policy · 1555459200000

EU Cybersecurity Act Adoption

The European Union adopted the Cybersecurity Act, establishing a cybersecurity certification framework and strengthening ENISA.

What happened

The EU Cybersecurity Act was adopted, revamping the European Union Agency for Cybersecurity (ENISA) with a permanent mandate and increased resources. It also introduced the European Cybersecurity Certification Framework (ECCF).

Technical mechanism

The policy establishes common cybersecurity requirements and evaluation criteria for the certification of ICT products, services, and processes across the EU.

Why it matters

A major policy milestone that created the first EU-wide cybersecurity certification framework for ICT products and gave ENISA a permanent mandate, significantly advancing European cyber resilience.

Impact

The Act harmonized cybersecurity certification across member states, reducing fragmentation and enhancing trust in digital products and services within the European single market.

Response

Member states and industry stakeholders began adapting to the new certification schemes and collaborating more closely through ENISA.

Defensive lessons

  • Standardized certification frameworks are crucial for ensuring baseline security in ICT products.
  • Strong, well-resourced central agencies are necessary for coordinating cross-border cybersecurity efforts.

Evidence register

  1. European Commission — EU cybersecurity policies (verified)