The EU Critical Entities Resilience (CER) Directive has moved into its implementation phase following the ending of the one-month window for Member States to notify critical entities.
Member States were required to identify critical entities by 17 July 2026 and notify them within one month. Once notified, entities have nine months to complete an organization-specific risk assessment, while the Directive’s resilience duties apply after ten months.
At the centre of the regime is an all-hazards approach. Critical entities must put in place and apply a resilience plan, or equivalent documents, covering natural and human-caused threats, accidents, public-health emergencies, hostile and hybrid threats, and cross-sector and cross-border dependencies.
Required measures extend across prevention, climate adaptation, physical protection, crisis response and mitigation, business continuity, recovery, alternative supply chains, employee security, training, awareness and exercises. The result should be an integrated resilience capability rather than a collection of isolated emergency, security and continuity plans.
Resilience Forward comment
The all-hazards approach that EU critical entities are required to take to resilience under the CER is worth considering for all organizations.
Identifying essential services, mapping dependencies, assessing disruption risks and joining existing plans into a coherent resilience framework can expose gaps, reduce fragmented investment, and improve decision-making during incidents.
An all-hazards approach to resilience would include:
- Essential services and outcomes – identify what must be maintained or restored.
- Governance and accountability – define ownership, decision-making authority and oversight.
- Comprehensive risk assessment – consider natural, accidental, technological, malicious, public-health and climate-related threats.
- Impact assessment – understand the potential severity, duration and scale of disruption.
- Dependency mapping – identify reliance on people, premises, technology, information, utilities, suppliers and other sectors.
- Prevention and risk reduction – reduce the likelihood of incidents occurring.
- Protective measures – safeguard physical assets, personnel, information and systems.
- Detection and warning – establish monitoring, escalation triggers and alerting procedures.
- Preparedness and contingency arrangements – develop alternative operating methods, capacity, locations and supply chains.
- Incident and crisis response – establish command, coordination and decision-making arrangements.
- Business continuity – sustain priority activities and essential-service delivery during disruption.
- Recovery and restoration – restore services safely and in an appropriate order.
- Communication and stakeholder coordination – support timely internal, public, regulatory and partner communications.
- People and competence – identify critical roles and provide appropriate training, awareness and support.
- Exercises and testing – validate plans, assumptions, dependencies and decision-making.
- Assurance and performance monitoring – verify that measures are implemented and effective.
- Learning and adaptation – capture lessons from incidents and exercises and use them to improve arrangements.
The key principle is that all-hazards planning develops common capabilities for managing disruption, with hazard-specific arrangements added only where necessary.
