· ReadyStack
Worked example
Real numbers from this tool, line by line.
Six findings came back when Resilience Plan Lint read a sample water utility resilience plan. The plan was written for an EU critical entity under the CER Directive and was notified on 2026-08-14. Five of the findings are errors and one is a warning. If you are the security or compliance lead at a designated energy, water, transport or health operator in Germany, the Netherlands, France or any other member state, those six lines are the ones the competent authority will read first.
Why now: member states had to identify their critical entities by 17 July 2026. A critical entity must complete its first risk assessment within nine months of the designation notice. For a notice dated 2026-08-14, that is 2027-05-14. The sample plan targets 2027-06-30, which is six weeks late.
Here is what the lint returned on the sample file, line by line:
| Plan says | CER requires |
|---|---|
| 72 hours initial notice | 24 hours (Art. 15) |
| Detailed report in 60 days | One month (Art. 15) |
| Review every five years | At least every four years |
| First assessment 2027-06-30 | Due 2027-05-14 (nine months) |
| No public health hazard | All hazards (Art. 12) |
| No liaison officer | Named contact (Art. 13) |
The 72-hour line is the most common mistake, and it has a clear origin. NIS2 incident reporting has three steps: a 24-hour early warning, a 72-hour incident notification and a one-month final report. CER Article 15 has two steps: an initial notification no later than 24 hours after becoming aware, and a detailed report no later than one month after that. Teams that already run a NIS2 process often copy it into the resilience plan, and the 72-hour step comes with it. For CER, that first notice is 48 hours late.
The lint uses nine rules, one per requirement in Articles 12 to 15:
- CER-15-INITIAL: initial notice no later than 24 hours.
- CER-15-REPORT: detailed report no later than one month.
- CER-15-MISSING: an incident notification procedure exists.
- CER-12-CYCLE: re-assessment at least every four years.
- CER-12-FIRST: first assessment within nine months of the designation notice.
- CER-12-HAZARDS: natural hazards, accidents, public health emergencies and antagonistic threats.
- CER-12-DEPEND: dependencies on and from other sectors.
- CER-13-LIAISON: a named liaison officer as point of contact.
- CER-13-MEASURES: physical protection, recovery and business continuity, personnel security and background checks, training and exercises.
The deadline rule reads the dates in the plan itself. If the plan says "Designation notified: 2026-08-14", the rule adds nine calendar months. If the plan's own completion date falls after that, the line is flagged. If there is no completion date and the deadline has already passed on the day you run the check, the plan is flagged as overdue. On the build date, 2026-09-27, the sample deadline has not passed yet, so the only date finding is the late target.
How to use it: paste the plan Markdown into the free web page, or open the file in VS Code and run the check command. Each finding shows the line, the article and the fix. The free check covers one file with no limit on runs. The full version scans every plan in a workspace at once and exports a dated gap report for the auditor file.
For comparison, an online CER Directive trained-professional course costs $297. It teaches the articles, but it does not read your plan.
The lint reads text. It cannot judge whether your fences are high enough. It only checks that the plan covers each Article 12 to 15 element and that the deadlines match the directive.
15 seconds — what it actually does
Questions people ask
What does Resilience Plan Lint check?
Resilience Plan Lint reads a critical entity's risk assessment or resilience plan written in Markdown and checks it against EU CER Directive 2022/2557 Articles 12 to 15. Nine rules cover the 24-hour initial notice, the one-month detailed report, the nine-month first assessment, the four-year review cycle, all hazard groups, dependencies, a liaison officer and all six Article 13(1) measure areas. Each finding shows the line, the article and the fix.
Who is Resilience Plan Lint for?
It is for security, risk and compliance leads at EU critical entities designated under the CER Directive: drinking water and wastewater utilities, energy, transport, health and digital infrastructure operators. It suits teams that keep the risk assessment and resilience plan as Markdown in a repository, and water utilities that hold a separate drought contingency plan and need the resilience plan to cover Article 13(1)(a).
Why not just use a free template or a chatbot?
Many resilience plan templates are copied from NIS2, which has a 72-hour incident notification step. CER Article 15 requires the initial notice within 24 hours and a detailed report within one month. A chatbot can explain those rules but does not read your file line by line, add nine months to your own designation date, or notice that a drought hazard has no matching adaptation measure.
What is free and what needs a licence key?
The free check reads one plan at a time, in the browser or in VS Code, with every finding and no limit on runs. The licence key adds a workspace sweep: every plan in the repository is checked at once and a dated gap report is written for the auditor file. The key costs $29 once for one person or team seat.
What does the alternative cost?
An online CER Directive trained-professional course costs $297. It teaches Articles 12 to 15 but does not check your own plan. Resilience Plan Lint checks the plan itself: the free version covers one file with every finding, and the workspace sweep with a dated gap report costs $29 once. The lint reads text only, so it does not judge whether measures are adequate.
Why not just ask ChatGPT or another AI chat?
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. Resilience Plan Lint (CER Directive) checks the file you open against 9 rules, each naming its legal or official basis, from a rule set dated 2026-09-28, and points at the exact line with the fix. For a filing, an audit or a client you need that dated result on your own files.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.