Draft in parliament
CER
CER is NIS2 for the physical world: the same essential sectors, asked to stay running through sabotage, drone incursion, flooding and the insider who already has a badge. Slovenia had to transpose it by 17 October 2024 and has not yet done so.
Who it catches
The sector list is deliberately the same as NIS2's high-criticality list, so in practice an organisation that is an essential entity under ZInfV-1 should assume it will be a critical entity under CER as well. The difference is what is being protected. NIS2 asks whether your network survives an attacker; CER asks whether the service survives at all — whether the substation keeps supplying, the hospital keeps admitting, the water keeps flowing — regardless of what caused the disruption.
What CER adds that NIS2 does not cover
- Physical security of sites, perimeters and control rooms
- Background checks on staff with access to critical functions
- Insider-threat and sabotage scenarios, exercised rather than assumed
- Unmanned aircraft over and near the site
- Natural hazards, and dependency on a single supplier or route
- Resilience of the service, not only of the systems behind it
THE DATES
Where this stands today
-
CER Directive enters into force
-
Transposition deadline — missed in Slovenia
-
Member States to adopt a critical-entity resilience strategy
-
Member States to have identified their critical entities
What to do before it lands
- Assume you are in scope if ZInfV-1 already names you as an essential entity
- Write one resilience risk assessment covering cyber and physical together, not two documents
- Test the continuity plan against a scenario that is not a cyber attack
- Look at your airspace — counter-drone is where CER and the Commission's 2026 action plan meet
- Keep the evidence: whatever the Slovenian act asks for, it will ask you to show it
What it costs to get wrong
The penalties will be set by the Slovenian implementing act, which does not exist yet, so nobody can quote you a figure honestly. What is already certain is the direction: the same organisations, the same management accountability, and an obligation to demonstrate resilience rather than assert it. Work started now under NIS2 counts twice, because the risk assessment and the continuity plan are the same two documents.
WHAT WE DO ABOUT IT
The services that close this gap
Not the whole catalogue — these are the ones that map onto the obligations above. If something here is already covered internally, say so and we will scope around it.
Chief Information Security Officer
A security executive on subscription: policy, risk register, board reporting and the evidence an auditor asks for — without a six-figure hire.
Read more IoT / OTIoT and OT security
Cameras, controllers and machines that shipped with no security and cannot be patched. We segment them, watch them and stop them talking to strangers.
Read more IRIncident response
Containment, eradication and recovery, on site if it needs to be. The 24-hour clock in the law starts the moment you notice, not the moment you call.
Read moreNot sure whether CER applies to you?
Tell us your sector, your headcount and what you sell. We will tell you which regimes catch you and what the first three things to do are — in writing, at no charge, because half the organisations that ask turn out not to be in scope and we would rather say so.