HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"EN
18.6.2013 Official
Journal
of
the
European
Union L
165/41
REGULATION (EU) No 526/2013 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
of 21 May 2013
concerning the European Union Agency for Network and Information Security (ENISA) and
repealing Regulation (EC) No 460/2004
(Text with EEA relevance)
THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE
may have consequences for the electronic and physical
EUROPEAN UNION,
infrastructure which delivers services critical to the well-
being of European citizens.
Having regard to the Treaty on the Functioning of the European
Union, and in particular Article 114 thereof,
(2) The
threat
landscape
is
continuously
changing
and
security incidents can undermine the trust that users
have in technology, networks and services, thereby
Having regard to the proposal from the European Commission,
affecting their ability to exploit the full potential of the
internal market and widespread use of information and
communications technologies (ICT).
After transmission of the draft legislative act to the national
parliaments,
(3) Regular assessment of the state of network and
information security in the Union, based on reliable
Union data, as well as systematic forecast of future devel
Having regard to the opinion of the European Economic and
opments, challenges and threats, both at Union and
Social Committee ( 1 ),
global level, is therefore important for policy makers,
industry and users.
Acting in accordance with the ordinary legislative procedure ( 2 ),
(4) By
Decision
2004/97/EC,
Euratom
( 3 ), adopted at the
meeting of the European Council on 13 December
Whereas:
2003, the representatives of the Member States decided
that the European Network and Information Security
Agency (ENISA), that was to be established on the
(1) Electronic
communications,
infrastructure
and
services
basis of the proposal submitted by the Commission,
are essential factors, both directly and indirectly, in
would have its seat in a town in Greece to be determined
economic and societal development. They play a vital
by the Greek Government. Following that Decision, the
role for society and have in themselves become
Greek Government determined that ENISA should have
ubiquitous utilities in the same way as electricity or
its seat in Heraklion, Crete.
water supplies, and also constitute vital factors in the
delivery of electricity, water and other critical services.
Communications networks function as social and inno
(5) On
1
April
2005,
a
Headquarters
Agreement
(‘Seat
vation catalysts, multiplying the impact of technology
Agreement’) was concluded between the Agency and
and shaping consumer behaviours, business models,
the host Member State.
industries, as well as citizenship and political partici
pation. Their disruption has the potential to cause
considerable physical, social and economic damage,
(6)
The Agency’s host Member State should ensure the best
underlining the importance of measures to increase
possible conditions for the smooth and efficient
protection and resilience aimed at ensuring continuity
operation of the Agency. It is imperative for the proper
of critical services. The security of electronic communi
and efficient performance of its tasks, for staff
cations, infrastructure and services, in particular their
recruitment and retention and to enhance the efficiency
integrity, availability and confidentiality, faces
of networking activities that the Agency be based in an
continuously expanding challenges which relate, inter
appropriate location, among other things providing
alia, to the individual components of the communi
appropriate transport connections and facilities for
cations infrastructure and the software controlling those
spouses and children accompanying members of staff
components, the infrastructure overall and the services
of the Agency. The necessary arrangements should be
provided through that infrastructure. This is of increasing
laid down in an agreement between the Agency and
concern to society not least because of the possibility of
the host Member State concluded after obtaining the
problems due to system complexity, malfunctions,
approval of the Management Board of the Agency.
systemic failures, accidents, mistakes and attacks that
( 3 ) Decision 2004/97/EC, Euratom taken by common agreement
( 1 ) OJ C 107, 6.4.2011, p. 58.
between the Representatives of the Member States, meeting at
( 2 ) Position of the European Parliament of 16 April 2013 (not yet
Head of State or Government level, of 13 December 2003 on the
published in the Official Journal) and decision of the Council of
location of the seats of certain offices and agencies of the European
13 May 2013.
Union (OJ L 29, 3.2.2004, p. 15).

---

L 165/42
EN
Official Journal of the European Union
18.6.2013
(7) In
order
to
improve
the
operational
efficiency
of
the (11) Since ENISA was set up, the challenges of network and
Agency, the Agency has established a branch office in
information security have changed with technology,
the metropolitan area of Athens, which should be main
market and socioeconomic developments and have
tained with the agreement and support of the host
been the subject of further reflection and debate. In
Member State, and where the operational staff of the
response to the changing challenges, the Union has
Agency should be located. Staff primarily engaged in
updated its priorities for network and information
the administration of the Agency (including the
security policy. This Regulation aims to strengthen the
Executive Director), finance, desk research and analysis,
Agency to successfully contribute to the efforts of the
IT and facilities management, human resources, training,
Union institutions and the Member States to develop a
and communications and public affairs, should be based
European capacity to cope with network and information
in Heraklion.
security challenges.
(8) The
Agency
has
the
right
to
determine
its
own
organi
(12) Internal market measures in the field of security of elec
sation in order to ensure the proper and efficient
tronic communications and, more generally, network and
performance of its tasks, while respecting the provisions
information security require different forms of technical
on the seat and Athens branch office laid down in this
and organisational applications by the Union institutions
Regulation. In particular, in order to carry out tasks
and the Member States. The heterogeneous application of
involving interaction with key stakeholders such as the
those requirements can lead to inefficiencies and can
Union institutions, the Agency should make the
create obstacles to the internal market. This makes a
necessary practical arrangements to enhance such oper
centre of expertise at Union level necessary, providing
ational efficiency.
guidance, advice and assistance on issues related to
network and information security, which may be relied
upon by the Union institutions and the Member States.
The Agency can respond to those needs by developing
and maintaining a high level of expertise and assisting
the Union institutions, the Member States, and the
(9) In 2004 the European Parliament and the Council
adopted Regulation (EC) No 460/2004 (
business community in order to help them meet the

1 ) establishing
ENISA with the purpose of contributing to the goals of
legal and regulatory requirements of network and
ensuring a high level of network and information
information security and to determine and address
security within the Union and developing a culture of
network and information security issues, thereby
network and information security for the benefit of
contributing to the proper functioning of the internal
citizens, consumers, enterprises and public adminis
market.
trations. In 2008, the European Parliament and the
Council adopted Regulation (EC) No
1007/2008
( 2 )
extending the mandate of the Agency until March
2012. Regulation (EC) No 580/2011 ( 3 ) extends the
mandate of the Agency until 13 September 2013.
(13) The
Agency
should
carry
out
the
tasks
conferred
on
it
by
legal acts of the Union in the field of electronic
communications and, in general, contribute to an
enhanced level of security of electronic communications
as well as of privacy and personal data protection by,
among other things, providing expertise and advice, and
(10) The
Agency
should
succeed
ENISA
as
established
by
promoting the exchange of best practices, and offering
Regulation (EC) No 460/2004. Within the framework
policy suggestions.
of the Decision of the Representatives of the Member
States, meeting in the European Council of 13 December
2003, the host Member State should maintain and
further develop the current practical arrangements in
order to ensure the smooth and efficient operation of
(14) Directive
2002/21/EC
of
the
European
Parliament
and
of
the Agency, including its Athens branch office, and
the Council of 7 March 2002 on a common regulatory
facilitate the recruitment and retention of highly
framework for electronic communications networks and
qualified staff.
services (Framework Directive) ( 4 ) requires that providers
of public electronic communications networks or
( 1 ) Regulation (EC) No 460/2004 of the European Parliament and of the
publicly available electronic communications services
Council of 10 March 2004 establishing the European Network and
take appropriate measures to safeguard the integrity
Information Security Agency (OJ L 77, 13.3.2004, p. 1).
and security thereof, and introduces an obligation for
( 2 ) Regulation (EC) No 1007/2008 of the European Parliament and of
the national regulatory authorities, where appropriate,
the Council of 24 September 2008 amending Regulation (EC)
No 460/2004 establishing the European Network and Information
to inform, inter alia, the Agency about any security
Security Agency as regards its duration (OJ L 293, 31.10.2008,
breach or integrity loss that has had a significant
p. 1).
impact on the operation of networks or services and to
( 3 ) Regulation (EU) No 580/2011 of the European Parliament and of
submit to the Commission and to the Agency an annual
the Council of 8 June 2011 amending Regulation (EC) No 460/2004
establishing the European Network and Information Security Agency
as regards its duration (OJ L 165, 24.6.2011, p. 3).
( 4 ) OJ L 108, 24.4.2002, p. 33.

---

EN
18.6.2013 Official
Journal
of
the
European
Union L
165/43
summary report on the notifications received and the
(18) The
Agency
should
operate
as
a
point
of
reference
estab
action taken. Directive 2002/21/EC further calls on the
lishing trust and confidence by virtue of its indepen
Agency, by providing opinions, to contribute to the
dence, the quality of the advice it delivers and the
harmonisation of appropriate technical and organisa
information it disseminates, the transparency of its
tional security measures.
procedures and methods of operation, and its diligence
in carrying out its tasks. The Agency should build on
national and Union efforts and therefore carry out its
tasks in full cooperation with the Union institutions,
bodies, offices and agencies and the Member States,
and be open to contacts with industry and other
(15) Directive
2002/58/EC
of
the
European
Parliament
and
of
relevant stakeholders. In addition, the Agency should
the Council of 12 July 2002 concerning the processing
build on input from and cooperation with the private
of personal data and the protection of privacy in the
sector, which plays an important role in securing elec
electronic communications sector (Directive on privacy
tronic communications, infrastructures and services.
and electronic communications) ( 1 ) requires a provider
of a publicly available electronic communications
service to take appropriate technical and organisational
measures to safeguard the security of its services and also
requires that the confidentiality of the communications
and related traffic data be maintained. Directive
(19) A set of tasks should indicate how the Agency is to
2002/58/EC introduces personal data breach information
accomplish its objectives while allowing flexibility in its
and notification requirements for electronic communi
operations. The tasks carried out by the Agency should
cation services providers. It also requires the Commission
include the collection of appropriate information and
to consult the Agency on any technical implementing
data needed to carry out analyses of the risks to the
measures to be adopted concerning the circumstances
security and resilience of electronic communications,
or format of and procedures applicable to information
infrastructure and services and to assess, in cooperation
and notification requirements. Directive 95/46/EC of the
with Member States, the Commission and, where appro
European Parliament and of the Council of 24 October
priate, with relevant stakeholders, the state of network
1995 on the protection of individuals with regard to the
and information security in the Union. The Agency
processing of personal data and on the free movement of
should ensure coordination and collaboration with the
such data (
Union institutions, bodies, offices and agencies and

2 ) requires Member States to provide that the
controller must implement appropriate technical and
Member States, and enhance cooperation between stake
organisational measures to protect personal data against
holders in Europe, in particular by involving in its
accidental or unlawful destruction or accidental loss,
activities competent national and Union bodies and
alteration, unauthorised disclosure or access, in particular
high-level private sector experts in relevant areas, in
where the processing involves the transmission of data
particular providers of electronic communications
over a network and against all other unlawful forms of
networks and services, network equipment manufacturers
processing.
and software vendors, taking into account that network
and information systems comprise combinations of
hardware, software and services. The Agency should
provide assistance to the Union institutions and to the
Member States in their dialogue with industry to address
security-related problems in hardware and software
(16) The Agency should contribute to a high level of network
products, thereby contributing to a collaborative
and information security, to better protection of privacy
approach to network and information security.
and personal data, and to the development and
promotion of a culture of network and information
security for the benefit of citizens, consumers, businesses
and public sector organisations in the Union, thus
contributing to the proper functioning of the internal
(20) Network and information security strategies made public
market. In order to achieve this, the necessary
by a Union institution, body, office or agency or a
budgetary funds should be allocated to the Agency.
Member State should be provided to the Agency for its
information and to avoid duplication of effort. The
Agency should analyse the strategies and promote their
presentation in a format that facilitates comparability. It
should make the strategies and its analyses available to
the public through electronic means.
(17) Given
the
increasing
significance
of
electronic
networks

and communications, which now constitute the
backbone of the European economy, and the actual
size of the digital economy, the financial and human
resources allocated to the Agency should be increased
to reflect its enhanced role and tasks, and its critical
(21) The
Agency
should
assist
the
Commission
by
means
of
position in defending the European digital ecosystem.
advice, opinions and analyses on all the Union matters
related to policy development in the area of network and
( 1 ) OJ L 201, 31.7.2002, p. 37.
information security, including Critical Information Infra
( 2 ) OJ L 281, 23.11.1995, p. 31.
structure Protection and resilience. The Agency should

---

L 165/44
EN
Official Journal of the European Union
18.6.2013
also assist the Union institutions, bodies, offices and
authorities, in particular supporting the development,
agencies and where relevant, the Member States, at
promotion and exchange of best practices and
their request, in their efforts to develop network and
standards for education programmes and awareness-
information security policy and capability.
raising schemes. Increased information exchange
between Member States will facilitate such action. The
Agency should contribute towards raising the awareness
of individual users of electronic communications, infra
(22) The
Agency
should
take
full
account
of
the
ongoing
structure and services, including by assisting Member
research, development, and technological assessment
States, where they have chosen to use the public
activities, in particular those carried out by the various
interest information platform provided for in Directive
Union research initiatives to advise the Union institu
2002/22/EC of the European Parliament and of the
tions, bodies, offices and agencies and where relevant,
Council of 7 March 2002 on universal service and
the Member States, at their request, on research needs
users’ rights relating to electronic communications
in the area of network and information security.
networks and services (Universal Service Directive) ( 1 ),
to produce relevant public interest information
regarding network and information security, and also
by assisting in the development of such information to
(23) The
Agency
should
assist
the
Union
institutions,
bodies,
be included with the supply of new devices intended for
offices and agencies as well as the Member States in their
use on public communications networks. The Agency
efforts to build and enhance cross-border capability and
should also support cooperation between stakeholders
preparedness to prevent, detect and respond to network
at Union level, partly by promoting information
and information security problems and incidents. In this
sharing, awareness-raising campaigns and education and
regard, the Agency should facilitate cooperation among
training programmes.
the Member States and between the Commission and
other Union institutions, bodies, offices and agencies
and the Member States. To this end, the Agency should
support the Member States in their continuous efforts to
(27) The
Agency
should,
inter
alia,
assist
the
relevant
Union
improve their response capability and to organise and
institutions, bodies, offices and agencies and the Member
run European exercises on security incidents and, at the
States in public education campaigns to end users,
request of a Member State, national exercises.
aiming at promoting safer individual online behaviour
and raising awareness of potential threats in cyberspace,
including cybercrimes such as phishing attacks, botnets,
financial and banking fraud, as well as promoting basic
(24) To understand better the challenges in the network and
authentication and data protection advice.
information security field, the Agency needs to analyse
current and emerging risks. For that purpose the Agency
should, in cooperation with Member States and, as
appropriate, with statistical bodies and others, collect
relevant information. Furthermore, the Agency should
(28) To
ensure
that
it
fully
achieves
its
objectives,
the
Agency
assist the Union institutions, bodies, offices and
should liaise with relevant bodies, including those dealing
agencies and the Member States and in their efforts to
with cybercrime such as Europol, and privacy protection
collect, analyse and disseminate network and information
authorities to exchange know-how and best practices and
security data. The collection of appropriate statistical
provide advice on network and information security
information and data needed to carry out analyses of
aspects that might have an impact on their work. The
the risks to the security and resilience of electronic
Agency should aim to achieve synergies between the
communications, infrastructure and services should take
efforts of those bodies and its own efforts to promote
place on the basis of the information provided by the
advanced network and information security. Represen
Member States and the Agency’s insight to the Union
tatives of national and Union law enforcement and
institutions’ ICT infrastructures in accordance with
privacy protection authorities should be eligible to be
Union provisions and national provisions in compliance
represented in the Agency’s Permanent Stakeholders
with Union law. On the basis of that information, the
Group. In liaising with law enforcement bodies
Agency should maintain awareness of the latest state of
regarding network and information security aspects that
network and information security and related trends in
might have an impact on their work, the Agency should
the Union for the benefit of Union institutions, bodies,
respect existing channels of information and established
offices and agencies and the Member States.
networks.

(25) In
performing
its
tasks,
the
Agency
should
facilitate
(29) The
Commission
has
launched
a
European
Public-Private
cooperation between the Union and the Member States
Partnership for Resilience as a flexible Union-wide
to improve awareness of the state of network and
cooperation platform for resilience of ICT infrastructure,
information security in the Union.
in which the Agency should play a facilitating role,
bringing together stakeholders to discuss public policy
priorities, economic and market dimensions of challenges
and measures for the resilience of ICT.
(26) The Agency should facilitate cooperation among
the Member States’ competent independent regulatory
( 1 ) OJ L 108, 24.4.2002, p. 51.

---

EN
18.6.2013 Official
Journal
of
the
European
Union L
165/45
(30) In order to promote network and information security
offices and agencies dealing with network and
and its visibility, the Agency should facilitate cooperation
information security. The Agency should contribute to
among the Member States’ competent public bodies, in
identifying research priorities, at Union level, in the
particular by supporting the development and exchange
areas of network resilience and network and information
of best practices and awareness-raising schemes and by
security, and should convey knowledge of industry needs
enhancing their outreach activities. The Agency should
to relevant research institutions.
also support cooperation between stakeholders and the
Union institutions, partly by promoting information
sharing and awareness-raising activities.
(35) The
Agency
should
encourage
Member
States
and
service
providers to raise their general security standards so that
all internet users take the necessary steps to ensure their
(31) In
order
to
enhance
an
advanced
level
of
network
and
own personal cyber security.
information security in the Union, the Agency should
promote cooperation and the exchange of information
and best practices between relevant organisations, such as
Computer Security Incident Response Teams (CSIRTs)
and Computer Emergency Response Teams (CERTs).
(36) Network and information security problems are global
issues. There is a need for closer international
cooperation to improve security standards, including
the definition of common norms of behaviour and
codes of conduct, and information sharing, promoting
(32) A
Union
system
of
properly
functioning
CERTs
should
swifter international collaboration in response to, as
constitute a cornerstone of the Union’s network and
well as a common global approach to, network and
information security infrastructure. The Agency should
information security issues. To that end, the Agency
support Member State CERTs and the Union CERT in
should support further Union involvement and
the operation of a network of CERTs, including the
cooperation with third countries and international
members of the European Governmental CERTs Group.
organisations by providing, where appropriate, the
In order to assist in ensuring that each of the CERTs has
necessary expertise and analysis to the relevant Union
sufficiently advanced capabilities and that those capa
institutions, bodies, offices and agencies.
bilities correspond as far as possible to the capabilities
of the most developed CERTs, the Agency should
promote the establishment and operation of a peer-
review system. Furthermore, the Agency should
promote and support cooperation between the relevant
(37) The
Agency should operate in accordance with the
CERTs in the event of incidents, attacks on or disruptions
principle of subsidiarity, ensuring an appropriate degree
of networks or infrastructure managed or protected by
of coordination between the Member States on matters
the CERTs and involving or potentially involving at least
relating to network and information security and
two CERTs.
improving the effectiveness of national policies, thus
adding value to them and in accordance with the
principle of proportionality, not going beyond what is
necessary in order to achieve the objectives set out by
(33) Efficient network and information security policies
this Regulation. The exercise of the Agency’s tasks should
should be based on well-developed risk assessment
reinforce, but not interfere with, the competences, nor
methods, both in the public and private sector. Risk
should it pre-empt, impede or overlap with the relevant
assessment methods and procedures are used at
powers and tasks, of the national regulatory authorities
different levels with no common practice regarding
as set out in the Directives relating to electronic
how to apply them efficiently. Promoting and developing
communications networks and services, as well as those
best practices for risk assessment and for interoperable
of the Body of European Regulators for Electronic
risk management solutions in public- and private-sector
Communications (BEREC) established by Regulation
organisations will increase the security level of networks
(EC) No
1211/2009
( 1 ) and the Communications
and information systems in the Union. To this end, the
Committee referred to in Directive 2002/21/EC, of the
Agency should support cooperation between stake
European standardisation bodies, the national standard
holders at Union level, facilitating their efforts relating
isation bodies and the Standing Committee as set out in
to the establishment and take-up of European and inter
Directive 98/34/EC ( 2 ) and the independent supervisory
national standards for risk management and for
authorities of the Member States as set out in Directive
measurable security of electronic products, systems,
95/46/EC.
networks and services which, together with software,
comprise the network and information systems.
( 1 ) Regulation (EC) No 1211/2009 of the European Parliament and of
the Council of 25 November 2009 establishing the Body of
European Regulators for Electronic Communications (BEREC) and
the Office (OJ L 337, 18.12.2009, p. 1).
( 2 ) Directive 98/34/EC of the European Parliament and of the Council
of 22 June 1998 laying down a procedure for the provision of
(34) Where
appropriate
and
useful
for
fulfilling
its
objectives
information in the field of technical standards and regulations and
and tasks, the Agency should share experience and
of rules on Information Society services (OJ L 204, 21.7.1998,
general information with Union institutions, bodies,
p. 37).

---

L 165/46
EN
Official Journal of the European Union
18.6.2013
(38) It
is
necessary
to
implement
certain
principles
regarding
entrusted with the powers necessary to establish the
the governance of the Agency in order to comply with
budget, verify its execution, adopt the appropriate
the Joint Statement and Common Approach agreed upon
financial rules, establish transparent working procedures
in July 2012 by the Inter-Institutional Working Group
for decision making by the Agency, adopt the Agency’s
on EU decentralised agencies, the purpose of which
work programme, adopt its own rules of procedure and
statement and approach is to streamline the activities
the Agency’s internal rules of operation, appoint the
of agencies and improve their performance.
Executive Director, decide on the extension of the
Executive Director’s term of office after obtaining the
views of the European Parliament, and decide on the
termination thereof. The Management Board should set
(39) The
Joint
Statement
and
Common
Approach
should
also
up an Executive Board to assist it with its administrative
be reflected, as appropriate, in the Agency’s Work
and budgetary tasks.
Programmes, evaluations of the Agency, and the
Agency’s reporting and administrative practice.
(45) The
smooth
functioning
of
the
Agency
requires
that
its
Executive Director be appointed on grounds of merit and
(40) In order for the Agency to function properly,
the
documented administrative and managerial skills, as well
Commission and the Member States should ensure that
as competence and experience relevant for network and
persons to be appointed to the Management Board have
information security, and that the duties of the Executive
appropriate professional expertise. The Commission and
Director be carried out with complete independence as to
the Member States should also make efforts to limit the
the organisation of the internal functioning of the
turnover of their respective Representatives on the
Agency. To this end, the Executive Director should
Management Board, in order to ensure continuity in its
prepare a proposal for the Agency’s work programme,
work.
after prior consultation with the Commission, and take
all necessary steps to ensure the proper execution of the
work programme of the Agency. The Executive Director
should prepare an annual report to be submitted to the
(41) It is essential that the Agency establish and maintain a
Management Board, draw up a draft statement of
reputation for impartiality, integrity and high professional
estimates of revenue and expenditure for the Agency,
standards. Accordingly, the Management Board should
and implement the budget.
adopt comprehensive rules covering the entire Agency
for the prevention and management of conflicts of
interest.
(46) The
Executive
Director
should
have
the
option
of
setting
up ad hoc Working Groups to address specific matters,
in particular of a scientific, technical or legal or socioe
(42) Given the unique circumstances of the Agency and the
conomic nature. In setting up ad hoc Working Groups
difficult challenges facing it, the organisational structure
the Executive Director should seek input from and draw
of the Agency should be simplified and strengthened to
on the relevant external expertise needed to enable the
ensure greater efficiency and effectiveness. Therefore,
Agency to have access to the most up-to-date
among other things, an Executive Board should be estab
information available regarding security challenges
lished in order to enable the Management Board to focus
posed by the developing information society. The
on issues of strategic importance.
Executive Director should ensure that the ad hoc
Working Groups’ members are selected according to
the highest standards of expertise, taking due account
of a representative balance, as appropriate according to
(43) The
Management
Board
should
appoint
an
Accounting
the specific issues in question, between the public admin
Officer in accordance with rules adopted under Regu
istrations of the Member States, the Union institutions
lation (EU, Euratom) No 966/2012 ( 1 ) (the ‘Financial
and the private sector, including industry, users, and
Regulation’).
academic experts in network and information security.
The Executive Director should be able, as appropriate,
to invite individual experts recognised as competent in
the relevant field to participate in the Working Groups’
(44) In order to ensure that the Agency is effective, the
proceedings, on a case-by-case basis. Their expenses
Member States and the Commission should be repre
should be met by the Agency in accordance with its
sented on the Management Board, which should define
internal rules and in accordance with rules adopted
the general direction of the Agency’s operations and
under the Financial Regulation.
ensure that it carries out its tasks in accordance with
this Regulation. The Management Board should be
( 1 ) Regulation (EU, Euratom) No 966/2012 of the European Parliament
(47) The Agency should have
a Permanent Stakeholders’
and of the Council of 25 October 2012 on the financial rules
Group as an advisory body, to ensure regular dialogue
applicable to the general budget of the Union and repealing
Council Regulation (EC, Euratom) No 1605/2002 (OJ L 298,
with the private sector, consumers’ organisations and
26.10.2012, p. 1).
other relevant stakeholders. The Permanent Stakeholders’

---

EN
18.6.2013 Official
Journal
of
the
European
Union L
165/47
Group, set up by the Management Board on a proposal
concerned. Moreover, the Court of Auditors should audit
by the Executive Director, should focus on issues relevant
the Agency’s accounts to ensure transparency
to stakeholders and bring them to the attention of the
and accountability.
Agency. The Executive Director should, where appro
priate and according to the agenda of the meetings, be
able to invite representatives of the European Parliament
and other relevant bodies to take part in meetings of the
(52) In
view
of
the
continually
changing
threat
landscape
and
Group.
the evolution of Union policy on network and
information security, and in order to align to the multi
annual financial framework, the duration of the mandate
of the Agency should be set to a limited period of seven
years with a possibility of extending the duration.
(48) Since
there
is
provision
for ample
representation
of
stakeholders in the Permanent Stakeholders Group, and
that group is to be consulted in particular regarding the
draft Work Programme, there is no longer any need to
provide for representation of stakeholders in the
(53) The
Agency’s
operations
should
be
evaluated
indepen
dently. The evaluation should have regard to the
Management Board.
Agency’s effectiveness in achieving its objectives, its
working practices and the relevance of its tasks, in
order to determine the continuing validity, or otherwise,
of the objectives of the Agency and, based thereon,
whether and for what period the duration of its
(49) The
Agency
should
apply
the
relevant
Union
provisions
concerning public access to documents as set out in
mandate should be further extended.
Regulation (EC) No
1049/2001 of the European
Parliament and of the Council ( 1 ). The information
processed by the Agency for purposes relating to its
internal functioning as well as the information
(54) If, towards the end of the duration of the mandate of the
processed in carrying out its tasks should be subject to
Agency, the Commission has not introduced a proposal
Regulation (EC) No 45/2001 of the European Parliament
for an extension of the mandate, the Agency and the
and of the Council of 18 December 2000 on the
Commission should take the relevant measures,
protection of individuals with regard to the processing
addressing in particular issues relating to staff contracts
of personal data by the Community institutions and
and budget arrangements.
bodies and on the free movement of such data ( 2 ).
(55) Since the objective of this Regulation, namely to establish
a European Union Agency for Network and Information
(50) The Agency should comply with the provisions
Security for the purpose of contributing to a high level of
applicable to the Union institutions, and with national
network and information security within the Union and
legislation regarding the treatment of sensitive docu
in order to raise awareness and develop and promote a
ments.
culture of network and information security in society
for the benefit of citizens, consumers, enterprises and
public sector organisations in the Union, thus
contributing to the establishment and proper functioning
of the internal market, cannot be sufficiently achieved by
(51) In order to guarantee the full autonomy and inde
the Member States and can therefore be better achieved
pendence of the Agency and to enable it to perform
at Union level, the Union may adopt measures, in
additional and new tasks, including unforeseen
accordance with the principle of subsidiarity as set out
emergency tasks, the Agency should be granted a
in Article 5 of the Treaty on European Union. In
sufficient and autonomous budget whose revenue
accordance with the principle of proportionality, as set
comes primarily from a contribution from the Union
out in that Article, this Regulation does not go beyond
and contributions from third countries participating in
what is necessary in order to achieve that objective.
the Agency’s work. The majority of the Agency staff
should be directly engaged in the operational implemen
tation of the Agency’s mandate. The host Member
State, or any other Member State, should be allowed
(56) Regulation
(EC)
No
460/2004
should
be
repealed.
to make voluntary contributions to the revenue of the
Agency. The Union’s budgetary procedure should
remain applicable as far as any subsidies chargeable
to the general budget of the European Union are
(57) The
European
Data
Protection
Supervisor
was
consulted
in accordance with Article 28(2) of Regulation (EC)
( 1 ) Regulation (EC) No 1049/2001 of the European Parliament and of
No 45/2001 and adopted his opinion on 20 December
the Council of 30 May 2001 regarding public access to European
2010 ( 3 ),
Parliament, Council and Commission documents (OJ L 145,
31.5.2001, p. 43).
( 2 ) OJ L 8, 12.1.2001, p. 1.
( 3 ) OJ C 101, 1.4.2011, p. 20.

---

L 165/48
EN
Official Journal of the European Union
18.6.2013
HAVE ADOPTED THIS REGULATION:
5. The
Agency
shall
use
its
expertise
to
stimulate
broad
cooperation between actors from the public and private sectors.
SECTION 1
Article 3
SCOPE OBJECTIVES AND TASKS
Tasks
Article 1
1. Within the purpose set out in Article 1, and in order to
Subject matter and Scope
attain the objectives set out in Article 2, whilst respecting
1. This
Regulation
establishes
a
European
Union
Agency
for Article 1(2), the Agency shall perform the following tasks:
Network and Information Security (ENISA, hereinafter ‘the
Agency’) to undertake the tasks assigned to it for the purpose
of contributing to a high level of network and information
(a) support the development of Union policy and law, by:
security within the Union and in order to raise awareness of
network and information security and to develop and promote
a culture, of network and information security in society for the
(i) assisting and advising on all matters relating to Union
benefit of citizens, consumers, enterprises and public sector
network and information security policy and law;
organisations in the Union, thus contributing to the estab
lishment and proper functioning of the internal market.
(ii) providing preparatory work, advice and analyses
relating to the development and update of Union
2. The
objectives
and
the
tasks
of
the
Agency
shall
be
network and information security policy and law;
without prejudice to the competences of the Member States
regarding network and information security and in any case
to activities concerning public security, defence, national
(iii) analysing publicly available network and information
security (including the economic well-being of the state when
security strategies and promoting their publication;
the issues relate to national security matters) and the activities
of the state in areas of criminal law.
(b) support capability building by:
3. For
the
purposes
of
this
Regulation
‘network
and
information security’ means the ability of a network or an
(i) supporting Member States, at their request, in their
information system to resist, at a given level of confidence,
efforts to develop and improve the prevention,
accidental events or unlawful or malicious actions that
detection and analysis of and the capability to
compromise the availability, authenticity, integrity and confiden
respond to network and information security
tiality of stored or transmitted data and the related services
problems and incidents, and providing them with
offered by or accessible via those networks and systems.
the necessary knowledge;
Article 2
(ii) promoting and facilitating voluntary cooperation
among the Member States and between the Union
Objectives
institutions, bodies, offices and agencies and the
1. The
Agency
shall
develop
and
maintain
a
high
level
of
Member States in their efforts to prevent, detect and
expertise.
respond to network and information security
problems and incidents where these have an impact
across borders;
2. The
Agency
shall
assist
the
Union
institutions,
bodies,
offices and agencies in developing policies in network and
information security.
(iii) assisting the Union institutions, bodies, offices and
agencies in their efforts to develop the prevention,
detection and analysis of and the capability to
respond to network and information security
3. The
Agency
shall
assist
the
Union
institutions,
bodies,
problems and incidents, in particular by supporting
offices and agencies and the Member States in implementing
the operation of a Computer Emergency Response
the policies necessary to meet the legal and regulatory
Team (CERT) for them;
requirements of network and information security under
existing and future legal acts of the Union, thus contributing
to the proper functioning of the internal market.
(iv) supporting the raising of the level of capabilities of
national/governmental and Union CERTs, including
by promoting dialogue and exchange of information,
4. The
Agency
shall
assist
the
Union
and
the
Member
States
with a view to ensuring that, with regard to the state
in enhancing and strengthening their capability and
of the art, each CERT meets a common set of
preparedness to prevent, detect and respond to network and
minimum capabilities and operates according to best
information security problems and incidents.
practices;

---

EN
18.6.2013 Official
Journal
of
the
European
Union L
165/49
(v) supporting the organisation and running of Union
(d) support research and development and standardisation, by:
network and information security exercises, and, at
their request, advising Member States on national
exercises;
(i) facilitating the establishment and take-up of European
and international standards for risk management and for
the security of electronic products, networks and
(vi) assisting the Union institutions, bodies, offices and
services;
agencies and the Member States in their efforts to
collect, analyse and, in line with Member States’
security requirements, disseminate relevant network
(ii) advising the Union and the Member States on research
and information security data; and on the basis of
needs in the area of network and information security
information provided by the Union institutions,
with a view to enabling effective responses to current
bodies, offices and agencies and the Member States
and emerging network and information security risks
in accordance with provisions of Union law and
and threats, including with respect to new and
national provisions in compliance with Union law,
emerging information and communications technol
maintaining the awareness, on the part of the Union
ogies, and to using risk-prevention technologies effec
institutions, bodies, offices and agencies as well as the
tively;
Member States of the latest state of network and
information security in the Union for their benefit;
(e) cooperate with Union institutions, bodies, offices and
agencies, including those dealing with cybercrime and the
(vii) supporting the development of a Union early warning
protection of privacy and personal data, with a view to
mechanism that is complementary to Member States’
addressing issues of common concern, including by:
mechanisms;
(i) exchanging know-how and best practices;
(viii) offering network and information security training for
relevant public bodies, where appropriate in
cooperation with stakeholders;
(ii) providing advice on relevant network and information
security aspects in order to develop synergies;
(c) support voluntary cooperation among competent public
bodies, and between stakeholders, including universities
(f) contribute to the Union’s efforts to cooperate with third
and research centres in the Union, and support awareness
countries and international organisations to promote inter
raising, inter alia, by:
national cooperation on network and information security
issues, including by:
(i) promoting cooperation between national and govern
mental CERTs or Computer Security Incident Response
(i) being engaged, where appropriate, as an observer and
Teams (CSIRTs), including the CERT for the Union
in the organisation of international exercises, and
institutions, bodies, offices and agencies;
analysing and reporting on the outcome of such
exercises;
(ii) promoting the development and sharing of best
(ii) facilitating exchange of best practices of relevant
practices with the aim of attaining an advanced level
organisations;
of network and information security;
(iii) providing the Union institutions with expertise.
(iii) facilitating dialogue and efforts to develop and
exchange best practices;
2. Union institutions, bodies, offices and agencies and
Member State bodies may request advice from the Agency in
(iv) promoting best practices in information sharing and
the event of breach of security or loss of integrity with a
awareness raising;
significant impact on the operation of networks and services.
(v) supporting the Union institutions, bodies, offices and
3. The
Agency
shall
carry
out
tasks
conferred
on
it
by
legal
agencies and, at their request, the Member States and
acts of the Union.
their relevant bodies in organising awareness raising,
including at the level of individual users, and other
outreach activities to increase network and information
4. The Agency shall express independently its own
security and its visibility by providing best practices and
conclusions, guidance and advice on matters within the scope
guidelines;
and objectives of this Regulation.

---

L 165/50
EN
Official Journal of the European Union
18.6.2013
SECTION 2
Servants of the European Union (the ‘Staff Regulations’ and the
‘Conditions of Employment of Other Servants’), laid down in
ORGANISATION
Regulation (EEC, Euratom, ECSC) No
259/68
( 1 ) on the
Article 4
Appointing Authority and on the Authority Empowered to
Conclude Contract of Employment, respectively.
Composition of the Agency
1. The
Agency
shall
comprise:
The Management Board shall adopt, in accordance with the
procedure under Article 110 of the Staff Regulations, a
(a) a Management Board;
decision based on Article 2(1) of the Staff Regulations and on
Article 6 of the Conditions of Employment of Other Servants
delegating the relevant Appointing Authority powers to the
(b) an Executive Director and staff; and
Executive Director. The Executive Director may sub-delegate
those powers.
(c) a Permanent Stakeholders’ Group.
Where exceptional circumstances so require, the Management
2. In
order
to
contribute
to
enhancing
effectiveness
and
effi
Board may revoke the delegation of the powers of the
ciency of the operation of the Agency, the Management Board
Appointing Authority to the Executive Director and those
shall establish an Executive Board.
sub-delegated by the Executive Director. In such a case, the
Management Board may delegate them, for a limited period
to one of its members or to a staff member other than the
Executive Director.
Article 5
Management Board
1. The
Management
Board
shall
define
the
general
direction 8. The
Management
board
shall
adopt
appropriate
rules
of the operation of the Agency and ensure that the Agency
implementing the Staff Regulations and the Conditions of
works in accordance with the rules and principles laid down
Employment of Other Servants in accordance with the
in this Regulation. It shall also ensure consistency of the
procedure provided for in Article 110 of the Staff Regulations.
Agency’s work with activities conducted by the Member States
as well as at Union level.
9. The
Management
Board
shall
appoint
the
Executive
2. The
Management
Board
shall
adopt
the
Agency’s
annual Director and may extend his term of office or remove him
and multiannual work programme.
from office in accordance with Article 24 of this Regulation.
3. The
Management
Board
shall
adopt
an
annual
report
on
10. The
Management
Board
shall
adopt
the
rules
of
the Agency’s activities and send it, by 1 July of the following
procedure for itself and for the Executive Board after consulting
year, to the European Parliament, the Council, the Commission
the Commission. The rules of procedure shall provide for
and the Court of Auditors. The annual report shall include the
expedited decisions through either written procedure or by
accounts and describe how the Agency has met its performance
remote conferencing.
indicators. The annual report shall be made public.
4. The Management Board shall adopt an anti-fraud strategy
11. The
Management
Board
shall
adopt
the
Agency’s
internal
that is proportionate to the fraud risks having regard to a cost-
rules of operation after consulting the Commission services.
benefit analysis of the measures to be implemented.
Those rules shall be made public.
5. The
Management
Board
shall
ensure
adequate
follow-up 12. The
Management
Board
shall
adopt
the
financial
rules
to the findings and recommendations resulting from investi
applicable to the Agency. They may not depart from
gations of the European Anti-fraud Office (OLAF) and the
Commission Regulation (EC, Euratom) No
2343/2002 of
various internal or external audit reports and evaluations.
19 November 2002 on the framework Financial Regulation
for the bodies referred to in Article 185 of Council Regulation
(EC, Euratom) No 1605/2002 on the Financial Regulation
6. The
Management
Board
shall
adopt
rules
for
the applicable to the general budget of the European Commu
prevention and management of conflicts of interest.
nities ( 2 ), unless such departure is specifically required for the
Agency’s operation and the Commission has given its prior
consent.
7. The
Management
Board
shall
exercise,
with
respect
to
the
staff of the Agency, the powers conferred by the Staff Regu
( 1 ) OJ L 56, 4.3.1968, p. 1.
lations of Officials and the Conditions of Employment of Other
( 2 ) OJ L 357, 31.12.2002, p. 72.

---

EN
18.6.2013 Official
Journal
of
the
European
Union L
165/51
13. The
Management
Board
shall
adopt
a
Multiannual
Staff
Article 9
Policy Plan, after consulting the Commission services and
having duly informed the European Parliament and the Council.
Voting
1. The
Management
Board
shall
take
its
decisions
by
an
absolute majority of its members.
Article 6
Composition of the Management Board
2. A
two-thirds
majority
of
all
Management
Board
members
1. The
Management
Board
shall
be
composed
of
one
repre
shall be required for the adoption of the Management Board’s
sentative of each Member State, and two representatives
rules of procedure, the Agency’s internal rules of operation, the
appointed by the Commission. All representatives shall have
budget, the annual and multiannual work programme, the
voting rights.
appointment, extension of the term of office or removal of
the Executive Director, and the designation of the Chairperson
of the Management Board.
2. Each
member
of
the
Management
Board
shall
have
an
alternate to represent the member in their absence.
Article 10
3. Members
of
the
Management
Board
and
their
alternates
Executive Board
shall be appointed in light of their knowledge of the Agency’s
1. The
Management
Board
shall
be
assisted
by
an
Executive
tasks and objectives, taking into account the managerial, admin
Board.
istrative and budgetary skills relevant to fulfil the tasks listed in
Article 5. The Commission and the Member States should make
efforts to limit turnover of their representatives in the
Management Board, in order to ensure continuity of that
2. The
Executive
Board
shall
prepare
decisions
to
be
adopted
board’s work. The Commission and the Member States shall
by the Management Board on administrative and budgetary
aim to achieve a balanced representation between men and
matters only.
women on the Management Board.
Together with the Management Board, it shall ensure adequate
4. The term of office of members of the Management Board
follow-up to the findings and recommendations stemming from
and of their alternates shall be four years. That term shall be
investigations of OLAF and the various internal or external audit
renewable.
reports and evaluations.
Article 7
Without prejudice to the responsibilities of the Executive
Director, as set out in Article 11, the Executive Board shall
Chairperson of the Management Board
assist and advise the Executive Director in implementing the
1. The
Management
Board
shall
elect
its
Chairperson
and
a decisions of the Management Board on administrative and
Deputy Chairperson from among its members for a period of
budgetary matters.
three years, which shall be renewable. The Deputy Chairperson
shall ex officio replace the Chairperson if the latter is unable to
attend to his or her duties.
3. The
Executive
Board
shall
be
made
up
of
five
members
appointed from among the members of the Management Board
amongst whom the Chairperson of the Management Board,
2. The
Chairperson
may
be
invited
to
make
a
statement who may also chair the Executive Board, and one of the repre
before the relevant committee(s) of the European Parliament
sentatives of the Commission.
and answer Members’ questions.
4. The term of office of members of the Executive Board
Article 8
shall be the same as that of members of the Management
Board set out in Article 6(4).
Meetings
1. Meetings
of
the
Management
Board
shall
be
convened
by
its Chairperson.
5. The
Executive
Board
shall
meet
at
least
once
every
three
months. The chairperson of the Executive Board shall convene
additional meetings at the request of its members.
2. The Management Board shall hold an ordinary meeting at
least once a year. It shall also hold extraordinary meetings at the
request of the Chairperson or of at least a third of its members.
Article 11
Duties of the Executive Director
3. The
Executive
Director
shall
take
part,
without
voting 1. The
Agency
shall
be
managed
by
its
Executive
Director,
rights, in the meetings of the Management Board.
who shall be independent in the performance of his/her duties.

---

L 165/52
EN
Official Journal of the European Union
18.6.2013
2. The
Executive
Director
shall
be
responsible
for:
3. Where
necessary
and
within
the
Agency’s
objectives
and
tasks, the Executive Director may set up ad hoc Working
Groups composed of experts, including from the Member
States’ competent authorities. The Management Board shall be
(a) the day-to-day administration of the Agency;
informed in advance. The procedures regarding in particular the
composition, the appointment of the experts by the Executive
Director and the operation of the ad hoc Working Groups shall
(b) implementing the decisions adopted by the Management
be specified in the Agency’s internal rules of operation.
Board;
4. The
Executive
Director
shall
make
administrative
support
(c) after consultation with the Management Board, preparing
staff and other resources available to the Management Board
the annual work programme and the multiannual work
and the Executive Board whenever necessary.
programme and submitting them to the Management
Board after consulting the Commission;
Article 12
(d) implementing the annual work programme and the multi
Permanent Stakeholders’ Group
annual work programme and reporting to the Management
Board thereon;
1. The
Management
Board,
acting
on
a
proposal
by
the
Executive Director, shall set up a Permanent Stakeholders’
Group composed of recognised experts representing the
relevant stakeholders, such as the ICT industry, providers of
(e) preparing the annual report on the Agency’s activities and
electronic communications networks or services available to
presenting it to the Management Board for approval;
the public, consumer groups, academic experts in network
and information security, and representatives of national regu
latory authorities notified under Directive 2002/21/EC as well
as of law enforcement and privacy protection authorities.
(f) preparing an action plan following-up on the conclusions of
the retrospective evaluations and reporting on progress
every two years to the Commission;
2. Procedures
for,
in
particular,
the
number,
composition,
and the appointment of the members of the Permanent Stake
(g) protecting the financial interests of the Union by the appli
holders’ Group by the Management Board, the proposal by the
cation of preventive measures against fraud, corruption and
Executive Director and the operation of the Group shall be
any other illegal activities, by effective checks and, if irregu
specified in the Agency’s internal rules of operation and shall
larities are detected, by the recovery of the amounts
be made public.
wrongly paid and, where appropriate, by effective, propor
tionate and dissuasive administrative and financial penalties;
3. The
Permanent
Stakeholders’
Group
shall
be
chaired
by
the Executive Director or by any person the Executive Director
(h) preparing an anti-fraud strategy for the Agency and pres
appoints on a case-by-case basis.
enting it to the Management Board for approval;
4. The term of office of the Permanent Stakeholders’ Group’s
(i) ensuring that the Agency performs its activities in
members shall be two-and-a-half years. Members of the
accordance with the requirements of those using its
Management Board may not be members of the Permanent
services, in particular with regard to the adequacy of the
Stakeholders’ Group. Experts from the Commission and the
services provided;
Member States shall be entitled to be present at the meetings
of the Permanent Stakeholders’ Group and to participate in its
work. Representatives of other bodies deemed relevant by the
Executive Director, who are not members of the Permanent
(j) developing and maintaining contact with the Union institu
Stakeholders’ Group, may be invited to be present at the
tions, bodies, offices and agencies;
meetings of the Permanent Stakeholders’ Group and to
participate in its work.
(k) developing and maintaining contact with the business
community and consumers’ organisations to ensure
regular dialogue with relevant stakeholders;
5. The
Permanent
Stakeholders’
Group
shall
advise
the
Agency in respect of the performance of its activities. It shall
in particular advise the Executive Director on drawing up a
proposal for the Agency’s work programme, and on ensuring
(l) other tasks assigned to the Executive Director by this Regu
communication with the relevant stakeholders on all issues
lation.
related to the work programme.

---

EN
18.6.2013 Official
Journal
of
the
European
Union L
165/53
SECTION 3
2. Requests
referred
to
in
paragraph
1
may
be
made
by:
OPERATION
Article 13
(a) the European Parliament;
Work Programme
1. The
Agency
shall
carry
out
its
operations
in
accordance (b) the Council;
with its annual and multiannual work programme, which shall
contain all of its planned activities.
(c) the Commission;
2. The
work
programme
shall
include
tailored
performance
indicators allowing for effective assessment of the results
(d) any competent body appointed by a Member State, such as
achieved in terms of objectives.
a national regulatory authority defined in Article 2 of
Directive 2002/21/EC.
3. The
Executive
Director
shall
be
responsible
for
drawing
up 3. The
practical
arrangements
for
applying
paragraphs
1
and
the Agency’s draft work programme after prior consultation
2, regarding in particular submission, prioritisation, follow-up
with the Commission services. By 15 March each year the
and information to the Management and Executive Board on
Executive Director shall submit the draft work programme for
the requests to the Agency, shall be laid down by the
the following year to the Management Board.
Management Board in the Agency’s internal rules of operation.
Article 15
4. By
30
November
each
year,
the
Management
Board
shall
adopt the Agency’s work programme for the following year,
Declaration of interest
after having received the opinion of the Commission. The
work programme shall include a multiannual outlook. The
1. Members of the Management Board, the Executive
Management Board shall ensure that the work programme is
Director and officials seconded by Member States on a
consistent with the Agency’s objectives and with the Union’s
temporary basis shall each make a declaration of commitments
legislative and policy priorities in the area of network and
and a declaration indicating the absence or presence of any
information security.
direct or indirect interest which might be considered prejudicial
to their independence. The declarations shall be accurate and
complete, made annually in writing and updated whenever
necessary.
5. The
work
programme
shall
be
organised
in
accordance
with the activity-based management principle. The work
programme shall be in line with the statement of estimates of
2. Members of the Management Board, the Executive
the Agency’s revenue and expenditure and the Agency’s budget
Director, and external experts participating in ad hoc Working
for the same financial year.
Groups shall each accurately and completely declare, at the
latest at the start of each meeting, any interest which might
be considered prejudicial to their independence in relation to
the items on the agenda, and shall abstain from participating in
6. The
Executive
Director
shall,
following
adoption
by
the the discussion of and voting upon such points.
Management Board, forward the work programme to the
European Parliament, the Council, the Commission and the
Member States and shall publish it. At the invitation of the
3. The
Agency
shall
lay
down,
in
its
internal
rules
of
oper
relevant committee of the European Parliament, the Executive
ation, the practical arrangements for the rules on declarations of
Director shall present and hold an exchange of views on the
interest referred to in paragraphs 1 and 2.
adopted annual work programme.
Article 16
Article 14
Transparency
Requests to the Agency
1. The Agency shall ensure that it carries out its activities
1. Requests
for
advice
and
assistance
falling
within
the with a high level of transparency and in accordance with
Agency’s objectives and tasks shall be addressed to the
Articles 17 and 18.
Executive Director and accompanied by background
information explaining the issue to be addressed. The
Executive Director shall inform the Management Board and
2. The
Agency
shall
ensure
that
the
public
and
any
interested
Executive Board of the requests received, the potential
parties are given appropriate, objective, reliable and easily
resource implications, and, in due course, of the follow-up to
accessible information, in particular with regard to the results
the requests. If the Agency refuses a request, it shall give a
of its work. It shall also make public the declarations of interest
justification.
made in accordance with Article 15.

---

L 165/54
EN
Official Journal of the European Union
18.6.2013
3. The Management Board, acting on a proposal from the
complaint to the Ombudsman under Article 228 TFEU or of an
Executive Director, may authorise interested parties to observe
action before the Court of Justice of the European Union under
the proceedings of some of the Agency’s activities.
Article 263 TFEU.
4. The
Agency
shall
lay
down,
in
its
internal
rules
of
oper
SECTION 4
ation, the practical arrangements for implementing the trans
FINANCIAL PROVISIONS
parency rules referred to in paragraphs 1 and 2.
Article 19
Adoption of the budget
Article 17
1. The revenues of the Agency shall consist of a contribution
Confidentiality
from the Union budget, contributions from third countries
participating in the work of the Agency as provided for in
1. Without
prejudice
to
Article
18,
the
Agency
shall
not Article 30, and voluntary contributions from Member States
divulge to third parties information that it processes or
in money or in kind. Member States that provide voluntary
receives in relation to which a reasoned request for confidential
contributions may not claim any specific right or service as a
treatment, in whole or in part, has been made.
result thereof.
2. Members
of
the
Management
Board,
the
Executive 2. The
expenditure
of
the
Agency
shall
include
staff,
adminis
Director, the members of the Permanent Stakeholders Group,
trative and technical support, infrastructure and operational
external experts participating in ad hoc Working Groups, and
expenses, and expenses resulting from contracts entered into
members of the staff of the Agency including officials seconded
with third parties.
by Member States on a temporary basis shall comply with the
confidentiality requirements under Article 339 of the Treaty on
the Functioning of the European Union (TFEU), even after their
3. By
1
March
each
year,
the
Executive
Director
shall
draw
duties have ceased.
up a draft statement of estimates of the Agency’s revenue and
expenditure for the following financial year, and shall forward it
to the Management Board, together with a draft establishment
plan.
3. The
Agency
shall
lay
down,
in
its
internal
rules
of
oper
ation, the practical arrangements for implementing the
confidentiality rules referred to in paragraphs 1 and 2.
4. Revenue
and
expenditure
shall
be
in
balance.
4. If
required
for
the
performance
of
the
Agency’s
tasks,
the 5. Each year, the Management Board shall, on the basis of a
Management Board shall decide to allow the Agency to handle
draft statement of estimates of revenue and expenditure drawn
classified information. In that case the Management Board shall,
up by the Executive Director, produce a statement of estimates
in agreement with the Commission services, adopt internal rules
of revenue and expenditure for the Agency for the following
of operation applying the security principles set out in
financial year.
Commission Decision 2001/844/EC, ECSC, Euratom of
29 November 2001 amending its internal rules of procedure ( 1 ).
Those rules shall cover, inter alia, provisions for the exchange,
6. The
Management
Board
shall,
by
31
March
each
year,
processing and storage of classified information.
send that statement of estimates, which shall include a draft
establishment plan together with the draft work programme,
to the Commission and the third countries with which the
Union has concluded agreements in accordance with Article 30.
Article 18
Access to documents
7. The
Commission
shall
forward
that
statement
of
estimates
1. Regulation
(EC)
No
1049/2001
shall
apply
to
documents to the European Parliament and the Council together with the
held by the Agency.
draft general budget of the Union.
2. The
Management
Board
shall
adopt
arrangements
for 8. On the basis of that statement of estimates, the
implementing Regulation (EC) No
1049/2001 within six
Commission shall enter in the draft budget of the Union the
months of the establishment of the Agency.
estimates it deems necessary for the establishment plan and the
amount of the subsidy to be charged to the general budget,
which it shall submit to the European Parliament and the
Council in accordance with Article 314 TFEU.
3. Decisions
taken
by
the
Agency
pursuant
to
Article
8
of
Regulation (EC) No 1049/2001 may be the subject of a
9. The
European
Parliament
and
the
Council
shall
authorise
( 1 ) OJ L 317, 3.12.2001, p. 1.
the appropriations for the subsidy to the Agency.

---

EN
18.6.2013 Official
Journal
of
the
European
Union L
165/55
10. The
European
Parliament
and
the
Council
shall
adopt
the shall contain provisions expressly empowering the Court of
establishment plan for the Agency.
Auditors and OLAF to conduct such audits and investigations,
according to their respective competences.
11. Together with the work programme, the Management
Article 21
Board shall adopt the Agency’s budget. It shall become final
following definitive adoption of the general budget of the
Implementation of the budget
Union. Where appropriate, the Management Board shall adjust
the Agency’s budget and work programme in accordance with
1. The
Executive
Director
shall
be
responsible
for
the
imple
the general budget of the Union. The Management Board shall
mentation of the Agency’s budget.
forward the budget without delay to the European Parliament,
the Council and the Commission.
2. The
Commission’s
internal
auditor
shall
exercise
the
same
powers over the Agency as over Commission departments.
Article 20
Combating fraud
3. By
1
March
following
each
financial
year
(1
March
of
year
1. In
order
to
facilitate
the
combating
of
fraud,
corruption N +
1), the Agency’s accounting officer shall send the
and other unlawful activities under Regulation (EC)
provisional accounts to the Commission’s accounting officer
No 1073/1999 (
together with a report on the budgetary and financial

1 ), the Agency shall, within six months from
the day it becomes operational, accede to the Interinstitutional
management for that financial year. The Commission’s
Agreement of 25 May 1999 concerning internal investigations
accounting officer shall consolidate the provisional accounts
by the European Anti-fraud Office (OLAF) (
of the institutions and decentralised bodies in accordance with

2 ) and shall adopt
the appropriate provisions applicable to all the employees of the
Article 147 of the Financial Regulation.
Agency, using the template set out in the Annex to that
Agreement.
4. By
31
March
of
year
N
+
1,
the
Commission’s
accounting
officer shall send the Agency’s provisional accounts to the Court
of Auditors, together with a report on the budgetary and
2. The Court of Auditors shall have the power of audit, on
financial management for that financial year. The report on
the basis of documents and on the spot, over all grant bene
the budgetary and financial management for the financial year
ficiaries, contractors and subcontractors who have received
shall also be sent to the European Parliament and the Council.
Union funds from the Agency.
5. On receipt of the Court of Auditor’s observations on the
Agency’s provisional accounts, pursuant to Article 148 of the
3. OLAF
may
carry
out
investigations,
including
on-the-spot Financial Regulation, the Executive Director shall draw up the
checks and inspections, in accordance with the provisions and
Agency’s final accounts under his/her own responsibility and
procedures laid down in Regulation (EC) No 1073/1999 and
send them to the Management Board for an opinion.
Council Regulation (Euratom, EC) No 2185/96 of 11 November
1996 concerning on-the-spot checks and inspections carried out
by the Commission in order to protect the European Commun
ities’ financial interests against fraud and other irregularities ( 3 )
6. The
Management
Board
shall
deliver
an
opinion
on
the
with a view to establishing whether there has been fraud,
Agency’s final accounts.
corruption or any other illegal activity affecting the financial
interests of the Union in connection with a grant or a
contract funded by the Agency.
7. The
Executive
Director
shall,
by
1
July
of
year
N
+
1,
transmit the final accounts, including the report on the
budgetary and financial management for that financial year
and the Court of Auditor’s observations, to the European
4. Without
prejudice
to
paragraphs
1,
2
and
3,
cooperation Parliament, the Council, the Commission and the Court of
agreements with third countries and international organisations,
Auditors, together with the Management Board’s opinion.
contracts, grant agreements and grant decisions of the Agency
( 1 ) Regulation (EC) No 1073/1999 of the European Parliament and of
the Council of 25 May 1999 concerning investigations conducted by
8. The
Executive
Director
shall
publish
the
final
accounts.
the European Anti-Fraud Office (OLAF) (OJ L 136, 31.5.1999, p. 1).
( 2 ) Interinstitutional Agreement of 25 May 1999 between the European
Parliament, the Council of the European Union and the Commission
of the European Communities concerning internal investigations by
9. The
Executive
Director
shall
send
the
Court
of
Auditors
a
the European Anti-fraud Office (OLAF) (OJ L 136, 31.5.1999,
p. 15).
reply to its observations by 30 September of year N + 1 and
( 3 ) OJ L 292, 15.11.1996, p. 2.
shall also send to the Management Board a copy of that reply.

---

L 165/56
EN
Official Journal of the European Union
18.6.2013
10. The
Executive
Director
shall
submit
to
the
European 4. The Management Board may, acting on a proposal from
Parliament, at the latter’s request, all the information
the Commission which takes into account the assessment
necessary for the smooth application of the discharge
referred to in paragraph 3 and after obtaining the views of
procedure for the financial year in question, as laid down in
the European Parliament, extend once the term of office of
Article 165(3) of the Financial Regulation.
the Executive Director for no more than five years.
11. The European Parliament, acting on a recommendation
5. The
Management
Board
shall
inform
the
European
from the Council, shall, before 15 May of year N + 2, give a
Parliament about its intention to extend the Executive Director’s
discharge to the Executive Director in respect of the implemen
term of office. Within three months before any such extension,
tation of the budget for the year N.
the Executive Director shall, if invited, make a statement before
the relevant committee of the European Parliament and answer
Members’ questions.
SECTION 5
STAFF
6. An
Executive
Director
whose
term
of
office
has
been
Article 22
extended may not participate in another selection procedure
General provisions
for the same post.
The Staff Regulations and the Conditions of Employment of
Other Servants and the rules adopted by agreement between
the Union institutions for giving effect to those Staff Regu
7. The
Executive
Director
may
be
removed
from
office
only
lations shall apply to the staff of the Agency.
by decision of the Management Board.
Article 23
Article 25
Privileges and immunity
Seconded national experts and other staff
Protocol No 7 on the Privileges and Immunities of the European
1. The
Agency
may
make
use
of
seconded
national
experts
Union annexed to the Treaty on European Union and to the
or other staff not employed by the Agency. The Staff Regu
TFEU shall apply to the Agency and its staff.
lations and the Conditions of Employment of Other Servants
shall not apply to such staff.
Article 24
Executive Director
2. The
Management
Board
shall
adopt
a
decision
laying
down rules on the secondment to the agency of national
1. The
Executive
Director
shall
be
engaged
as
a
temporary experts.
agent of the Agency under Article 2(a) of the Conditions of
Employment of Other Servants.
SECTION 6
2. The
Executive
Director
shall
be
appointed
by
the
GENERAL PROVISIONS
Management Board from a list of candidates proposed by the
Commission, following an open and transparent selection
Article 26
procedure.
Legal status
1. The Agency shall be a body of the Union. It shall have
For the purpose of concluding the contract of the Executive
legal personality.
Director, the Agency shall be represented by the Chairperson
of the Management Board.
2. In each of the Member States the Agency shall enjoy the
most extensive legal capacity accorded to legal persons under
Before appointment, the candidate selected by the Management
their laws. It may, in particular, acquire and dispose of movable
Board shall be invited to make a statement before the relevant
and immovable property and be a party to legal proceedings.
committee of the European Parliament and to answer Members’
questions.
3. The
Agency
shall
be
represented
by
its
Executive
Director.
3. The term of office of the Executive Director shall be five
years. By the end of that period, the Commission shall
undertake an assessment which takes into account the
4. A
branch
office
established
in
the
metropolitan
area
of
evaluation of the performance of the Executive Director and
Athens shall be maintained in order to improve the operational
the Agency’s future tasks and challenges.
efficiency of the Agency.

---

EN
18.6.2013 Official
Journal
of
the
European
Union L
165/57
Article 27
Article 30
Liability
Participation of third countries
1. The
contractual
liability
of
the
Agency
shall
be
governed 1. The
Agency
shall
be
open
to
the
participation
of
third
by the law applicable to the contract in question.
countries which have concluded agreements with the
European Union by virtue of which they have adopted and
applied Union legal acts in the field covered by this Regulation.
The Court of Justice of the European Union shall have juris
diction to give judgment pursuant to any arbitration clause
contained in a contract concluded by the Agency.
2. Arrangements
shall
be
made
under
the
relevant
provisions
of those agreements, specifying in particular the nature, extent
and manner in which those countries will participate in the
2. In
the
case
of
non-contractual
liability,
the
Agency
shall, Agency’s work, including provisions relating to participation
in accordance with the general principles common to the laws
in the initiatives undertaken by the Agency, financial
of the Member States, make good any damage caused by it or
contributions and staff.
its servants in the performance of their duties.
Article 31
The Court of Justice of the European Union shall have juris
Security Rules on the protection of classified information
diction in any dispute relating to compensation for such
damage.
The Agency shall apply the security principles contained in the
Commission’s security rules for protecting European Union
Classified Information (EUCI) and sensitive non-classified
information, as set out in the Annex to Decision 2001/844/EC,
3. The
personal
liability
of
its
servants
towards
the
Agency ECSC, Euratom. This shall cover, inter alia, provisions for the
shall be governed by the relevant conditions applying to the
exchange, processing and storage of such information.
staff of the Agency.
Article 28
SECTION 7
Languages
FINAL PROVISIONS
1. Regulation
No
1
of
15
April
1958
determining
the
Article 32
languages to be used in the European Economic Community ( 1 )
Evaluation and review
shall apply to the Agency. The Member States and the other
bodies appointed by them may address the Agency and receive
1. By
20
June
2018
the
Commission
shall
commission
an
a reply in the official language of the institutions of the Union
evaluation to assess, in particular, the impact, effectiveness and
of their choice.
efficiency of the Agency and its working practices. The
evaluation shall also address the possible need to modify the
mandate of the Agency and the financial implications of any
such modification.
2. The
translation
services
required
for
the
functioning
of
the
Agency shall be provided by the Translation Centre for the
Bodies of the European Union.
2. The
evaluation
referred
to
in
paragraph
1
shall
take
into
account any feedback made to the Agency in response to its
activities.
Article 29
Protection of personal data
1. When
processing
data
relating
to
individuals,
in
particular 3. The
Commission
shall
forward
the
evaluation
report
while performing its tasks, the Agency shall observe the prin
together with its conclusions to the European Parliament, the
ciples of personal data protection in, and be subject to, the
Council and the Management Board. The findings of the
provisions of Regulation (EC) No 45/2001.
evaluation shall be made public.
2. The Management Board shall adopt implementing 4. As
part
of
the
evaluation,
there
shall
also
be
an
measures referred to in Article 24(8) of Regulation (EC)
assessment of the results achieved by the Agency, having
No 45/2001. The Management Board may adopt additional
regard to its objectives, mandate and tasks. If the Commission
measures necessary for the application of Regulation (EC)
considers that the continuation of the Agency is justified with
No 45/2001 by the Agency.
regard to its assigned objectives, mandate and tasks, it may
propose that the duration of the mandate of the Agency set
( 1 ) OJ 17, 6.10.1958, p. 385/58.
out in Article 36 be extended.

---

L 165/58
EN
Official Journal of the European Union
18.6.2013
Article 33
References to Regulation (EC) No 460/2004 and to ENISA shall
be construed as references to this Regulation and to the Agency.
Cooperation of the host Member State
The Agency’s host Member State shall provide the best possible
conditions to ensure the proper functioning of the Agency,
2. The Agency succeeds the Agency that was established by
including the accessibility of the location, the existence of
Regulation (EC) No 460/2004 as regards all ownership, agree
adequate education facilities for the children of staff members,
ments, legal obligations, employment contracts, financial
appropriate access to the labour market, social security and
commitments and liabilities.
medical care for both children and spouses.
Article 36
Article 34
Duration
Administrative control
The Agency shall be established for a period of seven years
The operations of the Agency shall be supervised by the
from 19 June 2013.
Ombudsman in accordance with Article 228 TFEU.
Article 37
Article 35
Entry into force
Repeal and succession
This Regulation shall enter into force on the day following that
1. Regulation
(EC)
No
460/2004
is
repealed.
of its publication in the Official Journal of the European Union.
This Regulation shall be binding in its entirety and directly applicable in all Member States.
Done at Strasbourg, 21 May 2013.
For the European Parliament
For the Council
The President
The President
M. SCHULZ
L. CREIGHTON

---

Document Outline

• �

---