This Regulation, based on the provisions of the Croatian Law on critical infrastructures, establishes the guidelines, criteria and standards for the identification of critical infrastructures and the risk analysis of critical infrastructure operations, as well as the holders and obligations of the holder of such risk analysis aimed for critical infrastructure operations, which is also an integral part of the regulated risk assessment process. The guidelines and criteria for risk analysis from paragraph 1 of this article comply with the ISO 31000:2009 standard for risk management. The central bodies of the state administration, in cooperation with the competent regulatory agencies, in their scope for the purpose of risk analysis: carry out the procedure for identification of critical infrastructures; maintain a database of critical infrastructures; establish sectoral benchmarks for risk analysis of critical infrastructures; prepare a sectoral risk analysis of critical infrastructure operations. Owners/managers of critical infrastructures shall prepare a business risk assessment of related critical infrastructures. Risk analysis is a process for understanding the nature of risk and determining its level, which provides the basis for its evaluation and decision on risk treatment, including the detailed elaboration and gradation of threats, vulnerabilities, probabilities and consequences and determining the criteria for obtaining the risk level. The Annex is also part of this publication (methodology sheets and indicator lists).
Croatia · 2016-05-04