For years, the protection of critical infrastructure has been addressed primarily as a matter of physical security: identifying strategic assets, protecting them from hostile incidents, and reducing their vulnerability. The new European framework takes a broader perspective. It focuses not only on the integrity of the infrastructure but also on the ability to continue providing essential services even when an incident affects part of it. This is the change introduced by Directive (EU) 2022/2557 on the resilience of critical entities, known as the CER Directive. The directive defines resilience as the ability to prevent an incident, protect against it, respond to it, withstand it, mitigate its consequences, absorb it, adapt to it, and recover from it. In Italy, the directive has been transposed by the Legislative Decree No. […], dated September 4, 2024 134, whose provisions take effect on October 18, 2024. The decree refers to “critical entities” and links resilience to services that are essential to society, the economy, healthcare, public safety, and the environment. For those involved in resilience, this is the most interesting aspect: the focus shifts from the protection of resources to an organization’s ability to maintain its critical functions.

A true “all-hazards” approach

Risk assessment must take into account the full spectrum of events that could compromise an essential service: natural disasters, man-made events, public health emergencies, hybrid threats, cross-border events, and other hostile threats. The approach is therefore explicitly “all-hazards” and goes beyond a plan designed for a single scenario. For a Resilience Manager, this means shifting the focus from the cause of the incident to its operational consequences. There is no need for a separate plan for every possible event. What is needed is to understand which functions must be maintained, which resources are truly indispensable, which dependencies can be eliminated, and which capabilities enable operations to continue under adverse conditions.

Interdependencies are factored into the risk assessment

Perhaps the most interesting change concerns interdependencies. In risk assessment (Article 12 of the directive), the critical entity cannot limit itself to what happens within its own perimeter. It must consider the extent to which other sectors depend on the service it provides and the extent to which it itself depends on essential services in other sectors, including those in neighboring Member States. This is a legal recognition of an obvious reality. An electric grid depends on telecommunications and digital systems. Telecommunications depend on energy. Transportation depends on energy, communications, and information systems. Hospitals depend on electricity, water, telecommunications, supplies, and transportation. A local failure can quickly spread to other systems. A methodological clarification: The regulation does not mention “second- and third-level” dependencies. To respond seriously to that requirement, however, stopping at the first level is rarely sufficient. This is a conclusion based on best practices, not a legal obligation.

From an Emergency Plan to a Resilience Plan

The decree requires critical entities to adopt appropriate and proportionate technical, security, and organizational measures. These measures cover incident prevention, physical protection, response and mitigation (including crisis management), recovery, business continuity, and the identification of alternative supply chains to restore essential services. The critical entity must prepare a resilience plan describing the measures adopted and update it as necessary, and in any case, at least every three years. It is not mandatory to draft a new, separate document: the directive refers to a plan or “equivalent document,” so crisis plans, security plans, recovery plans, or other documents may be used, provided they meet the requirements. This is a pragmatic approach. Resilience does not come from a proliferation of plans, but from the ability to integrate existing ones and assess their effectiveness as a whole.

Resilience also applies to people

The measures must take into account personnel, critical functions, external parties performing relevant activities, access criteria, background checks for sensitive roles, training, and awareness-raising. This is yet another sign: resilience is now a well-rounded organizational capability. An infrastructure may be technically intact but still fail to provide service if there is a shortage of staff, if crisis roles are unclear, if crucial skills are concentrated in just a few people, or if those responsible for responding are not properly trained. People, processes, technology, facilities, and suppliers are all components of a single system.

CER and NIS2: The Line Between the Physical and Digital Worlds Is Blurring

The CER Directive was developed in parallel with NIS2, which focuses on cybersecurity, and this decision reflects another transformation: critical infrastructure is becoming increasingly cyber-physical. A power plant, a water system, a port, or a rail network depends as much on digital systems as it does on physical components. A cyberattack can have both operational and physical consequences, while a fire, a flood, or a power outage can compromise IT and telecommunications systems. In Italy, NIS2 was transposed by Legislative Decree 138/2024 and the CER by Legislative Decree 134/2024, both adopted on the same day. They have different objectives but are complementary: entities identified as critical under the CER are also considered essential entities for the purposes of NIS2. From an operational standpoint, the regulatory distinction should not lead to an organizational separation. In a crisis, the cause may be cyber-based or physical, but the question remains the same: which services are affected, which dependencies are involved, and what capabilities must be mobilized to maintain essential functions?