Critical Entities Resilience Directive

What the directive is for

The Critical Entities Resilience Directive is an EU resilience law for organisations that provide essential services. It creates a common baseline for identifying critical entities, assigning responsibility, and keeping vital functions operating when disruption hits.

Its purpose is broader than narrow cyber compliance. The directive is about whether essential services can continue through disruption from cyber incidents, physical events, supplier failure, human error, and other hazards that can interrupt continuity.

Scope and who it affects

The directive focuses on critical entities, meaning organisations whose services are important enough that their failure would create wider societal or economic harm. In practice, this usually means operators of essential services, infrastructure owners, and other entities that sit in the continuity path for public safety, energy, transport, health, finance, digital services, or similar sectors.

That scope matters because the law is entity-based, not just technology-based. A business may have strong IT controls and still fall short if it has not properly identified which services, sites, dependencies, and supporting suppliers are essential to continuity.

For a sector-by-sector view of how this sits alongside other critical infrastructure rules, see the Critical Infrastructure Regulation Map.

What resilience means under CER

Under CER, resilience is not a slogan, it is an operating requirement. Organisations are expected to understand their critical functions, assess the risks that can disrupt them, and maintain proportionate protective, continuity, and recovery measures that are credible under real-world pressure.

That typically includes governance for risk assessment, business continuity planning, incident reporting, crisis response, and recovery arrangements. The point is to reduce the chance that a single failure, dependency, or disruption cascades into prolonged service outage.

Because the directive is designed for essential services, the practical question is always whether the organisation can still deliver the vital function, not whether a control exists on paper. That is why the directive pushes entities to connect policy, operations, suppliers, and recovery into one resilience model.

CER and related EU resilience rules

CER often sits beside other EU obligations rather than replacing them. Many organisations will need to think about how CER, NIS2, sector-specific supervision, and incident reporting duties interact, especially where the same essential service is exposed to both operational disruption and cyber risk.

The overlap can be useful, but it also creates coordination work. One regime may focus on cybersecurity controls, while CER focuses on broader service resilience, continuity, and all-hazards disruption. A mature programme should treat them as complementary parts of the same operational defence picture.

The EU NIS2 Directive is a useful comparison point because many of the same essential-service operators must reconcile cyber incident handling with wider resilience expectations. For organisations with strong dependency on vendors, continuity testing, and service restoration planning, the EU Digital Operational Resilience Act (DORA) shows how sector resilience law can formalise testing, third-party risk, and incident discipline.

Risk and Threat Considerations

Critical entities are exposed to disruption risk, not just breach risk. A weak continuity plan, an untested dependency, or a supplier outage can disable an essential function as effectively as a direct attack, and the impact can extend beyond the organisation to the public and to other infrastructure that depends on it.

Failure mechanism: Resilience fails when critical services, dependencies, recovery procedures, and incident responsibilities are not mapped tightly enough to keep essential operations running through a loss of site, people, systems, connectivity, or supplier support.

Impact: The result can be prolonged service interruption, delayed recovery, regulatory exposure, and cascading disruption across interconnected public and private services.

Practitioner Guidance

Why practitioners should care: CER is an operational resilience obligation, so the practical test is whether the business can continue its essential functions under stress, not whether it has a policy statement. That means owners of critical services need clear accountability for continuity, disruption response, and dependency management.

What to watch for: The biggest warning signs are unclear critical-service ownership, incomplete dependency mapping, untested restoration steps, and continuity plans that do not reflect supplier, site, or staffing failure. Those gaps usually show up only during an incident unless they are exercised in advance.

Practitioner takeaway: Treat CER as a resilience programme across process, people, supplier, and technology layers, with incident reporting and recovery planning anchored to the services the public actually depends on.

Related resources from NHI Mgmt Group

• Guide: EU Critical Entities Resilience Directive Guide
• What breaks when banking resilience programmes cannot see critical dependencies?
• Why do MSPs and other critical suppliers increase national cyber resilience risk?
• Why do critical vulnerabilities become resilience events?
• How should security teams validate resilience in interconnected critical infrastructure?