The European Commission has published new non-binding guidance to help operators of critical entities implement resilience measures required under the Critical Entities Resilience (CER) Directive ahead of the 17 July 2026 deadline for Member States to identify critical entities.

The guidance, issued under Article 13(5) of Directive (EU) 2022/2557, provides recommendations on technical, security and organisational measures that operators can adopt to strengthen resilience against both natural and human-made threats, including sabotage, terrorism, cyberattacks and hybrid threats.

Key recommendations for critical entities

The Commission stresses that resilience measures should be risk-based, proportionate and integrated, covering the full lifecycle of prevention, protection, response, recovery and continuous improvement rather than focusing solely on physical infrastructure.

Among the recommended measures are:

• Comprehensive risk assessments that consider cross-border, cross-sector and supply chain interdependencies.

• Governance structures that embed resilience at board level, including the possible appointment of a dedicated resilience officer.

• Development and regular testing of resilience plans, business continuity plans and crisis management procedures.

• Cooperation and information sharing with competent authorities, emergency services, law enforcement and defence organisations.

• Integration of resilience measures with existing obligations under the NIS2 Directive and other sector-specific legislation.

Stronger physical security against hybrid threats

The guidance places particular emphasis on protecting critical infrastructure from intentional attacks.

Recommended measures include:

• High-security perimeter protection, controlled access points and layered physical security.

• CCTV, intrusion detection systems and enhanced monitoring.

• Protection against hostile vehicle attacks.

• Measures to address threats from drones, including detection systems, anti-drone technologies and geofencing where permitted.

• Consideration of espionage, sabotage, insider threats, terrorism and violent extremism within security planning.

Cyber and operational resilience

Critical entities are encouraged to strengthen operational resilience by:

• Ensuring manual override capabilities for operational technology.

• Protecting networks and operational systems against cyberattacks and radio-frequency interference.

• Maintaining backup power for at least 72 hours.

• Diversifying suppliers and establishing contingency plans for supply chain disruptions.

• Using predictive maintenance, sensor networks and AI where appropriate, while ensuring compliance with the EU AI Act for high-risk systems.

Workforce and awareness

The Commission also recommends enhanced personnel security, including:

• Background checks for sensitive positions.

• Role-based access controls and regular access reviews.

• Regular resilience and security awareness training for all staff.

• Scenario-based exercises involving emergency responders and public authorities to test preparedness.

Recovery and continuity

The guidance encourages organisations to prioritise rapid recovery through:

• Business continuity plans based on business impact assessments.

• Alternative operating sites and redundant systems.

• Structured post-incident reviews to identify lessons learned.

• Strategic stockpiles and mutual assistance agreements to support recovery following major disruptions.

Although the guidance is not legally binding, it is intended to support implementation of the CER Directive, which requires critical entities across sectors including energy, transport, banking, health, digital infrastructure, water, public administration and others to strengthen their resilience against an increasingly complex threat landscape.