Often seen as NIS2’s sister directive, CER addresses physical and operational resilience of essential services across 11 sectors, including energy, transport, banking, health and digital infrastructure. It takes an all-hazards approach, from natural disasters to sabotage and insider threats.
Member States had to identify critical entities by 17 July 2026; designated entities then have ten months to comply. For organisations already subject to NIS2 or DORA, the priority is to integrate CER into existing risk, continuity and incident processes rather than build a parallel framework.
