This Regulation establishes guidelines for the preparation of risk analysis and assessment in the process of identifying critical entities. The risk analysis guidelines shall be in accordance with the risk management standards ISO 31000 and EN IEC 31010. Criticality analysis is the process of identifying systems, networks and facilities of national importance whose disruption of operation or interruption of the delivery of key services could have serious consequences for human health and life, property and the environment, security and economic stability and the continuous functioning of government. In the process of identifying critical entities, the competent authorities shall compile a list of entities providing key services and their infrastructure, containing the name, basic data on the entity and infrastructure, location and type of activity. Data on potentially vulnerable parts of the infrastructure, possible real threats, consequences, existing protection measures and redundancy shall be kept within the analytical documentation prepared for the purposes of risk analysis and assessment and shall be updated in accordance with changes in circumstances, threats, vulnerabilities and resilience measures. The identification of critical entities is carried out on the basis of a procedure for identifying the criticality of their infrastructure, which is carried out for each system, sector, network and facility, or their individual parts, which serve to provide key services within the scope of the competent authority. The Annex is part of this text (containing the guidelines for conducting critical infrastructure risk assessments -calculation of the critical entity risk index).
Croatia · 2026-07-21