Which sectors are covered by the CER Directive?

CER covers eleven sectors, including energy, transport, banking and finance, health, drinking water, wastewater, digital infrastructure, public administration, space, and food.

What are EU Member States required to do under the CER Directive?

Member States must identify critical entities within the relevant sectors and establish requirements for how those entities manage resilience.

What types of risks does the CER Directive address?

The directive takes a broad approach to risk and covers both natural events and human-made threats, including sabotage, terrorism, and hybrid threats.

What is expected of organizations covered by CER?

Organizations must be able to prevent, protect against, respond to, withstand, and recover from incidents that may affect critical services.

What is the difference between CER and NIS2?

NIS2 primarily focuses on cybersecurity in network and information systems, while CER has a broader focus on an organization's overall resilience and continuity.

Why is mapping dependencies important when preparing for CER?

Organizations need to understand their critical services and dependencies to assess which incidents could affect them and which resilience measures should be prioritized.

Sicra can assist organizations with security maturity assessments, risk assessments, and analysis of existing security measures. This can support efforts to identify risks, dependencies, and prioritized measures related to increased resilience.

CER Directive (Critical Entities Resilience Directive)

What is the CER Directive?

The CER Directive (Critical Entities Resilience Directive) is an EU directive designed to strengthen the resilience of organizations that provide services critical to society and the economy. Its formal designation is Directive (EU) 2022/2557.

CER covers eleven sectors, including energy, transport, banking and financial services, health, drinking water, wastewater, digital infrastructure, public administration, space, and food. Member States must identify critical entities in these sectors and establish requirements for their resilience.

The directive takes a broad approach to risk. Critical entities must be able to prevent, protect against, respond to, resist, and recover from incidents. This includes natural hazards as well as human-made threats such as sabotage, terrorism, and hybrid threats.

CER is closely connected to NIS2. While NIS2 primarily addresses cybersecurity in network and information systems, CER has a broader focus on organizational resilience and continuity.

The CER Directive has been assessed as EEA-relevant. As of 2026, it has not yet been implemented in Norwegian law, and Norwegian authorities are preparing its implementation alongside NIS2.

Sicra and the CER Directive

Organizations affected by CER need to understand which critical services and dependencies they have, which incidents could affect them, and which measures can improve their resilience.

Sicra helps organizations assess security maturity, risk, security strategy, and existing security controls. This can support efforts to identify risks and prioritize measures as organizations prepare for greater resilience requirements. Sicra's security analysis includes security mapping, risk assessment, and prioritized recommendations based on NSM principles.

Services

Security maturity assessment

Security strategy

Security analysis – NSM principles

NIS2 and ISO27001

Need Assistance?

We are happy to have a non-binding conversation.