Commission Regulation (EU) 2018/1798 of 21 November 2018 implementing Regulation (EC) No 808/2004 of the European Parliament and of the Council concerning Community statistics on the information society for the reference year 2019 (Text with EEA relevance.)

for all enterprises:

• computer usage;

for enterprises using computers:

• (optional) persons employed or percentage of the total number of persons employed who use computers for business purposes.

for enterprises using computers:

• internet access;

for enterprises with internet access:

• persons employed or percentage of the total number of persons employed who use computers with access to the internet for business purposes;

• (optional) use of voice or video call applications over the internet for business purposes;

• internet connection: any type of fixed connection;

• internet connection: provision of portable devices that allow a mobile connection using mobile telephone networks, for business purposes;

• (optional) having a website;

• use of social networks, not solely used for paid adverts;

• use of the enterprise's blogs or microblogs, not solely used for paid adverts;

• use of multimedia content sharing websites, not solely used for paid adverts;

• use of wiki based knowledge sharing tools, not solely used for paid adverts;

for enterprises having any type of fixed connection to the internet:

• maximum contracted download speed of the fastest fixed internet connection in Mbit/s in the ranges: [0,< 2], [2,< 10], [10,< 30], [30,< 100], [> = 100];

for enterprises that provide their persons employed with portable devices that allow a mobile internet connection using mobile telephone networks, for business purposes:

• persons employed or percentage of the total number of persons employed using a portable device provided by the enterprise which allows internet connection via mobile telephone networks, for business purposes;

for enterprises having a website, information about the provision of the following facilities:

• (optional) description of goods or services, price lists;

• (optional) online ordering, reservation or booking;

• (optional) possibility for visitors to customise or design online goods or services;

• (optional) tracking or status of placed orders;

• (optional) personalised content on the website for regular/recurrent visitors;

• (optional) links or references to the enterprise's social media profiles;

• (optional) use of information about visitors' behaviour on enterprise's website such as clicks, items viewed, for example for advertising or improving customer satisfaction;

for enterprises using social media (not solely for paid adverts) referring specifically to social networks, the enterprise's blogs or microblogs, multimedia content-sharing websites or wiki-based knowledge-sharing tools:

• use of social media to develop the enterprise's image or market products such as advertising or launching products;

• use of social media to obtain or respond to customer opinions, reviews or questions;

• use of social media to involve customers in development or innovation of goods or services;

• use of social media to collaborate with business partners (such as suppliers) or other organisations (such as public authorities or non-governmental organisations);

• use of social media to recruit employees;

• use of social media to exchange views, opinions or knowledge within the enterprise.

for enterprises using computers:

• receipt of orders for goods or services placed via a website or apps (web sales), in the previous calendar year;

• receipt of orders for goods or services via EDI-type messages (EDI-type sales), in the previous calendar year;

for enterprises having received orders for goods or services placed via a website or apps in the previous calendar year:

• value of the turnover, expressed in absolute figures or as a percentage of total turnover, of e-commerce sales resulting from orders received via a website or apps, in the previous calendar year;

• percentage of turnover from orders received via a website or apps, broken down by sales to private consumers (Business to Consumers: B2C), and sales to other enterprises (Business to Business: B2B) and to public authorities (Business to Government: B2G), in the previous calendar year;

• receipt of orders for goods or services via the enterprise's own website or apps (including those of parent or affiliate enterprises, extranets), in the previous calendar year;

• receipt of orders for goods or services via an e-commerce marketplace website or apps used by several enterprises for trading products, in the previous calendar year;

• percentage of turnover from orders received via a website or apps broken down by orders received via the enterprise's own website or apps (including those of parent or affiliate enterprises, extranets) and by orders received via an e-commerce marketplace website or apps used by several enterprises for trading products, in the previous calendar year;

• receipt of orders that were placed by customers via a website or apps by origin: own country, in the previous calendar year;

• receipt of orders that were placed by customers via a website or apps by origin: other Member States, in the previous calendar year;

• receipt of orders that were placed by customers via a website or apps by origin: rest of the world, in the previous calendar year;

• (optional) the percentage of turnover from orders received via a website or apps in the previous calendar year broken down by origin: own country, other Member States and rest of the world;

for enterprises having received orders for goods or services via EDI-type messages, in the previous calendar year:

• value of the turnover, expressed in absolute figures or as a percentage of the total turnover, of e-commerce sales resulting from orders received via EDI-type messages, in the previous calendar year;

• receipt of orders that were placed by customers via EDI-type messages, by origin: own country, in the previous calendar year;

• receipt of orders that were placed by customers via EDI-type messages, by origin: other Member States, in the previous calendar year;

• receipt of orders that were placed by customers via EDI-type messages, by origin: rest of the world, in the previous calendar year.

for enterprises using computers:

• use of an ERP (Enterprise Resource Planning) software package to share information among different functional areas;

• use of any software application for managing information on customers (Customer Relationship Management — CRM software) that makes it possible to collect, store and make available to other business functions information about the enterprise's customers;

• use of any software application for managing information on customers (Customer Relationship Management — CRM software) that enables information about customers to be analysed for marketing purposes.

for enterprises using computers:

• (optional) employment of ICT specialists;

• (optional) provision of any type of training to develop ICT-related skills for ICT specialists, in the previous calendar year;

• (optional) provision of any type of training to develop ICT-related skills for other persons employed, in the previous calendar year;

• (optional) recruitment of or the attempt to recruit ICT specialists in the previous calendar year;

• (optional) performance of ICT functions (such as maintenance of ICT infrastructure, support for office software, development or support of business management software/systems and/or web solutions, security and data protection) by own employees (including those employed in parent or affiliated enterprises) in the previous calendar year;

• (optional) performance of ICT functions (such as maintenance of ICT infrastructure, support for office software, development or support of business management software/systems and/or web solutions, security and data protection) by external suppliers in the previous calendar year;

for enterprises using computers and which have recruited or tried to recruit ICT specialists in the previous calendar year:

• (optional) vacancies for ICT specialists that were difficult to fill.

for enterprises that received orders placed by customers in other Member States, via a website or apps, during the previous calendar year: information about the following difficulties when selling to other Member States:

• high costs of delivering or returning products;

• difficulties related to resolving complaints and disputes;

• adapting product labelling for sales to other Member States;

• lack of knowledge of foreign languages to communicate with customers in other Member States;

• restrictions imposed by the enterprise's business partners on sales to certain Member States.

for enterprises with computers:

• use as an ICT security measure: strong password authentication;

• use as an ICT security measure: keeping the software (including operating systems) up-to-date;

• use as an ICT security measure: user identification and authentication via biometric methods implemented by the enterprise;

• use as an ICT security measure: encryption techniques for data, documents or e-mails;

• use as an ICT security measure: data backup to a separate location (including backup to the cloud);

• use as an ICT security measure: network access control (management of access by devices and users to the enterprise's network);

• use as an ICT security measure: VPN (Virtual Private Network, which extends the private network across a public network to enable secure exchange of data over public network);

• use as an ICT security measure: maintaining log files for analysis after security incidents;

• use as an ICT security measure: ICT risk assessment, i.e. periodically assessment of probability and consequences of ICT security incidents;

• use as an ICT security measure: ICT security tests such as performing penetration tests, testing security alert systems, reviewing security measures, testing backup systems;

• making persons employed aware of their obligations in ICT security related issues through voluntary training or internally available information (such as information on the intranet);

• making persons employed aware of their obligations in ICT security related issues through compulsory training courses or viewing compulsory material;

• making persons employed aware of their obligations in ICT security related issues through a contract (such as a contract of employment);

• ICT security related activities such as security testing, ICT training on security, resolving ICT security incidents (excluding upgrades of pre-packaged software) carried out by enterprise's own employees (including those employed in parent or affiliate enterprises);

• ICT security related activities such as security testing, ICT training on security, resolving ICT security incidents (excluding upgrades of pre-packaged software) carried out by external suppliers;

• availability of document(s) on measures, practices or procedures on ICT security;

• problems experienced at least once in the previous calendar year due to ICT related incidents: unavailability of ICT services, for example denial of service attacks, ransomware attacks, hardware or software failures excluding mechanical failure, theft;

• problems experienced at least once in the previous calendar year due to ICT related incidents: destruction or corruption of data, for example due to infection of malicious software or unauthorised intrusion, hardware or software failures;

• problems experienced at least once in the previous calendar year due to ICT related incidents: disclosure of confidential data, for example due to intrusion, pharming, phishing attack, actions by enterprise's own employees (intentionally or unintentionally);

• availability of an insurance against ICT security incidents;

for enterprises having document(s) on measures, practices or procedures on ICT security:

• (optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: management of access rights for the usage of ICT, such as computers, network;

• (optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: storage, protection, access or processing of data;

• (optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: procedures or rules to prevent or respond to security incidents, such as pharming, phishing attacks, ransomware;

• (optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: responsibility, rights and duties of persons employed in the field of ICT, such as use of e-mails, mobile devices, social media;

• (optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: training of persons employed in the safe usage of ICT;

• most recent definition or review of enterprise's document(s) on measures, practices or procedures on ICT security (such as risk assessment, evaluation of ICT security incidents): within the last 12 months; more than 12 months and up to twenty-four months ago; more than twenty-four months ago.