ANNEX IIIU.K.Procedure for the identification by the Member States of critical infrastructures which may be designated as an ECI pursuant to Article 3
Article 3 requires each Member State to identify the critical infrastructures which may be designated as an ECI. This procedure shall be implemented by each Member State through the following series of consecutive steps.
A potential ECI which does not satisfy the requirements of one of the following sequential steps is considered to be ‘non-ECI’ and is excluded from the procedure. A potential ECI which does satisfy the requirements shall be subjected to the next steps of this procedure.
Step 1U.K.
Each Member State shall apply the sectoral criteria in order to make a first selection of critical infrastructures within a sector.
Step 2U.K.
Each Member State shall apply the definition of critical infrastructure pursuant to Article 2(a) to the potential ECI identified under step 1.
The significance of the impact will be determined either by using national methods for identifying critical infrastructures or with reference to the cross-cutting criteria, at an appropriate national level. For infrastructure providing an essential service, the availability of alternatives, and the duration of disruption/recovery will be taken into account.
Step 3U.K.
Each Member State shall apply the transboundary element of the definition of ECI pursuant to Article 2(b) to the potential ECI that has passed the first two steps of this procedure. A potential ECI which does satisfy the definition will follow the next step of the procedure. For infrastructure providing an essential service, the availability of alternatives, and the duration of disruption/recovery will be taken into account.
Step 4U.K.
Each Member State shall apply the cross-cutting criteria to the remaining potential ECIs. The cross-cutting criteria shall take into account: the severity of impact; and, for infrastructure providing an essential service, the availability of alternatives; and the duration of disruption/recovery. A potential ECI which does not satisfy the cross-cutting criteria will not be considered to be an ECI.
A potential ECI which has passed through this procedure shall only be communicated to the Member States which may be significantly affected by the potential ECI.