S.L. 460.41 Art. 21Use of European cybersecurity certification schemes. 39

(1) In the implementation of article 19 the CIP

Department shall without imposing or discriminating in favour of any particular type of technology, encourage the use of ICT products, ICT

services and ICT processes, developed by the essential or important entity or procured from third parties, that are certified under European cybersecurity certification schemes adopted in accordance with Article 49 of Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act):

Provided that the CIP Department, or where designated the competent authority, shall require where applicable, essential and important entities to use such ICT products, ICT services and ICT processes:

Provided further that specific categories of essential and important entities listed in Commission delegated acts, shall use certain certified ICT products, ICT services and ICT processes or obtain a certificate under a European cybersecurity certification scheme adopted in accordance with Article 49 of Regulation (EU) 2019/881.

(2) Essential and important entities may use qualified trust services.