EC Statement on Cybersecurity Act and Certification Rules in EU

The EU Cybersecurity Act gives ENISA, the EU Agency for Cybersecurity, more tasks and resources to assist EU member states in dealing with cyber-attacks. ENISA will improve the cybersecurity preparedness and resilience in EU, contributing to better information-sharing between EU member states through the network of Computer Security Incident Response Teams (CSIRTs) and by organizing regular pan-European cybersecurity exercises. 

Additionally, the Cybersecurity Act introduces for the first time EU-wide rules for cybersecurity certification. Companies in EU will benefit from having to certify their products, processes, and services only once and see their certificates recognized across EU. Under the framework, multiple schemes will be created for different categories of ICT products, processes, and services. Each scheme will specify, among  others, the type or categories of ICT products, services and processes covered, the purpose, the security standards that shall be met, and the evaluation methods.  The schemes will also indicate the period of validity for the certificates issued. ENISA, on request from EC or the European Cybersecurity Certification Group (composed by member states), will prepare the certification schemes that will then be adopted by EC through implementing acts. 

Regarding the certification framework, EC will prepare the first requests for ENISA to develop certification schemes and set-up the governance structure with the establishment of the relevant expert groups:

• The European Cybersecurity Certification Group, comprising representatives from member states that will have to appoint the representatives from their competent authorities 
• The Stakeholder Cybersecurity Certification Group, which will be responsible to advise ENISA and EC

Related Links

• News Release
• Overview of EU Cybersecurity Act (PDF)

Keywords: Europe, EU, Banking, Insurance, Securities, Cybersecurity Act, ENISA, Cyber Risk, Cybersecurity Certification, Cyber Resilience, EC