1.
1The Cooperation Group shall, on 17 January 2025, establish, with the assistance of the Commission and ENISA, and, where relevant, the CSIRTs network, the methodology and organisational aspects of peer reviews with a view to learning from shared experiences, strengthening mutual trust, achieving a high common level of cybersecurity, as well as enhancing Member States’ cybersecurity capabilities and policies necessary to implement this Directive. 2Participation in peer reviews is voluntary. 3The peer reviews shall be carried out by cybersecurity experts. 4The cybersecurity experts shall be designated by at least two Member States, different from the Member State being reviewed.
5The peer reviews shall cover at least one of the following:
(a)
the level of implementation of the cybersecurity risk-management measures and reporting obligations laid down in Articles 21 and 23;
(b)
the level of capabilities, including the available financial, technical and human resources, and the effectiveness of the exercise of the tasks of the competent authorities;
(c)
the operational capabilities of the CSIRTs;
(d)
the level of implementation of mutual assistance referred to in Article 37;
(e)
the level of implementation of the cybersecurity information-sharing arrangements referred to in Article 29;
(f)
specific issues of cross-border or cross-sector nature.
2.
1The methodology referred to in paragraph 1 shall include objective, non-discriminatory, fair and transparent criteria on the basis of which the Member States designate cybersecurity experts eligible to carry out the peer reviews. 2The Commission and ENISA shall participate as observers in the peer reviews.
3.
Member States may identify specific issues as referred to in paragraph 1, point (f), for the purposes of a peer review.
4.
Before commencing a peer review as referred to in paragraph 1, Member States shall notify the participating Member States of its scope, including the specific issues identified pursuant to paragraph 3.
5.
1Prior to the commencement of the peer review, Member States may carry out a self-assessment of the reviewed aspects and provide that self-assessment to the designated cybersecurity experts. 2The Cooperation Group shall, with the assistance of the Commission and ENISA, lay down the methodology for the Member States’ self-assessment.
6.
1Peer reviews shall entail physical or virtual on-site visits and off-site exchanges of information. 2In line with the principle of good cooperation, the Member State subject to the peer review shall provide the designated cybersecurity experts with the information necessary for the assessment, without prejudice to Union or national law concerning the protection of confidential or classified information and to the safeguarding of essential State functions, such as national security. 3The Cooperation Group, in cooperation with the Commission and ENISA, shall develop appropriate codes of conduct underpinning the working methods of designated cybersecurity experts. 4Any information obtained through the peer review shall be used solely for that purpose. 5The cybersecurity experts participating in the peer review shall not disclose any sensitive or confidential information obtained in the course of that peer review to any third parties.
7.
Once subject to a peer review, the same aspects reviewed in a Member State shall not be subject to a further peer review in that Member State for two years following the conclusion of the peer review, unless otherwise requested by the Member State or agreed upon after a proposal of the Cooperation Group.
8.
1Member States shall ensure that any risk of conflict of interest concerning the designated cybersecurity experts is revealed to the other Member States, the Cooperation Group, the Commission and ENISA, before the commencement of the peer review. 2The Member State subject to the peer review may object to the designation of particular cybersecurity experts on duly substantiated grounds communicated to the designating Member State.
9.
1Cybersecurity experts participating in peer reviews shall draft reports on the findings and conclusions of the peer reviews. 2Member States subject to a peer review may provide comments on the draft reports concerning them and such comments shall be attached to the reports. 3The reports shall include recommendations to enable improvement on the aspects covered by the peer review. 4The reports shall be submitted to the Cooperation Group and the CSIRTs network where relevant. 5A Member State subject to the peer review may decide to make its report, or a redacted version of it, publicly available.
