23.12.2008 Official Journal of the European Union L 345/75 COUNCIL DIRECTIVE 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection (Text with EEA relevance) THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty establishing the European Community, and in particular Article 308 thereof, Having regard to the proposal from the Commission, Having regard to the opinion of the European Parliament (1), Having regard to the opinion of the European Central Bank (3), Whereas: In June 2004 the European Council asked for the preparation of an overall strategy to protect critical infra- structures. In response, on 20 October 2004, the Commission adopted a Communication on critical infra- structure protection in the fight against terrorism which put forward suggestions as to what would enhance European prevention of, preparedness for and response to terrorist attacks involving critical infrastructures. On 17 November 2005 the Commission adopted a Green Paper on a European programme for critical infra- structure protection which provided policy options on the establishment of the programme and the Critical Infrastructure  Warning Information Network. The responses received to the Green Paper emphasised the added value of a Community framework concerning critical infrastructure protection. The need to increase the critical infrastructure protection capability in Europe and to help reduce vulnerabilities concerning critical infrastructures was acknowledged. The importance of the key principles of subsidiarity, proportionality and complementarity, as well as of stakeholder dialogue was emphasised. In December 2005 the Justice and Home Affairs Council called upon the Commission to make a proposal for a European programme for critical infrastructure protection (!) Opinion of 10 July 2007 (not yet published in the Official Journal). () O] C 116, 26.5.2007, p. 1. (EPCIP’) and decided that it should be based on an all- hazards approach while countering threats from terrorism as a priority. Under this approach, man-made, technological threats and natural disasters should be taken into account in the critical infrastructure protection process, but the threat of terrorism should be given priority. In April 2007 the Council adopted conclusions on the EPCIP in which it reiterated that it was the ultimate responsibility of the Member States to manage arrangements for the protection of critical infrastructures within their national borders while welcoming the efforts of the Commission to develop a European procedure for the identification and designation of European critical infrastructures (ECIs) and the assessment of the need to improve their protection. This Directive constitutes a first step in a step-by-step approach to identify and designate ECIs and assess the need to improve their protection. As such, this Directive concentrates on the energy and transport sectors and should be reviewed with a view to assessing its impact and the need to include other sectors within its scope, inter alia, the information and communication technology (ICT’) sector. The primary and ultimate responsibility for protecting ECIs falls on the Member States and the owners/o- perators of such infrastructures. There are a certain number of critical infrastructures in the Community, the disruption or destruction of which would have significant cross-border impacts. This may include transboundary cross-sector effects resulting from interdependencies between interconnected infra- structures. Such ECIs should be identified and designated by means of a common procedure. The evaluation of security requirements for such infrastructures should be done under a common minimum approach. Bilateral schemes for cooperation between Member States in the field of critical infrastructure protection constitute a well- established and efficient means of dealing with trans- boundary critical infrastructures. EPCIP should build on such cooperation. Information pertaining to the desig- nation of a particular infrastructure as an ECI should be classified at an appropriate level in accordance with existing Community and Member State legislation.