NIS Directive and national CSIRTs
NIS Directive and national CSIRTs TLP WHITE | Info Note | Final | February 2016
NIS Directive and national CSIRTs
1 Introduction
In December 2015, the Commission, the Parliament of the EU, and the Council of Ministers reached an agreement on the Network and Information Security (NIS) Directive (hereafter “the Directive”). This draft Directive still needs to be polished, but a preliminary version is already available. Articles and paragraphs referred to in this document refer to the draft version of the Directive mentioned here. The final text is expected in spring. This document will be adjusted should the NIS Directive change. This note explains the structure of the Directive, and highlights the parts that are relevant to National CSIRTs. For easier reading we refer to national CSIRTs in the context of this document simply as “CSIRT” or “dedicated CSIRT”.
2 Structure of the Directive
The Directive is structured around the following sections. More specific provisions directly targeted to CSIRTs (mainly from Chapter 3 and Annex 1) will follow in Section 3: Recitals give the context in which the Directive works. They state the importance and specificities of Network and Information Security, and describe the actors that will need to play a role. Chapter 1. General provisions. This Chapter describes the goals of the Directive, and its legislative environment. It also gives formal definitions to terms that appear in the text. Chapter 2. National frameworks on NIS. This Chapter lists the different entities and legislative frameworks that each Member State will have to set up in order to comply with the Directive. Each MS needs to adopt a national NIS strategy; designate one or more national competent authorities, as well as a single point of contact for cross-border cooperation; and set up at least one Computer Security Incident Response Team (CSIRT). These teams need to cover certain sectors and services. Chapter 3. Cooperation between competent authorities. This Chapter defines two groups meant to improve NIS-related cooperation between MS. The first is the Cooperation Network, composed of representatives of MS, the Commission, and ENISA. This group is meant to focus on strategic issues. The second group is the CSIRT Network, composed of representatives of MS’ CSIRT and CERT-EU, with the Commission as observer and ENISA as Secretary and active support. Chapter 4. Security of the NIS of operators of essential services. This Chapter defines security requirements for and duties of operators of essential services. These services are described in Annex 2 of the Directive. Chapter 4a. Security of the NIS of digital service providers. This Chapter defines security requirements for and duties of digital service providers. These providers are described in Annex 3 of the Directive. Chapter 4b. Standardisation. This Chapter encourages the use of EU standards. Chapter 5. Final provisions. This Chapter covers all other aspects, like the details the timeline for transposition of the Directive, or penalties. Annex 1. Requirements and tasks of the CSIRT. This Annex gives a list of tasks that a MS’ CSIRT has to perform.
© European Union Agency for Network and Information Security (ENISA), 2016 01 NIS Directive and national CSIRTs
TLP WHITE | Info Note | Final | February 2016
Annex 2. Sectors and entities. This Annex lists the sectors and subsectors that need to be covered by each country’s Information Security Strategy and CSIRTs. Annex 3. Types of digital services. This Annex lists the digital services targeted by the Directive.
3 CSIRTs
Article 7 of the Directive gives the framework for CSIRTs. The following table presents each paragraph, and if necessary comments on what it means for the relevant CSIRTs.
PARAGRAPH STATEMENT MEANING
Each Member State shall designate one or more Each MS will designate one or more CSIRT. Together, Computer Security Incident Response Teams (hereinafter: these CSIRTs need to cover the sectors and services listed "CSIRTs ") covering at least the sectors referred to in in Annex II and III. Annex II and types of digital services referred to in Annex 1 III, responsible for handling incidents and risks according The designated CSIRT(s) need to fulfil the requirements to a well-defined process, which shall comply with the and tasks listed in Annex I. This is one of the places where requirements set out in point (1) of Annex I. A CSIRT may the Directive points to “adequate resources and be established within a competent authority. equipment” for the CSIRT.
The Directive does not impose a structure or hierarchy for Where they are separate, the competent authority, the single point of contact and the CSIRTs of the same the competent authority, the single point of contact and the CSIRTs. They may be together in one organisation, or Member State shall cooperate with regard to the obligations laid down in this Directive. Where a Member be separate. What matters is that, together, they have to State decides that CSIRTs shall not receive notifications, fulfil the obligations defined by the Directive. Each 1a Member State will have to come up with the structure the CSIRTs shall, to the extent necessary to fulfil their tasks, be granted access to data on incidents notified by that suits them. operators of essential services pursuant to Article 14(2) The designated CSIRTs are entitled to data on incidents and (2ac) or by digital service providers pursuant to Article notified by operators of essential services and providers of 15a(2). digital services.
The designated CSIRTs are entitled to sufficient resources, Member States shall ensure that the designated CSIRTs which need to be provided by the respective government 2 have adequate resources to effectively carry out their of the Member State. This is the second time the Directive tasks set out in point (2) of Annex I. points to “adequate resources and equipment” for the CSIRT
Member States shall ensure that the designated CSIRTs have access to an appropriate, secure, and resilient The third time the Directive points to “adequate resources 3 communication and information infrastructure at national and equipment” for the CSIRT level.
CSIRTs need to document their constituencies and services. They also will need to provide a high level overview of their incident handling process to the Member States shall inform the Commission about the Commission. 4 remit as well as the main elements of the incident handling process of the CSIRTs. The practical details as to how this will happen are not defined yet, however a good start is that the team publishes an RFC2350-compliant document (https://tools.ietf.org/html/rfc2350).
Member States may request the assistance of ENISA in 5c CSIRTs can get ENISA’s help either to set up their developing national CSIRTs. operations, integrate in the community, or ask for
© European Union Agency for Network and Information Security (ENISA), 2016 02 NIS Directive and national CSIRTs
TLP WHITE | Info Note | Final | February 2016
PARAGRAPH STATEMENT MEANING
training. Please contact cert-relations@enisa.europa.eu for more details.
4 The CSIRT Network
Article 8b of the Directive covers the CSIRT Network.
PARAGRAPH STATEMENT MEANING
In order to contribute to developing confidence and trust There will be a dedicated network for all national CSIRTs between the Member States and to promote swift and
1 established, run by the MS (with the help of ENISA) and effective operational cooperation, a network of the secretariat provided by ENISA. national CSIRTs is hereby established.
The CSIRTs network shall be composed of representatives of the Member States’ CSIRTs and CERT-EU. The Commission shall participate in the CSIRTs network as an ENISA is there to support the group and its members. The 2 observer. The European Network and Information Security Agency will provide resources and input to discussions. Agency (ENISA) shall provide the secretariat and actively support the cooperation among the CSIRTs.
Exactly how the group will perform these tasks is up to the group itself, as stated by paragraph 5. It means that the 3 The CSIRTs network shall have the following tasks: group will determine its own priorities, with input from the Collaboration Group. ENISA will support the group by making appropriate proposals.
Exchange information on CSIRTs services, operations and 3a (see comment for paragraph 3) cooperation capabilities
At the request of the representative of a Member State potentially affected by an incident, exchange and discuss non-commercially sensitive information related to that 3b (see comment for paragraph 3) incident and associated risks. Any Member State may refuse to contribute to that discussion if there is a risk of prejudice to the investigation of the incident.
Exchange and make available on a voluntary basis non- 3c (see comment for paragraph 3) confidential information on individual incidents.
At the request of the representative of a Member State's CSIRT, discuss and, where possible, identify a coordinated 3d (see comment for paragraph 3) response to an incident that has been identified within the jurisdiction of that same Member State.
Support Member States in addressing cross-border 3e incidents on the basis of their voluntary mutual (see comment for paragraph 3) assistance.
Discuss, explore and identify further forms of operational cooperation, including in relation to: 3f (see comment for paragraph 3) (i) categories of risks and incidents
(ii) early warnings
© European Union Agency for Network and Information Security (ENISA), 2016 03 NIS Directive and national CSIRTs
TLP WHITE | Info Note | Final | February 2016
PARAGRAPH STATEMENT MEANING
(iii) mutual assistance (iv) principles and modalities for coordination, when Member States respond to cross border NIS risks and incidents.
Inform the Cooperation Group on its activities and on the further forms of operational cooperation discussed 3g (see comment for paragraph 3) pursuant to paragraph 3(f), and request guidance related thereto.
Discuss lessons learnt from NIS exercises, including from 3h (see comment for paragraph 3) those organised by ENISA.
At the request of an individual CSIRT, discuss the 3i (see comment for paragraph 3) capabilities and preparedness of that same CSIRT.
Issue guidelines in order to facilitate the convergence of (operational) practices with regard to the application of 3j (see comment for paragraph 3) the provisions of this Article concerning operational cooperation.
As input to the Commission's periodic review of the functioning of this Directive, the CSIRTs network shall The form and content of the report are not defined yet. This will need to be negotiated between the CSIRT every one and a half years produce a report assessing the 4 experience gained with the operational cooperation, network and the cooperation group. including conclusions and recommendations, pursued ENISA will help producing the report, and the group will under this article. That report shall also be submitted to have to approve it. the cooperation group.
The group will need to determine its governance structure The CSIRTs network shall define its own rules of and terms of reference. ENISA, as secretary and support, 5 procedure. can provide input to the group and come up with proposals
5 Tasks for CSIRTs (Annex 1)
Annex 1 of the Directive gives basic requirements for designated CSIRTs, as well as a list tasks.
PARAGRAPH STATEMENT MEANING
This is a tool for designated CSIRTs to demand that their The requirements and tasks of the CSIRT shall be mandate be officially published. adequately and clearly defined and supported by national Preamble policy and/or regulation. They shall include the following ENISA and others have long argued that an officially elements recognised mandate is one of the very first steps for a successful national CSIRT.
Article 1 is about operational requirements, and gives 1 Requirements for the CSIRT arguments to request necessary budget, manpower, or infrastructure.
The CSIRTs shall ensure high availability of its There are two parts to this requirement: 1a communications services by avoiding single points of failure and have several means for being contacted and 1. High availability of communication services. for contacting others at all times. Furthermore, the Without further details, it’s hard to provide
© European Union Agency for Network and Information Security (ENISA), 2016 04 NIS Directive and national CSIRTs
TLP WHITE | Info Note | Final | February 2016
PARAGRAPH STATEMENT MEANING
communication channels shall be clearly specified and much guidance. In fine, it will be up to the CSIRT well known to the constituency and cooperative partners Network to define what constitutes high availability. ENISA will support the group by making appropriate proposals.
2. Clear specification of communication channels. RFC 2350 is the industry standard for publishing contact information. ENISA recommends that all participating CSIRTs publish such a document.
The group will have to define what “secure site” means: depending on the context, the range of measures that can The offices of the CSIRT and the supporting information be taken is huge. 1c systems shall be located in secure sites. ENISA will support the group by making appropriate proposals.
1. This requirement can be translated as the need for adequate tools to track incidents. There is a Business continuity: variety of tools that CSIRTs can use. Popular
tools are RTIR, FIR, etc. More concrete 1. The CSIRT shall be equipped with an appropriate definitions are up to discussion within the CSIRT system for managing and routing requests, in network. ENISA will support these discussions by order to facilitate handovers, making appropriate proposals. 1e 2. The CSIRT shall be adequately staffed to ensure 2. See ENISA CSIRT maturity study as a first availability at all times, pointer, but more concrete definitions are up to
3. The CSIRT shall rely on an infrastructure whose discussion within the CSIRT network. ENISA will continuity is ensured. To this end, redundant support these discussions by making systems and backup working space shall be appropriate proposals. available. 3. See 1a
We interpret this as a tool for designated CSIRTs to make sure they have the necessary travel budget to take part in existing communities like TF-CSIRT, FIRST, or EGC. CSIRTS shall have the possibility to participate, where 1f appropriate, in international cooperation networks In order to contribute to that and make it easier for designated CSIRTs, ENISA will try as much as possible to co-locate physical meetings of the group with TF-CSIRT meetings.
Article 2 is about what designated CSIRTs will have to do. 2 Tasks of the CSIRT This should be considered as the minimum set of tasks for designated CSIRTs.
1. Monitoring is a generic term, and designated CSIRTs will need to translate it to their own Tasks of the CSIRT shall include at least the following: context. ENISA plans to make monitoring the topic of its Workshop for national and 1. Monitoring incidents at a national level, governmental CSIRTs in May 2016. 2. Providing early warning, alerts, announcements 2. This task amounts to providing the “Alerts and and dissemination of information to relevant 2a Warnings” and “Announcements” services. stakeholders about risks and incidents, More information as to how a CSIRT can deliver 3. Responding to incidents, these services can be found in ENISA’s guides on
4. Providing dynamic risk and incident analysis and (Set up; Alerts-Warnings-Announcements?) situational awareness, 3. This is a basic requirement for CSIRTs. If
5. Participating in the CSIRT network necessary, ENISA’s Incident Management Guide can be of help.
© European Union Agency for Network and Information Security (ENISA), 2016 05 NIS Directive and national CSIRTs
TLP WHITE | Info Note | Final | February 2016
PARAGRAPH STATEMENT MEANING 4. Concrete definitions are up to discussion within the CSIRT network. ENISA will support these discussions by making appropriate proposals. 5. Participation, both online and in physical meetings, is essential to build trust between the members of the group.
Collaboration with the private sector is required to handle incidents efficiently. Designated CSIRTs will need to cover at least the sectors specified in Annex II of the Directive, The CSIRT shall establish cooperative relationships with 2b however the group members will have to decide what private sector. information they want to share with the private sector. ENISA will support the group by making appropriate proposals.
To facilitate cooperation, the CSIRT shall promote the adoption and use of common or standardised practises for: More concrete definitions are up to discussion within the 2c CSIRT network. ENISA will support these discussions by 1. incident and risk handling procedures, making appropriate proposals. 2. incident, risk and information classification schemes.