Skip to the text
In this act Article 4 of 6
Text as of 26 Oct 2026 · Commission Delegated Regulation (EU) 2026/881, OJ L, 2026/881, 20.4.2026 · Same wording as today’s text.Today’s text

Article 4 — Terms and conditions for applying cybersecurity-related grounds in relation to a specific CSIRT

Digital & dataLevel 2Delegated RegulationCRAIn forceOfficial source

The CSIRT initially receiving the notification may decide to delay for a period of time that is strictly necessary the dissemination of notifications or parts thereof to a specific relevant CSIRT in cases where:

4(a)
(a)the relevant CSIRT has been affected by a cybersecurity incident casting doubt on its ability to ensure the confidentiality of the notified information;
Copy link
4(b)
(b)it has sufficient reason to believe that the capabilities of the relevant CSIRT are inadequate to ensure the confidentiality of the notified information.
Copy link

In cases referred to in point (a) of the first subparagraph, the CSIRT initially receiving the notification may delay the dissemination until the relevant CSIRT has informed the CSIRTs Network referred to in Article 15 of Directive (EU) 2022/2555 that its ability to ensure the confidentiality of notifications has been restored.

In cases referred to in point (b) of the first subparagraph, the CSIRT initially receiving the notification may delay the dissemination to the relevant CSIRT until that CSIRT has provided evidence that it has addressed the shortcomings identified.