--- title: CER Directive Implementation Guide | Human Risks description: CER Directive guide for security and resilience teams. Map six core competencies, find what you already have, and build the evidence critical entities need. --- [Skip to content](https://www.humanrisks.com/cer-guide#main-content) Close - [Platform](https://www.humanrisks.com/platform) - [Risk Assessment](https://www.humanrisks.com/platform/risk-assessments) - [Incident Reports](https://www.humanrisks.com/platform/incident-reports) - [Questionnaires](https://www.humanrisks.com/platform/questionnaires) - [Tasks](https://www.humanrisks.com/platform/tasks) - [Business Continuity Management](https://www.humanrisks.com/platform/bcm) - [Business Impact Analysis](https://www.humanrisks.com/platform/bcm/business-impact-analysis) - [Business Continuity Plans](https://www.humanrisks.com/platform/bcm) - [Crisis Management](https://www.humanrisks.com/platform/bcm/crisis-management) - [Mass Communication](https://www.humanrisks.com/platform/mass-comms) - [Industries](https://www.humanrisks.com/industries) - [Manufacturing](https://www.humanrisks.com/industry/manufacturing) - [Banking & Financial Services](https://www.humanrisks.com/industry/banking-and-financial-services) - [Critical Infrastructure](https://www.humanrisks.com/industry/critical-infrastructure) - [Pharmaceuticals](https://www.humanrisks.com/industry/pharmaceuticals) - [Facility Management](https://www.humanrisks.com/industry/facility-management) - [Professional Services](https://www.humanrisks.com/industry/professional-services) - [Resources](https://www.humanrisks.com/resources) - [Security Templates](https://www.humanrisks.com/resources/templates) - [Risk Assessment](https://www.humanrisks.com/resources/risk-assessment-series) - [Webinars](https://www.humanrisks.com/resources/webinars) - [Whitepapers](https://www.humanrisks.com/resources/whitepapers) - [Insights](https://www.humanrisks.com/insights) - [Customer Cases](https://www.humanrisks.com/customer-cases) SEARCH CONTACT E-MAIL: [info@humanrisks.com](mailto:info@humanrisks.com) [Book a Demo](https://www.humanrisks.com/book-a-demo) [![Human Risks](https://www.humanrisks.com/hs-fs/hubfs/Human%20Risks_Logo-4.png?width=1935&height=431&name=Human%20Risks_Logo-4.png)![human risks logo white](https://www.humanrisks.com/hs-fs/hubfs/human%20risks%20logo%20white.png?width=200&height=44&name=human%20risks%20logo%20white.png)](https://www.humanrisks.com/) - [Platform](https://www.humanrisks.com/platform) - [Industries](https://www.humanrisks.com/industries) - [Resources](https://www.humanrisks.com/resources) E-MAIL: [info@humanrisks.com](mailto:info@humanrisks.com) [Book a Demo](https://www.humanrisks.com/book-a-demo) [Risk Assessments](https://www.humanrisks.com/platform/risk-assessments)[Incident Reports](https://www.humanrisks.com/platform/incident-reports)[Questionnaires](https://www.humanrisks.com/platform/questionnaires)[Tasks](https://www.humanrisks.com/platform/tasks)[Business Continuity Management](https://www.humanrisks.com/platform/bcm) [Business Impact Analysis](https://www.humanrisks.com/platform/bcm/business-impact-analysis)[Business Continuity Plans](https://www.humanrisks.com/platform/bcm/business-continuity-plans)[Crisis Management](https://www.humanrisks.com/platform/bcm/crisis-management)[Mass Communications](https://www.humanrisks.com/platform/mass-comms) [Manufacturing](https://www.humanrisks.com/industry/manufacturing)[Banking & Financial Services](https://www.humanrisks.com/industry/banking-and-financial-services)[Critical Infrastructure](https://www.humanrisks.com/industry/critical-infrastructure) [Pharmaceuticals](https://www.humanrisks.com/industry/pharmaceuticals)[Facility Management](https://www.humanrisks.com/industry/facility-management)[Professional Services](https://www.humanrisks.com/industry/professional-services) [Security Templates](https://www.humanrisks.com/resources/templates)[Risk Assessment](https://www.humanrisks.com/resources/risk-assessment-series)[Webinars](https://www.humanrisks.com/resources/webinars) [Whitepapers](https://www.humanrisks.com/resources/whitepapers)[Insights](https://www.humanrisks.com/insights)[Customer Cases](https://www.humanrisks.com/customer-cases) EU Directive 2022/2557 # CER Directive: A Practical Guide for Security & Resilience Teams #### Six core competencies to meet the Critical Entities Resilience Directive *Download the practical guide for security, resilience and compliance leaders on how to translate the CER Directive into a structured resilience programme.* ![CER](https://www.humanrisks.com/hs-fs/hubfs/Website%20Assets/Resource%20Pages/CER.png?width=1339&name=CER.png "CER") About the author ### Douglas Gray Douglas Gray is the Head of Product at Human Risks, bringing a decade of experience in enterprise risk and resilience. At Fonterra, the world’s largest dairy exporter, he led group resilience, crisis response and regulatory risk across a supply chain spanning 100+ markets. He has also advised major European firms in London and Paris on business continuity and crisis management. Douglas holds a Master’s in Intelligence and International Security from King’s College London, was highly commended as New Zealand’s Emerging Risk Professional of the Year, and sits on the ASIS Global Steering Committee for Crisis & Business Continuity Management. [Read more about Douglas Gray](https://www.humanrisks.com/insights/author/douglas-gray) ![Douglas Gray, Head of Product at Human Risks](https://26655958.fs1.hubspotusercontent-eu1.net/hub/26655958/hubfs/Website%20Assets/Company/Team/Doug%201-1.png?width=300&name=Doug%201-1.png) # The 5 Security & Resilience Things You'll Learn The Critical Entities Resilience Directive (CER) is the EU law that requires designated organisations across eleven sectors to keep essential services running through any hazard. For most security and resilience teams, it arrives as a compliance problem: sectors, thresholds, designations, and a clock that starts the day you receive notification. This practical guide from Human Risks reads the Directive differently. It treats CER as a description of what an effective security and resilience programme already contains, and shows you how to find it, own it, and prove it. Drawing on the Directive text, the Commission's guidelines, the Article 13 resilience measures, and the links to NIS2 and DORA, this guide gives security and resilience leaders a clear path from scattered plans and unnamed owners to one connected, evidenced framework. Two appendices turn the guide into a working tool: a competency reference mapped to the Commission's example measures, and a site-by-site readiness checklist covering what you have, what you can show, and when you last tested it.   1. **What CER means in practice.** Eleven sectors, three designation tests, and national rules that vary from country to country. The guide cuts through the mechanics and sets out the timeline that matters most: nine months to your risk assessment and ten months to your resilience plan, counted from your own notification date. 2. **Six core competencies.** Prevent, Protect, Respond, Recover, People, and Awareness. The Directive frames these as legal obligations. The guide frames them as the things a programme has to do well whether or not a regulator ever asks, backed by four connecting factors: the risk assessment, the resilience plan, a named contact, and a rehearsed 24-hour notification route. 3. **Start with what you already have.** Most compliance roadmaps begin with a gap assessment and learn what they lack before they know what they have. We advise you a different approach. With four inventory questions, asked of each competency at each site, you can identify the assessments, plans, and records already sitting in your organisation under other names. 4. **Ownership and evidence, not new controls.** The real gap is rarely a missing control. It is an assessment without an owner, a plan without a test date, or evidence nobody can produce on request. Learn the sequence European teams already follow, how to test whether ownership is real, and how to build a resilience plan that draws on the record rather than sitting beside it. 5. **Why suppliers are in scope anyway.** CER duties fall on designated entities, but critical entities carry the same expectations into their supply chains. Your team may not be in the regulation, but it will be in the paperwork. The guide sets out the six questions a critical customer will ask, and how to answer them from your own record. [![human risks logo white](https://26655958.fs1.hubspotusercontent-eu1.net/hub/26655958/hubfs/human%20risks%20logo%20white.png?width=200&name=human%20risks%20logo%20white.png)](https://www.humanrisks.com/) - [Platform](https://www.humanrisks.com/platform) - [Risk Assessments](https://www.humanrisks.com/platform/risk-assessments) - [Tasks](https://www.humanrisks.com/platform/tasks) - [Incident Reports](https://www.humanrisks.com/platform/incident-reports) - [Questionnaires](https://www.humanrisks.com/platform/questionnaires) - [Business Continuity](https://www.humanrisks.com/platform/bcm) - [Business Impact Analysis](https://www.humanrisks.com/platform/bcm/business-impact-analysis) - [Business Continuity Plans](https://www.humanrisks.com/platform/bcm/business-continuity-plans) - [Crisis Management](https://www.humanrisks.com/platform/bcm/crisis-management) - [Mass Communications](https://www.humanrisks.com/platform/mass-comms) - [Resources](https://www.humanrisks.com/resources) - [CER Directive Practical Guide](https://www.humanrisks.com/cer-guide) - [Whitepapers](https://www.humanrisks.com/resources/whitepapers) - [Webinars](https://www.humanrisks.com/resources/webinars) - [Security Templates](https://www.humanrisks.com/resources/templates) - [Risk Assessment](https://www.humanrisks.com/resources/risk-assessment-series) - [Case Studies](https://www.humanrisks.com/customer-cases) - [Insights](https://www.humanrisks.com/insights) - [Podcast](https://tr.ee/KvAUisFgFY) - Company - [About Us](https://www.humanrisks.com/company/about-us) - [Partners](https://www.humanrisks.com/company/partners) - [Careers](https://www.humanrisks.com/company/careers) - [Contact](https://www.humanrisks.com/company/contact) © All rights reserved, Human Risks 2026 - [Privacy Policy](https://www.humanrisks.com/privacy-policy) - [Legal Disclaimer](https://www.humanrisks.com/hubfs/Website%20Assets/Company/Legal%20Disclaimer.pdf) - [Data Security](https://www.humanrisks.com/hubfs/Website%20Assets/Company/Security-White-Paper_V1.9_2024.04.29_HumanRisks1.pdf) ```json { "@context" : "https://schema.org", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "Denmark", "addressLocality" : "Aalborg", "addressRegion" : "Nordjylland", "postalCode" : "9000", "streetAddress" : "Adelgade 12" }, "email" : "info@humanrisks.com", "knowsLanguage" : "en", "logo" : { "@type" : "ImageObject", "url" : "https://26655958.fs1.hubspotusercontent-eu1.net/hubfs/26655958/Human%20Risks_Logo-4.png" }, "name" : "Human Risks", "url" : "https://www.humanrisks.com/cer-guide" } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://www.humanrisks.com", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://www.humanrisks.com/resources", "name" : "Resources", "position" : 2 }, { "@type" : "ListItem", "item" : "https://www.humanrisks.com/resources/whitepapers", "name" : "Whitepapers", "position" : 3 }, { "@type" : "ListItem", "item" : "https://www.humanrisks.com/cer-guide", "name" : "CER Directive Implementation Guide", "position" : 4 } ] } ```