Prepare before you begin
The quality of registration depends on prior work: activities, sectors, size, services, establishment, representation, and supporting evidence. The checker can support the initial assessment, but its result is guidance only and does not replace mandatory self-identification where applicable.
The entity should retain a documented scope assessment explaining the data and criteria used.
One entity, one registration
Initial access belongs to the legal representative or a representative with valid, documented authority. The entity maintains a single registration even when it operates in several sectors or subsectors.
Roles, replacements, and contacts should be defined before an absence or urgent situation occurs.
Submission may require interaction
After completion and submission, the authority may request additional information. A draft decision and right-to-be-heard procedure follow, with a period of 10 business days for a response.
Responding requires coordination between management, legal, operations, and technical owners; it should not depend on a single mailbox.
Qualification creates concrete obligations
The final decision may qualify the entity, consolidate its registration, and indicate the applicable framework. In the cases provided for, the entity must then report the details of its Cybersecurity Officer and Permanent Contact Point.
Here, PCP means permanent contact point, not business continuity plan.
Keep the process operating and up to date
Information must remain up to date. The platform supports notifications and communications associated with documents, assets, incidents, and other duties.
The best preparation combines owners, a calendar, evidence, replacements, and periodic verification of the registration.