that the Core Service Platform cooperation mechanism, currently under development, provides the necessary functionalities and fulfils their requirements for cooperation also during cybersecurity crises.

Member States, with the assistance of ENISA and building on previous work in this area, should cooperate in developing and adopting a common taxonomy and template for situational reports to describe the technical causes and impacts of cybersecurity incidents to further enhance their technical and operational cooperation during crises. In this regard, Member States should take into account the ongoing work within the Cooperation Group on incident notification guidelines and in particular aspects related to the format of national notifications.

The procedures laid out in the Framework should be tested and when necessary revised following lessons learnt from Member State participation in national, regional, and Union as well as cyber diplomacy and NATO cybersecurity exercises. In particular, they should be tested in the context of the Cyber Europe exercises organised by ENISA. Cyber Europe 2018 presents a first such opportunity.

Member States and the EU institutions should regularly practise their response to large-scale cybersecurity incidents crisis at national and European level, including their political response, where necessary and with the involvement of private sector entities as appropriate.

Enable an effective response. Response may take many forms, ranging from identifying technical measures which may entail two or more entities jointly investigating the technical causes of the incident (e.g. malware analysis) or identifying ways that organisations may assess whether they have been affected (e.g. indicators of compromise), to operational decisions on applying such technical measures and, at the political level, deciding to trigger other instruments such as the EU Diplomatic Response to Malicious Cyber Activities (‘Cyber Diplomacy Toolbox’) or the EU operational protocol for countering hybrid threats depending on the incident.

Share situational awareness. A sufficiently good understanding of events as they unfold by all relevant stakeholders on all three levels (technical, operational, political) is essential for a coordinated response. Situational awareness may include technological elements about the causes as well as the impact and origin of the incident. As cybersecurity incidents may affect a wide variety of sectors (finance, energy, transport, healthcare, etc.), it is imperative that the appropriate information, in the suitable format, reaches all relevant stakeholders in a timely manner.

Agree on key public communication messages (9). Crisis communications play an important role in mitigating the negative effects of cybersecurity incidents and crises but may also be used as a means for influencing the behaviour of (potential) aggressors. An appropriate message can also serve to clearly signal the likely consequences of a diplomatic response to influence the behaviour of aggressors. Aligning the public communication to mitigate the negative effects of cybersecurity incidents and crises and the public communication to influence an aggressor is essential for a political response to be effective. Particularly important in cybersecurity is the dissemination of accurate actionable information on how the public can mitigate the effects of an incident (e.g. applying a patch, taking complementary actions to avoid the threat, etc.).

coordinated response,

shared situational awareness,

public communications.

Incident handling (11) during a cybersecurity crisis

Monitoring and surveillance of incident including continuous analysis of threats and risk.

Member States:

EU bodies/offices/agencies

European Commission

EEAS

As part of the regular cooperation at technical level to support Union situational awareness, ENISA should on a regular basis prepare the EU Cybersecurity Technical Situation Report on incidents and threats, based on publicly available information, its own analysis and reports shared with it by Member States' CSIRTs (on a voluntary basis) or NIS Directive single points of contact, European Cybercrime Centre (EC3) at Europol and CERT-EU and where appropriate the European Union Intelligence Centre (INTCEN) at the European External Action Service (EEAS). The report should be made available to the relevant instances of the Council, the Commission, the HRVP and the CSIRTs Network.

In case of major incident, the CSIRTs Network Chair, with the assistance of ENISA, prepares an EU Cybersecurity Incident Situation Report (13) which is presented to the Presidency, the Commission and the HRVP via the CSIRT of the rotating Presidency.

All other EU agencies report to their respective parent DGs who in turn report to the Commission lead service.

CERT-EU provides technical reports to the CSIRTs Network, EU institutions and agencies (as appropriate) and ARGUS (if activated).

Europol/EC3  (14) and CERT-EU provides expert forensic analysis of technical artefacts and other technical information to the CSIRTs Network.

EEAS SIAC: On behalf of INTCEN, the EU Hybrid Fusion Cell reports to relevant the EEAS departments.

The CSIRTs Network exchanges technical details and analysis on the incident, such as IP addresses, indicators of compromise (15), etc. Such information should be provided without undue delay to ENISA and not later than 24 hours from when the incident is detected.

In accordance with the CSIRTs Network Standard Operating Procedures, its members cooperate in their efforts to analyse the available technical artefacts and other technical information related to the incident with a view of determining the cause and possible technical mitigation measures.

ENISA assists CSIRTs' in their technical activities relying on its expertise and in accordance with its mandate (16).

Member States' CSIRTs coordinate their technical response activities with the assistance of ENISA and the Commission.

EEAS SIAC: On behalf of INTCEN, the EU Hybrid Fusion Cell sets the collection process to gather initial evidence in motion.

CSIRTs produce technical advisories (17) and vulnerability alerts (18) and disseminate them to their respective communities and the public following the authorisation procedures applicable in each case.

ENISA facilitates the production and dissemination of common CSIRTs Network communications.

ENISA coordinates its public communication activities with the CSIRTs Network and the Commission's Spokesperson service.

ENISA and EC3 coordinate their public communication activities based on the shared situational awareness agreed among Member States. They both coordinated their public communication activities with the Commission's Spokesperson service.

If the crisis entails an external or Common Security and Defence Policy (CSDP) dimension, the public communication should be coordinated with the EEAS and the HRVP Spokesperson service.

Preparing decision-making at the political level

Coordinate the management of the cybersecurity crisis (as appropriate)

Assess the consequences and impact at EU level and propose possible mitigating actions.

Member States:

EU bodies/offices/agencies

European Commission

EEAS

Council

Support the production of politico/strategic situation reports (e.g. the ISAA in case of IPCR activation)

The Council Horizontal Working Party on Cyber Issues prepares the Coreper or PSC meeting as appropriate

In case of IPCR activation:

In case of ARGUS activation

In case of the EEAS Crisis Response Mechanism activation:

Cross-border cooperation with single points of contact and national competent authorities (NIS Directive) to mitigate the consequences and effects.

Activate all technical mitigation measures and coordinate technical capacities needed to stop or reduce the impact of the attacks on the targeted information systems.

Cooperation and, if decided, coordination of technical capacities towards a joint or collaborative response in accordance with the CSIRTs Network SOPs .

Assess the need to cooperate with relevant third parties.

(where activated) Decision-making within the ARGUS process.

(where activated) Preparing decisions and coordinating under the IPCR arrangements.

(where activated) support EEAS decision-making through the EEAS Crisis Response Mechanism including as regards contacts with third countries and international organisations as well as any measure aimed at protecting CSDP missions and operations and EU delegations.

Agree upon public messages regarding the incident.

If the crisis entails an external or Common Security and Defence Policy (CSDP) dimension, the public communication should be coordinated with the EEAS and the HRVP Spokesperson service.

For Member States, Ministers responsible for cybersecurity

For the European Council, the President

For the Council, the rotating Presidency

When measures within the ‘Cyber Diplomatic Toolbox’, PSC and Horizontal Working Party

For the European Commission, the President or the delegated Vice-President/Commissioner

The High Representative of the Union for Foreign Affairs Security Policy/Vice-President of the Commission.

Identify the impacts of the disruptions caused by the crisis on the functioning of the Union.

Activate additional crisis management mechanisms/instruments depending on the nature and impact of the incident. These may include, for example, the Civil Protection Mechanism.

Take measures within the Framework for a Joint EU Diplomatic Response to Malicious Cyber Activities.

Make available emergency support to affected Member States for example activating the Cybersecurity Emergency Response Fund (22) once applicable.

Cooperation and Coordination with international organisations where appropriate such as the United Nations (UN), the Organisation for Security and Cooperation in Europe (OSCE) and particularly NATO.

Assess national security and defence implications.

Step 1 — Regular sectoral monitoring and alerting: the existing, regular sectoral situation reports and alerts provide indications to the Council Presidency on a developing crisis and its possible evolution.

Step 2 — Analysis and advice: based on available monitoring and alerting, the Commission services, the EEAS, and the GSC keep each other informed on possible developments, in order to be ready to advise the Presidency for a possible activation (in full or in information-sharing mode) of the IPCR.

Step 3 — Assessment/decision on IPCR activation: the Presidency evaluates the need for political coordination, information exchange or decision-making at EU level. To this end, the Presidency may convene an informal round table meeting. The Presidency carries out an initial identification of the areas requiring Coreper or Council involvement. This will form the basis of the guidance for the production of Integrated Situational Awareness and Analysis (ISAA) reports. The Presidency will decide, in light of the characteristics of the crisis, its possible consequences, and the related political needs, on the appropriateness of convening meetings of the relevant Council Working Parties and/or Coreper and or PSC.

The Commission, EEAS and GSC, in full agreement and associating the Presidency, can also decide to activate the IPCR in information-sharing mode by generating a crisis page, in order to prepare the ground for a possible full activation.

Step 4 — IPCR Activation/Information gathering and exchange: upon activation (whether in information-sharing mode or in full), a crisis page is generated on the IPCR web platform, allowing specific exchanges of information focusing on aspects that will contribute to feed ISAA and to prepare the discussion at political level. The ISAA lead service (one of the Commission services or EEAS) will depend on the circumstances of the case.

Step 5 — ISAA production: the production of ISAA reports will be initiated. The Commission/EEAS will issue ISAA reports as outlined in the ISAA SOPs and may further foster information-exchange on the IPCR web platform, or issue specific requests for information. The ISAA reports will be tailored to the needs of the political level (i.e. Coreper or the Council) as defined by the Presidency and laid out in its guidance, thus allowing a strategic overview of the situation and an informed debate on the agenda items defined by the Presidency. In accordance with the ISAA SOPs, the nature of the cybersecurity crisis will determine whether the ISAA report is prepared by one of the Commission Services (DG CNECT, DG HOME) or the EEAS.

Following the activation of the IPCR, the Presidency will outline the specific areas of focus for ISAA in order for it to support the political coordination and/or decision-making process in the Council. The Presidency will also specify the timing of the report, following consultations with the Commission services/EEAS.

Step 6 — Preparation of the informal Presidency round table: the Presidency, assisted by the General Secretariat of the Council, will define the timing, agenda, participants, and expected outcome (possible deliverables) of the informal Presidency round table meeting. The GSC will relay relevant information on the IPCR web platform on behalf of the Presidency, and will issue in particular the meeting's notice.

Step 7 — Presidency round table/preparatory measures for EU political coordination/decision-making: the Presidency will gather an informal round table to review the situation, and to prepare and review the items to be brought to the Coreper or Council's attention. The informal Presidency round table will also be the forum to develop, review and discuss all proposals for action to be submitted to Coreper/Council.

Step 8 — Political coordination and decision-making at Coreper/Council: The results of the Coreper/Council meetings concern the coordination of response activities at all levels, decisions on exceptional measures, political declarations, etc. These decisions also constitute an updated political/strategic guidance for the further production of ISAA reports.

Step 9 — Impact monitoring: the ISAA lead service will provide, with the support of ISAA contributors, information on the evolution of the crisis and on the impact of the political decisions taken. This feedback loop will support an evolving process and support the Presidency's decision in continuing the involvement of the EU political level or in phasing down the IPCR.

Step 10 — Phasing out: following the same process as for the activation, the Presidency may convene an informal round table meeting to assess the opportunity to maintain the IPCR active or not. The Presidency can decide to close or downgrade the activation.

The rotating Presidency (typically Coreper Chair) is in the lead

For the European Council, the Cabinet of the President

For the European Commission, DSG/DG level and/or subject experts

For the EEAS, DSG/MD level and/or subject experts

For the GSC, the Cabinet of the SG, the IPCR team and the responsible DGs.

(not active): IPCR monitoring pages can be generated to track developing situations that might escalate into a crisis with EU ramifications

(IPCR information-sharing): ISAA reports will be drafted by the ISAA lead on the basis of input from the Commission services, EEAS, and Member States (through the IPCR questionnaires)

(IPCR full activation): in addition to ISAA reports, informal IPCR round tables bring together different actors concerned in the MS, the Commission, EEAS, relevant agencies, etc. to discuss shortcomings and bottlenecks.

Phase I: is used for ‘information-sharing’ on a crisis of limited scale

Examples of recent Phase I reported events include the forest fires in Portugal and Israel, the 2016 Berlin attack, floods in Albania, Hurricane Matthew in Haiti and the drought in Bolivia. Any DG can open a Phase I event when it judges that a situation in its domain of competence is serious enough to warrant or benefit from information-sharing. For instance, DG CNECT or DG HOME can open a Phase I event when they judge that a cyber situation in their respective domain of competence is serious enough to warrant or benefit from information-sharing.

Phase II: is triggered in case of major multisectoral crisis or foreseeable or imminent threat for the Union.

Phase II triggers a specific coordination process enabling the Commission to take decisions and manage a rapid, coordinated and coherent response, at the highest level in its domain of competence and in cooperation with the other institutions. Phase II is meant for a major multisectoral crisis or foreseeable or imminent threat thereof. Examples of real-life Phase II events include the migration/refugee crisis (2015-ongoing), Fukushima triple disaster (2011) and the eruption of Eyjafjallajökull volcano in Iceland (2010).

Phase II is activated by the President on his own initiative or at the request of a Member of the Commission. The President may allocate the political responsibility for the Commission response to a Commissioner responsible for the service most concerned by the crisis at hand or decide to keep the responsibility to himself.

It foresees emergency meetings of the Crisis Coordination Committee (CCC). These are called under the authority of the President or a Commissioner to whom responsibility was assigned. The meetings are convened by SG through the ARGUS IT tool. The CCC is a specific operational crisis management structure established to lead and coordinate the Commission's response to the crisis, bringing together representatives of relevant Commission DGs, Cabinets, and other EU services. Chaired by the Deputy Secretary-General, the CCC assesses the situation, considers options and takes decisions, as well as ensures that decisions and actions are implemented while ensuring the coherence and consistency of the response. Support to the CCC is provided by the SG.

The European Cyber Crises Cooperation Framework, Version 1, 17 October 2012.

Report on Cyber Crisis Cooperation and Management, ENISA, 2014

Actionable Information for Security Incident Response, ENISA, 2014

Common practices of EU-level crisis management and applicability to cyber crises, ENISA, 2015

Strategies for Incident Response and Cyber Crisis Cooperation, ENISA, 2016

EU Cyber Standard Operating Procedures, ENISA, 2016

A good practice guide of using taxonomies in incident prevention and detection, ENISA, 2017

Communication on Strengthening Europe's Cyber Resilience System and Fostering a Competitive and Innovative Cybersecurity Industry, COM(2016) 410 final, 5 July 2016

Council Conclusions on Strengthening Europe's Cyber Resilience System and Fostering a Competitive and Innovative Cybersecurity Industry — Council conclusions (15 November 2016), 14540/16

Council Decision 2014/415/EU of 24 June 2014 on the arrangements for the implementation by the Union of the solidarity clause (OJ L 192, 1.7.2014, p. 53)

Finalisation of the CCA review process: the EU Integrated Political Crisis Response (IPCR) arrangements, 10708/13, 7 June 2013

Integrated Situational Awareness and Analysis (ISAA) — Standard Operating Procedures, DS 1570/15, 22 October 2015

Commission provisions on ‘ARGUS’ general rapid alert system, COM(2005) 662 final, 23 December 2005

Commission Decision 2006/25/EC, Euratom of 23 December 2005 amending its internal Rules of Procedure (OJ L 19, 24.1.2006, p. 20)

ARGUS Modus Operandi, European Commission, 23 October 2013

Council Conclusions on a Framework for a Joint EU Diplomatic Response to Malicious Cyber Activities (‘Cyber Diplomacy Toolbox’), Doc. 9916/17

EU operational protocol for countering hybrid threats ‘EU Playbook’, Doc. SWD(2016) 227

EEAS Crisis Response Mechanism, 8 November 2016 (Ares(2017)880661) Joint Staff Working Document EU operational protocol for countering hybrid threats, ‘EU Playbook’, SWD(2016) 227 final, 5 July 2016

Joint Communication to the European Parliament and the Council: Joint Framework on countering hybrid threats —a European Union response JOIN/2016/018 final, 6 April 2016

EEAS(2016) 1674 — Working Document of the European External Action Service — EU Hybrid Fusion Cell — Terms of Reference