Frequently asked questions about the resilience of critical entities

Yes. An entity designated as a CER critical entity is also subject to the obligations of an essential entity under the The Cybersecurity Act. These obligations include, for example, registration in Fimea’s NIS2 entity register, incident reporting, and risk management requirements.

16.7.2026

A critical entity designated under the CER Directive is also considered an essential entity under NIS2. The organisation must review the information submitted to the NIS2 entity register and update it if necessary. In addition, the entity must include, in the grounds for essential status, that it has been designated as a critical entity under CER legislation. Changes must be reported without undue delay, and at the latest within two weeks of the change.

16.7.2026

A critical entity must report without undue delay any significant incident that disrupts or may disrupt the provision of an essential service.

16.7.2026

A significant incident is an event that disrupts or may disrupt the provision of an essential service by a critical entity. The significance of the incident is assessed based on its impact on service provision, safety, and the functioning of society. Particular consideration is given to the number and proportion of affected users, the duration of the disruption, and the geographical scope and isolation of the affected area.

16.7.2026

The CER incident notification is submitted via an online form provided by the Ministry of the Interior. The form is directed to the competent authority based on the user’s selections.

16.7.2026

No. If the incident falls under both NIS2 and CER, the notification must currently be submitted separately under both regimes.

16.7.2026

Yes. The entity must first submit an initial notification and later a more detailed report when more information becomes available. The initial notification must be submitted without undue delay and no later than 24 hours after detection of the incident. The detailed report must be submitted no later than one month.

16.7.2026

The contact point may be either a specific individual’s contact details or, for example, a shared email address and the organisation’s phone number. Multiple contacts may also be provided if it supports communication with Fimea.

17.6.2026

Yes. The organisation may provide multiple contacts to facilitate communication and ensure continuity during absences.

17.6.2026

No. The same person or contact details may be used. However, the organisation may choose to use different contacts for NIS2 and CER matters.

17.6.2026

Critical entities must identify risks to their operations, assess their impacts, and implement appropriate technical, organisational, and security measures to improve resilience and ensure continuity.

17.6.2026

The critical entity must prepare a risk assessment and update it regularly and whenever significant changes occur, and at least every four years. The first assessment must be completed within nine months of the decision designating the entity as critical.

17.6.2026

The entity must assess risks comprehensively. This includes essential services, supply chains, dependencies, and both physical and cyber threats. Based on the assessment, appropriate risk management measures must be implemented.

17.6.2026

The plan must describe how the organisation prevents incidents, prepares for and responds to them, and recovers from them. It must include both preventive measures and operational procedures for incident situations.

17.6.2026

Yes. Risk assessments must also consider supply chains related to service provision, as well as dependencies on other entities and services.

17.6.2026