All concerned CSIRTs means all CSIRTs in charge of high- and critical-impact Entities that could be impacted by the specific threat or could provide useful information to high- and critical-impact entities to actively prepare their defenses. The legislation doesn’t apply outside the EU, except if there is a specific agreement (see Art.14).

During the transition period, high- and critical-impact entities can apply the NCCS on a voluntary basis. But following Art.38.4 they will need the Cyber-Attack Classification Scale Methodology (Art.37.8) to define if a cyber-attack is reportable or not. In addition, to determine the “potential impact” of a cyber-attack (Art.37.8.a), the methodology may need the result of the Union-Wide Risk Assessment. If a high- or critical-impact Entity reporting an incident through NIS2 estimates that the cross-border electricity flows could be impacted, it should alert its authority of the potential impact.

As soon as competent authorities receive information from high- and critical-impact Entities, they should share it according to the NCCS, with full respect of national confidentiality requirements.