Article 15 — CSIRTs network

NIS2, Directive (EU) 2022/2555

What does NIS2 Article 15 say?

Short answer, straight from the official text

1. In order to contribute to the development of confidence and trust and to promote swift and effective operational cooperation among Member States, a network of national CSIRTs is established. 2.

Source: NIS2, Directive (EU) 2022/2555, read 2026-08-14.

Official text

Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.

Jump to a point: Point 1 · Point 2 · Point 3 · Point 4 · Point 5 · Point 6 · Point 7 · Point 8 · Point 9 · Point 10

1. In order to contribute to the development of confidence and trust and to promote swift and effective operational cooperation among Member States, a network of national CSIRTs is established.

2. The CSIRTs network shall be composed of representatives of the CSIRTs designated or established pursuant to Article 10 and the computer emergency response team for the Union’s institutions, bodies and agencies (CERT-EU). The Commission shall participate in the CSIRTs network as an observer. ENISA shall provide the secretariat and shall actively provide assistance for the cooperation among the CSIRTs.

3. The CSIRTs network shall have the following tasks:

(a) to exchange information about the CSIRTs’ capabilities;

(b) to facilitate the sharing, transfer and exchange of technology and relevant measures, policies, tools, processes, best practices and frameworks among the CSIRTs;

(c) to exchange relevant information about incidents, near misses, cyber threats, risks and vulnerabilities;

(d) to exchange information with regard to cybersecurity publications and recommendations;

(e) to ensure interoperability with regard to information-sharing specifications and protocols;

(f) at the request of a member of the CSIRTs network potentially affected by an incident, to exchange and discuss information in relation to that incident and associated cyber threats, risks and vulnerabilities;

(g) at the request of a member of the CSIRTs network, to discuss and, where possible, implement a coordinated response to an incident that has been identified within the jurisdiction of that Member State;

The article continues in the official text.

Open the article on EUR-Lex

• Previous article
• Next article

Other articles in this chapter

• Article 14
• Article 16
• Article 17
• Article 18
• Article 19

Who does this apply to

The register names five roles. Open a role to see the duties this act places on it, each row with its article and its source.

• Cloud service provider

Does this apply to us?

• Do ai governance rules apply to a cloud provider?
• Do personal data rules apply to a cloud provider?
• Do cross-border data rules apply to a cloud provider?
• Do cybersecurity rules apply to a cloud provider?
• Do health data rules apply to a cloud provider?
• Do online platforms rules apply to a cloud provider?

All roles in the register · All questions by role

The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.

Back to the act · EU acts, read down to the national law

ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.

Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.