Policy Themes

Critical infrastructure protection

The new approach to the European Programme for Critical Infrastructure Protection (EPCIP) is built on a review of the 2006 programme and the Council Directive 2008/114/EC on the identification and designation of European critical infrastructures and their protection.

It aims to increase the resilience of EU infrastructures against all threats and hazards. It looks at interdependencies between critical infrastructures, industry and the state, including where borders and sectors are crossed (e.g. European high-voltage electricity grid).

The EPCIP established:

  1.  Procedures for the identification and designation of European critical infrastructures and assessment of the need to improve their protection (Directive 2008/114/EC).
  2.  Measures to facilitate implementation, including an action plan, CIWIN, expert groups at EU level and an information sharing process.
  3.  Funding for measures and projects related to critical infrastructure protection focusing on ‘Prevention, Preparedness and Consequence Management of Terrorism and Other Security Related Risks.'
  4.  Engagement with third countries on critical infrastructure protection.

In 2013, less than 20 European Critical Infrastructures had been designated, and very few Operator Security Plans had been produced. Since then the number has since increased substantially.

The Directive 2008/114/EC has mainly encouraged engagement rather than creating a real European forum for cooperation, maybe because the approach focused on individual sectors.

In practice, analysis of criticalities tends to follow a ‘system’ or ‘service’ approach (e.g., hospitals, financial services). A cross-sector approach would help to address this. In practical terms, the development of preparedness strategies is based on contingency planning, stress tests, awareness raising, training, joint exercises and staff exchange. The program also promotes dialogue between the operators of the critical infrastructures and those who rely on them to prepare better responses.

The gaps identified in the review led the European Commission to present its new approach to the implementation of the EPCIP in 2013, with a greater focus on interdependencies and four critical European infrastructures (Eurocontrol, Galileo, the electricity transmission grid and the gas transmission network).


The guidelines for trans-European energy infrastructure are built on the Energy Infrastructure Priorities for 2020 and Beyond – A Blueprint for an integrated European Energy Network Communication of 28 February 2011. It stipulates that the EU energy infrastructure should be upgraded to increase resilience and prevent failure from technical faults, natural or man-made disasters, the adverse effects of climate change and security threats.


EU transport policies include security and safety policies for air, road, maritime and rail travel. All of them include technical standards for preventing and detecting risks as well as responding to major threats, including terrorist attacks, crimes, and accidents.

To maintain proper security levels, cooperation with third countries is paramount. The European Commission consolidates and strengthens security by working together with major international partners, exchanging experiences and best practices.

Transport security also relies on new technologies to develop systems that deliver high security without causing lengthy delays or disruption.

Related information

European Commission: Commission Staff Working Document on a new approach to the European Programme for Critical Infrastructure Protection. Making European Critical Infrastructures more secure, SWD(2013) 318 final

2008 Directive on European Critical Infrastructures 

More information

Details of projects in this theme can be found on the JRC database