Cybersecurity: Council info and EU Publications

On this page, you will find how the EU is working on various fronts to promote cyber resilience, fight cybercrime, and boost cyber diplomacy and defence.

Timeline of events related to Cybersecurity in the Council of the EU and the European Council.

This infographic shows facts and figures about the top cyber threats in the European Union between April 2020 and July 2021.

The European Union and its Member States have the responsibility for and are determined to protect and defend our electoral and political processes. We remain vigilant and ready to undertake any action necessary from the EU Cyber Diplomacy Toolbox, including sanctions to prevent and respond to unacceptable cyber-attacks.

Provisional agreement by the Council and the European Parliament on the NIS2 Directive:

Council backs deal on common certification and beefed-up agency by approving the proposed Cybersecurity Act.

In the conclusions Council highlights five functions of the EU in the cyber domain.

The Council today adopted conclusions inviting the EU and member states to further develop the EU cybersecurity crisis management framework, including by exploring the potential of a joint cyber unit.

The conclusions note that cybersecurity is essential for building a resilient, green and digital Europe. They set as a key objective achieving strategic autonomy while preserving an open economy. This includes reinforcing the ability to make autonomous choices in the area of cybersecurity, with the aim to strengthen the EU's digital leadership and strategic capacities. The Council highlights a number of areas for action in the coming year.

The Council today approved conclusions that acknowledge the increased use of consumer products and industrial devices connected to the internet and the related new risks for privacy, information security and cybersecurity. The conclusions set out priorities to address this crucial issue, and to boost the global competitiveness of the EU’s IoT industry by ensuring the highest standards of resilience, safety and security.

The Council adopts conclusions on the significance of 5G to the European economy and the need to mitigate security risks linked to 5G. The conclusions stress that 5G networks will form a part of crucial infrastructure for the maintenance of vital societal and economic functions.

ENISA contributes to the EU’s cyber policy. It works with organisations and businesses to strengthen trust in the digital economy, boost the resilience of the EU’s infrastructure, and, ultimately, keep EU citizens digitally safe.

Publications by the European Union Agency for Cybersecurity.

The Cybersecurity Higher Education Database (CyberHEAD) is the largest validated cybersecurity higher education database in the EU and EFTA countries. This list allows young talents to make informed decisions on the variety of possibilities offered by higher education in cybersecurity and helps universities attract high-quality students motivated in keeping Europe cyber-secure.

Search EUR-Lex for a complete list of EU legislation relating to cybersecurity.

The cybersecurity package In “A Europe Fit for the Digital Age”.

The European Union works on various fronts to promote cyber resilience, safeguarding our communication and data and keeping online society and economy secure

Joint Communication to the European Parliament and the Council: EU Policy on Cyber Defence.

On 16 December 2020, the European Commission and the High Representative of the Union for Foreign Affairs and Security Policy presented a new EU Cybersecurity Strategy.

The EU cybersecurity certification framework for ICT products enables the creation of tailored and risk-based EU certification schemes.

The European Parliament's legislative train schedule monitors the progress of legislative files. This page focuses on the Cyber-security package.

The European Parliament's legislative train schedule monitors the progress of legislative files. This page focuses on the review of the Directive on security of network and information systems.

European Parliament's database for monitoring the EU decision-making process. This procedure file includes the directive on measures for a high common level of cybersecurity across the Union.

Examination of whether the EUIBAs have adequate arrangements to protect themselves against cyber threats.

In 2021, in its efforts to contribute to the achievement of its objectives as defined in the Cybersecurity Act (CSA) and to the implementation of the ENISA Single Programming Document5, ENISA has kicked-off a series of activities in the area of cybersecurity market analysis. By initiating this activity, ENISA delivers an important contribution towards a more targeted, market-driven decision-making process for the conception, launching and maintenance of cybersecurity products, services and processes within the EU.

The European Commission and the Member States, with the support of ENISA, developed a single EU Coordinated Risk Assessment on Cybersecurity in 5G Networks, following on the European Commission’s Recommendation on the cybersecurity of 5G networks. Subsequently, the NIS Cooperation Group published the EU toolbox of risk mitigating measures. The objectives of this toolbox are to identify a possible common set of measures that are capable of mitigating the main cybersecurity risks of 5G networks that were identified in the EU report on coordinated risk assessment, and to provide guidance for the selection of measures that should be prioritised in mitigation plans at national and at Union level.

The EU Agency for Cybersecurity (ENISA) Threat Landscape report has been published on an annual basis since 2013. The report uses publicly available data and provides an independent view on observed threats agents, trends and attack vectors. ENISA aims at building on its expertise and enhancing this activity so that its stakeholders receive relevant and timely information for policy-creation, decision-making and applying security measures, as well as in increasing knowledge and information for specialised cybersecurity communities or for establishing a solid understanding of the cybersecurity challenges related to new technologies.

The methodology for sectoral cybersecurity assessments described in this document addresses these objectives in the context of drafting sectoral cybersecurity certification schemes, which address ICT services in individual market sectors. It is designed to be used as a preparatory step for the definition of a candidate scheme involving sectoral stakeholders.

To adequately address future cybersecurity threats and to shape a more secure society, ENISA aims to draw upon findings and research from the futures and foresight community to develop a process to apply foresight to cybersecurity. By fostering the ability to understand potential futures, ENISA will be able to better shape both itself and the European cybersecurity ecosystem to address and manage emerging and future challenges. This project aims to deliver an exemplary structured foresight framework for generating trend outlooks, scenarios and perspectives on the future to help ENISA to identify and address emerging and future cybersecurity challenges.

This report seeks to assist EU Member States in further building their cybersecurity capacities by analysing best practices on raising citizens’ awareness of cybersecurity. It offers recommendations about ways for better communicating cybersecurity.

The focus of this work is to identify the necessary research priorities to support the EU’s digital strategic autonomy and thus digital sovereignty. In this introductory chapter, we (i) analyse how the terms ‘digital strategic autonomy’ and ‘digital sovereignty’ have been used and propose the definition used in this report, (ii) define the scope and target audience, and (iii) outline the structure of the report.

As digital transformation is accelerating around the world and an increasingly larger share of the interactions is hosted online, citizens, companies and governments are being more and more exposed to cyber threats and digital crimes. As a consequence of a network-enabled, interconnected economy and society, cybersecurity and privacy are areas of major policy concern. Hacked and breached data are becoming especially more common as a result of using connected devices powered by the Internet of Things. The COVID-19 pandemic also had an impact on cybercrime that has soared since the start of the outbreak.

The Report Cybersecurity – Our Digital Anchor brings together research from different disciplinary fields of the Joint Research Centre (JRC), the European Commission's science and knowledge service. It provides multidimensional insights into the growth of cybersecurity over the last 40 years, identifying weaknesses in the current digital evolution and their impacts on European citizens and industry. The report also sets out the elements that potentially could be used to shape a brighter and more secure future for Europe’s digital society, taking into account the new cybersecurity challenges triggered by the COVID-19 crisis.

The often borderless nature of cyber- and cyber-related crime makes effective cross-border cooperation essential to investigate and prosecute perpetrators. Eurojust supports national authorities to work together and to make use of available cross-border investigative tools

A first ever EU wide legislation of its kind: the Cyber Resilience Act introduces mandatory cybersecurity requirements for hardware and software products, throughout their whole lifecycle

Due to this increase, cybersecurity and privacy are areas of major policy concern. In the report entitled Shaping Europe's Digital Future, the Council of the European Union underlined the importance of cybersecurity as “… a key component for a digitalised Single Market, as it ensures trust in digital technology and the digital transformation process.”

Everyone should be able to safely live their digital lives. The EU’s economy, democracy and society depend more than ever on secure and reliable digital tools and connectivity we need to protect.

The first EU-wide law on cybersecurity, the NIS Directive, came into force in 2016 and helped achieve a higher and more even level of security of network and information systems across the EU. In view of the unprecedented digitalisation in the last years, the time has come to refresh it.