The Council presidency and European Parliament negotiators today reached a provisional agreement on a regulation aimed at ensuring a high common level of cybersecurity across the EU institutions, bodies, offices and agencies. The measures were proposed by the Commission in March 2022 against the background of a significant surge in the number of sophisticated cyberattacks affecting the EU public administration in recent years. The new regulation will create a common framework for all the EU entities in the field of cybersecurity and will improve their resilience and incident response capacities. "The digital transformation can only be successful if we can ensure secure and resilient public administration and democratic institutions in this process. The new rules will help EU entities to prevent and counter cyberattacks, which have become increasingly frequent in the past few years." Jessika Roswall, Minister for EU Affairs of Sweden on behalf of the Council presidency Measures for a high common level of cybersecurityTo ensure high common standards across EU institutions, bodies, offices and agencies, the new rules require them to establish a governance, risk management and control framework in the area of cybersecurity. All EU entities will also have to implement cybersecurity measures addressing the identified risks, conduct regular cybersecurity maturity assessments and put in place a cybersecurity plan. A stronger CERT-EU and enhanced coordinationUnder the new regulation, the mandate of the EU’s Computer Emergency Response Team (CERT-EU) will also be strengthened, and it will be renamed the ‘Cybersecurity Service for the Union institutions, bodies, offices and agencies’, while keeping the current acronym. CERT-EU will advise all EU institutions, bodies, offices and agencies and help them to prevent, detect and respond to incidents. It will also act as a hub for information exchange and coordination on cybersecurity and incident response. All EU entities will be required to share non-classified incident-related information with CERT-EU without undue delay. A new interinstitutional Cybersecurity BoardIn addition, the new regulation will establish an interinstitutional Cybersecurity Board to drive and monitor the implementation of the regulation by EU institutions, bodies, offices and agencies. The new board will also supervise CERT-EU’s implementation of general priorities and objectives and provide it with strategic direction. The board will consist of representatives of all the EU institutions and advisory bodies, the European Investment Bank, the European Cybersecurity Competence Centre, the European Union Agency for Cybersecurity (ENISA), the European Data Protection Supervisor, the EU Agency for the Space Programme, as well as representatives of the EU Agencies Network. The Secretariat of the board will be provided by the European Commission. Next stepsThe provisional agreement will now be finalised at technical level, after which it will be submitted to the member states’ EU ambassadors for confirmation. Once confirmed in both the Council and the Parliament, it will be formally adopted by both institutions. BackgroundIn its conclusions of 20 June 2019, the European Council invited the EU institutions, together with the member states, to work on measures to enhance the resilience and improve the security culture of the EU against cyber and hybrid threats from outside the EU, and to better protect the EU’s information and communication networks, and its decision-making processes, from malicious activities of all kinds. The regulation setting out a common cybersecurity framework for the EU institutions, bodies, offices and agencies is one of the measures provided for in the EU's Cybersecurity Strategy for the Digital Decade, presented by the Commission and the High Representative of the Union for Foreign Affairs and Security Policy in December 2020 to strengthen the EU's collective resilience against cyber threats. In its conclusions of 22 March 2021 on that strategy, the Council stressed that cybersecurity is vital for the functioning of public administration and institutions at both national and EU level and for our society and the economy as a whole. Cybersecurity at the EU institutions, bodies, offices and agencies: Council adopts its position on common rules (press release, 18 November 2022) Cybersecurity (background information) |