Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection (Text with EEA relevance) (c. 114)

ANNEX I U.K. List of ECI sectors

Sector	Subsector
I Energy	1. Electricity	Infrastructures and facilities for generation and transmission of electricity in respect of supply electricity
	2. Oil	Oil production, refining, treatment, storage and transmission by pipelines
	3. Gas	Gas production, refining, treatment, storage and transmission by pipelines LNG terminals
II Transport	4. Road transport
	5. Rail transport
	6. Air transport
	7. Inland waterways transport
	8. Ocean and short-sea shipping and ports

The identification by the Member States of critical infrastructures which may be designated as ECIs is undertaken pursuant to Article 3. Therefore the list of ECI sectors in itself does not generate a generic obligation to designate an ECI in each sector.

ANNEX II U.K. ECI OSP PROCEDURE

The OSP will identify critical infrastructure assets and which security solutions exist or are being implemented for their protection. The ECI OSP procedure will cover at least:

1.

identification of important assets;

2.

conducting a risk analysis based on major threat scenarios, vulnerability of each asset, and potential impact; and

3.

identification, selection and prioritisation of counter-measures and procedures with a distinction between:

• permanent security measures, which identify indispensable security investments and means which are relevant to be employed at all times. This heading will include information concerning general measures such as technical measures (including installation of detection, access control, protection and prevention means); organisational measures (including procedures for alerts and crisis management); control and verification measures; communication; awareness raising and training; and security of information systems,

• graduated security measures, which can be activated according to varying risk and threat levels.

ANNEX III U.K. Procedure for the identification by the Member States of critical infrastructures which may be designated as an ECI pursuant to Article 3

Article 3 requires each Member State to identify the critical infrastructures which may be designated as an ECI. This procedure shall be implemented by each Member State through the following series of consecutive steps.

A potential ECI which does not satisfy the requirements of one of the following sequential steps is considered to be ‘non-ECI’ and is excluded from the procedure. A potential ECI which does satisfy the requirements shall be subjected to the next steps of this procedure.

Step 1 U.K.

Each Member State shall apply the sectoral criteria in order to make a first selection of critical infrastructures within a sector.

Step 2 U.K.

Each Member State shall apply the definition of critical infrastructure pursuant to Article 2(a) to the potential ECI identified under step 1.

The significance of the impact will be determined either by using national methods for identifying critical infrastructures or with reference to the cross-cutting criteria, at an appropriate national level. For infrastructure providing an essential service, the availability of alternatives, and the duration of disruption/recovery will be taken into account.

Step 3 U.K.

Each Member State shall apply the transboundary element of the definition of ECI pursuant to Article 2(b) to the potential ECI that has passed the first two steps of this procedure. A potential ECI which does satisfy the definition will follow the next step of the procedure. For infrastructure providing an essential service, the availability of alternatives, and the duration of disruption/recovery will be taken into account.

Step 4 U.K.

Each Member State shall apply the cross-cutting criteria to the remaining potential ECIs. The cross-cutting criteria shall take into account: the severity of impact; and, for infrastructure providing an essential service, the availability of alternatives; and the duration of disruption/recovery. A potential ECI which does not satisfy the cross-cutting criteria will not be considered to be an ECI.

A potential ECI which has passed through this procedure shall only be communicated to the Member States which may be significantly affected by the potential ECI.