Project 101: Enhance CBRN Critical Infrastructure Protection and (Cyber) Security in South East and Eastern Europe, Central Asia and Middle East

Context

Disruption at a CBRN-related facility can affect services far beyond the site itself. Incidents may interrupt healthcare, drinking-water or wastewater operations, energy, transport, food supply, or other services that depend on critical infrastructure. Project 101 helps partner countries identify these dependencies, assess risks and strengthen the resilience and continuity of the services concerned.

The project P101 draws on relevant EU approaches, including the Critical Entities Resilience Directive (CER) and the Network and Information Security Directive (NIS2). CER provides a framework for strengthening the resilience of critical entities providing essential services; NIS2 addresses cybersecurity risk management and incident reporting for entities within its scope. Project 101 adapts relevant approaches to partner countries’ national legal and institutional contexts.

Overall objective

To strengthen partner countries’ capacity to identify and assess CBRN-related risks to critical infrastructure and essential services, and to improve the physical resilience, cybersecurity, continuity and coordinated response arrangements of the entities and facilities concerned.

Specific objectives

• Identify CBRN-related critical infrastructure and the essential services it provides or supports, including relevant dependencies.
• Improve risk assessment of threats, vulnerabilities and potential consequences for service continuity.
• Strengthen physical protection, cybersecurity and operational technology security, continuity planning and incident response.
• Improve coordination and exchange of good practice among competent authorities, infrastructure operators and regional partners.

Concrete activities

• Identify CBRN-related critical infrastructure, essential services and dependencies.
• Develop national methodologies and guidance informed by CER, NIS2 and other relevant frameworks.
• Conduct pilot risk assessments of selected CBRN-related facilities and the services they provide or support.
• Develop guidance on physical resilience, cybersecurity, operational technology security, continuity and incident response.
• Support national decision-making and coordination among authorities and infrastructure operators.
• Identify priority capability, equipment and software needs for improving resilience and security.
• Deliver practical training and exercises on risk assessment, service continuity and coordinated response.
• Promote regional and inter-regional cooperation on shared risks, dependencies and good practice.

Expected results

• Result 1: National baselines on CBRN infrastructure and essential services.
• Result 2: Improved methods to identify infrastructure and assess service-continuity risks.
• Result 3: Country- and sector-specific risk assessments of CBRN critical infrastructure facilities.
• Result 4: Expertise enhanced through physical-security and cybersecurity training.
• Result 5: Regional cooperation strengthened through training, exercises and good-practice exchange.

Achievements

• National consultations: 18 consultation visits conducted to validate findings and discuss national priorities.
• National baseline reports: OSINT-based reports prepared for 18 partner countries.
• Expertise mobilised: More than 50 national experts contracted to support project activities including national reports
• National workshops: 11 workshops held to advance national CBRN critical infrastructure protection and security priorities.
• Regional engagement: Two inter-regional meetings held to support exchange and cooperation.