# Article 4 — Terms and conditions for applying cybersecurity-related grounds in relation to a specific CSIRT **Commission Delegated Regulation (EU) 2026/881 · binding · OJ L, 2026/881, 20.4.2026 · dated 11 Dec 2025 [in force]** *In force · Commission Delegated Regulation (EU) 2026/881, OJ L, 2026/881, 20.4.2026 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/eli/reg_del/2026/881/oj/eng)* The CSIRT initially receiving the notification may decide to delay for a period of time that is strictly necessary the dissemination of notifications or parts thereof to a specific relevant CSIRT in cases where: **(a)** the relevant CSIRT has been affected by a cybersecurity incident casting doubt on its ability to ensure the confidentiality of the notified information; **(b)** it has sufficient reason to believe that the capabilities of the relevant CSIRT are inadequate to ensure the confidentiality of the notified information. In cases referred to in point (a) of the first subparagraph, the CSIRT initially receiving the notification may delay the dissemination until the relevant CSIRT has informed the CSIRTs Network referred to in Article 15 of Directive (EU) 2022/2555 that its ability to ensure the confidentiality of notifications has been restored. In cases referred to in point (b) of the first subparagraph, the CSIRT initially receiving the notification may delay the dissemination to the relevant CSIRT until that CSIRT has provided evidence that it has addressed the shortcomings identified.