CER Directive Compliance | Risk & Resilience Planning

Frequently Asked Questions About the CER Directive

What is the CER Directive, and who does it apply to?

The Critical Entities Resilience Directive (EU 2022/2557) requires EU member states to identify and designate "critical entities" — public or private organisations providing essential services in eleven sectors: energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, and food production, processing and distribution. Once designated, a critical entity must assess and manage risks to its ability to keep delivering that essential service. For entities in banking, financial market infrastructure and digital infrastructure, the risk assessment, resilience and incident reporting obligations do not apply — those areas are covered by DORA and NIS2 instead.

What's the difference between CER and NIS2?

NIS2 focuses on cybersecurity — governance, risk management, and incident response for network and information systems. CER takes an all-hazards approach to the same essential services, covering natural disasters, sabotage, terrorism, and cascading failures from other sectors, not just cyberattacks. The two directives were designed together and frequently apply to the same organisations, since they largely share the same critical sectors — CER is often described as NIS2's "physical twin."

What are the CER Directive's key deadlines?

The CER Directive entered into force on 16 January 2023, and member states had to transpose it into national law by 17 October 2024 — though many did so later, so the exact national rules and dates depend on where you operate. By 17 January 2026, each member state had to adopt a national strategy and complete a national risk assessment. By 17 July 2026, member states had to identify and designate their critical entities, and designated entities are notified within one month. From the date an entity receives that notification, it has 9 months to complete its own risk assessment, and its resilience obligations apply after 10 months.

What does a CER risk assessment need to cover?

Under Article 12, a critical entity's risk assessment must consider all relevant risks that could disrupt its essential service — natural hazards, human-made threats including terrorism and sabotage, public health emergencies, and hybrid threats — as well as the entity's dependencies on other sectors. If an organisation has already completed relevant risk assessments under other frameworks, such as NIS2, it may be able to reuse elements of that work rather than starting over. The assessment must be updated whenever necessary and at least every four years.

What has to be in a CER resilience plan?

Based on the risk assessment, Article 13 requires a critical entity to take proportionate technical, security and organisational measures and describe them in a resilience plan or equivalent document. The measures must cover preventing incidents, physical protection of premises and critical infrastructure, responding to and recovering from disruption, employee security management — including background checks where permitted under Article 14 — and staff awareness through training, information materials and exercises.

What are the incident reporting requirements under CER?

A critical entity must notify its competent authority of any incident that significantly disrupts, or could significantly disrupt, its essential service without undue delay — with an initial notification no later than 24 hours after becoming aware of it, and a detailed follow-up report within one month.

What happens if my organisation doesn't comply with CER?

Unlike NIS2, which sets EU-wide maximum fine levels, CER leaves penalties to each member state's national implementing law — they must be "effective, proportionate and dissuasive." Competent authorities also have supervisory powers, including on-site inspections and audits, to verify that an entity's resilience measures meet the requirements.

How does NorthGRC support CER compliance?

NorthGRC's risk, asset, incident, and documentation modules — the same ones many customers already use for NIS2 and ISO 27001 — can support the core CER work: mapping essential services and dependencies, running all-hazards risk assessments, documenting resilience measures, and handling incidents within the 24-hour and one-month reporting timelines. Because CER and NIS2 frequently apply to the same organisations, reusing what you've already built for NIS2 reduces the amount of genuinely new work CER adds.

Build Operational Resilience Around Your Essential Services

Resilience Depends on More Than Cybersecurity

Manage CER as One Connected Process

Simplifying NIS2 compliance without distracting from core business

ISO 27001 certified in just 4 months

Structured ISMS operations

From statements to ongoing compliance

1/1

CER Made Practical

1. All-Hazards Risk Assessment

Understand the Risk

2. Resilience Measures and Planning

Turn Insight into Action

3. Incident Management and Evidence

Stay Ready to Respond

Key Features for CER Compliance

Compliance Management

Risk Management

Asset Management

Incident Management

Vendor Management

Documents Module

Dashboard & Reporting

Integrations

Need Help Turning CER into a Practical Programme?

Your CER Clock Is Already Running