NIS2 Cross-Border Cooperation

The NIS 2 Directive establishes several EU-wide cooperation mechanisms for cross-border cybersecurity: the CSIRT Network (Article 15) for operational information exchange between national incident response teams, EU-CyCLONe (Article 16) for coordinated crisis management during large-scale incidents, and the Cooperation Group for strategic information exchange and policy coordination. These structures ensure that cyberattacks with EU-wide impact are managed in a coordinated manner.

EU-CyCLONe (European Cyber Crisis Liaison Organisation Network) is the EU crisis coordination network established under NIS 2 Article 16. It supports the coordinated management of large-scale cybersecurity incidents and crises at operational level. CyCLONe consists of representatives from Member States' cyber crisis management authorities, ENISA as secretariat, and the European Commission as observer. It formally cooperates with the CSIRT Network and reports regularly to the European Parliament and Council.

EU Member States use three levels of cooperation: 1) CSIRT Network: operational level, national incident response teams share threat intelligence, indicators of compromise and best practices (Art. 15). 2) EU-CyCLONe: crisis level, during large-scale incidents, crisis management authorities coordinate joint situational assessment and response (Art. 16). 3) Cooperation Group: policy level, strategic cooperation, experience sharing and adaptation of national strategies (Art. 14).

NIS 2 establishes and uses several international cooperation structures: Cooperation Group (Art. 14) with all EU Member States, ENISA and the European Commission for strategic exchange. CSIRT Network (Art. 15) for operational information exchange between national CSIRTs. EU-CyCLONe (Art. 16) for crisis management. NIS 2 also promotes exchange with international partners (Art. 40) and provides for peer reviews of national NIS 2 implementations across Member States.

NIS 2 creates cross-sector EU cooperation structures (CyCLONe, CSIRT Network) for all regulated sectors. DORA (Digital Operational Resilience Act) supplements this for the financial sector with specific mechanisms: joint oversight of critical ICT third-party providers through the Joint Oversight Subcommittee (ESAs), TLPT coordination and sector-specific information exchange. For financial companies, DORA applies as lex specialis, both frameworks complement each other, with DORA taking precedence where they overlap.

At national level: the BSI as Germany's NIS 2 focal-point CSIRT and member of the CSIRT Network and EU-CyCLONe. At EU level: ENISA (EU Agency for Cybersecurity) as the central support body, coordinating the CSIRT Network and CyCLONe. The Cooperation Group (all Member States plus Commission) coordinates strategic NIS 2 implementation. For companies operating in multiple EU Member States: reporting obligations may apply to multiple national authorities, professional consulting helps coordinate compliance across jurisdictions.