EU Critical Entities Resilience Directive (EU) 2022/2557
Status: Transposition deadline passed 17 Oct 2024; infringement procedures opened Nov 2024
NIS2's physical-resilience sibling. Member States identify critical entities in 11 sectors (incl. energy, transport, drinking water, wastewater) which must carry out risk assessments and resilience measures. Critical entities under CER are also treated as essential entities under NIS2.
Who it applies to
- Entities identified by Member States as critical entities in energy, transport, banking, FMI, health, drinking water, wastewater, digital infrastructure, public administration, space, food
Why it matters for OT
Combined CER + NIS2 obligations land on the same OT-heavy operators; resilience plans should cover OT.
Controls affected & IEC 62443 mapping
| Requirement | Indicative IEC 62443 reference |
|---|---|
| Critical entity risk assessment and resilience measures | IEC 62443-3-2 (risk assessment) – physical aspects largely outside 62443 |
IEC 62443 mappings are editorial and indicative.
Sources
- EUR-Lex – Directive (EU) 2022/2557 eur-lex.europa.eu
- Commission infringement package 28 Nov 2024 (PDF) ec.europa.eu
Monitored for changes: eur-lex.europa.eu. Data file: data/regulations/eu-cer.yaml. Not legal advice.
Get CER changes in your inbox
What changed in OT/ICS regulation this week, who it applies to, the deadlines, and which IEC 62443 controls it touches — plus a short CISA ICS advisory digest. One email, every week. No spam.
Free. Unsubscribe any time. See privacy.