THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union [OJ L 194, 19.7.2016, p. 1.], and in particular Article 16(8) thereof,

Whereas:

(1) In accordance with Directive (EU) 2016/1148, RDSPs remain free to take technical and organisational measures they consider appropriate and proportionate to manage the risk posed to the security of their network and information systems, as long as those measures ensure an appropriate level of security and take into account the elements provided for in that Directive.

(2) When identifying the appropriate and proportionate technical and organisational measures, the RDSP should approach information security in a systematic way, using a risk-based approach.

(3) In order to ensure the security of systems and facilities, RDSPs should perform assessment and analysis procedures. These activities should concern the systematic management of network and information systems, the physical and environmental security, the security of supplies and the access controls.