This Law regulates the protection of national critical infrastructure and infrastructure of particular European importance, protection principles and resilience measures, coordination of critical infrastructure protection, the national framework for the resilience of critical entities, identification and certification of critical entities and critical entities of particular European importance, obligations of critical entities, defines the content of the security plan, certification of legal entities and businesses providing private protection of critical infrastructure, notification of incidents, verification of suitability and the role and obligations of the security coordinator, handling of data on critical infrastructure and supervision of the implementation of this Law. This Law, in the part of implementing the protection of national critical infrastructures, does not apply to state administration bodies and other state bodies whose jurisdiction includes national security, public safety, defense or law enforcement activities for the purpose of preventing, detecting and investigating criminal offences. Critical infrastructures are assets that are engaged in an essential service (essential for maintaining vital social functions, economic activities, public health and safety, and the environment). This Law transposes the rules contained in the Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC into Croatian legislation and ensures the implementation of Commission Delegated Regulation (EU) 2023/2450 of 25 July 2023 supplementing Directive (EU) 2022/2557 of the European Parliament and of the Council by establishing a list of essential services. The principles of critical infrastructure protection are: the principle of protection against all forms of threats implies that all critical entities and all competent authorities take into account various forms of threats in ensuring continuous operation in the delivery of key services of the critical entity; the principle of a comprehensive approach means the protection of critical infrastructure from disruption or interruption of operations and the delivery of key services, involving all competent authorities and institutions, taking into account all relevant forms of threats, resulting from a risk assessment and taking into account the interdependence of critical sector entities and their interaction; the principle of continuous planning for the protection of critical infrastructure implies a continuous assessment of threats and business risks, as well as an evaluation of plans for its protection, and protection planning is part of the ongoing business process of the critical entity; the principle of information and data exchange and data protection implies that all competent authorities and institutions regularly and timely exchange data and information, and that the exchange is based on trust and on the protection of data related to the work of the critical entity in accordance with the provisions of this Law and the law regulating the protection of secrecy and confidentiality of data. The Annex is part of this text (containing the list of sectors, sub-sectors and categories from which critical entities and key services are identified).
克罗地亚 · 2025-06-06