The European Commission has initiated a consultation to gather feedback on updating the EU’s cybersecurity regulations, which have been in place since 2019. The aim is to simplify and enhance the current framework, with a focus on the Cybersecurity Act (CSA) and its associated provisions.
The revision of the CSA will focus on strengthening the role of ENISA, the EU’s cybersecurity agency, expanding the European Cybersecurity Certification Framework, and addressing issues related to the security of ICT supply chains. The Commission also intends to assess ENISA’s mandate and funding in light of ongoing feedback from industry and national governments.
ENISA, which employs around 100 staff members, was tasked with overseeing the implementation of EU-wide cybersecurity rules. However, progress has been slow on one of its key initiatives – the voluntary cybersecurity certification for cloud services (EUCS). While the EUCS was designed to help companies prove their ICT solutions meet EU cybersecurity standards, its development has been hindered by political debates, particularly around sovereignty concerns. There have been calls to make the certification mandatory in the updated CSA.
EU Commissioner for Technology Henna Virkkunen announced plans for a “Digital Fitness Check” this year to assess whether existing tech regulations are creating unnecessary burdens for businesses and identify areas where simplification is needed.
This consultation follows Virkkunen’s recent push for stronger 5G security rules to protect networks from cyber threats, particularly in light of concerns over suppliers like Huawei and ZTE. While restrictions were agreed upon in 2020 for high-risk suppliers, only a few EU countries have moved forward with banning these companies.
Stakeholders, including national authorities, cybersecurity agencies, industry players, and trade associations, can provide their input on the proposed changes until June 20.
