CYBERSECURITY

Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act).
In a nutshell, the Cybersecurity Act:
strengthens the ENISA by granting to the agency a permanent mandate, reinforcing its financial and human resources, and overall enhancing its role in supporting EU to achieve a common and high-level cybersecurity.
establishes the first EU-wide cybersecurity certification framework to ensure a common cybersecurity certification approach in the European internal market and ultimately improve cybersecurity in a broad range of digital products (e.g. Internet of Things) and services.

The main objective of the Cybersecurity Act (CSA) is to improve protection against threats to cybersecurity within the EU. The CSA also enables manufacturers and service providers to use one mutually recognised certificate throughout the EU.
Over the years, many European member states have adopted national cybersecurity certification regulations. Divergence between standards in different member states and the lack of mutual recognition risked disruption to the free flow of ICT-products and services within the EU. The CSA certification schemes replaces the current national-level certification schemes, provided these are similar enough in scope.
The CSA requires every EU member state to identify at least one National Cybersecurity Certification Authority (NCCA). 

Mandatory vs voluntary certification
CSA certification is voluntary unless otherwise specified in other EU law or national law. Several actual EU regulation proposals, such as the NIS II directive, Artificial Intelligence Act and Cyber Resilience Act, mandate the European Commission to define the obligations for CSA certification under these regulations.
Mandatory certification will come in different forms. Certification may become mandatory for EU market entry for certain products and services or for specific sectors. In other cases, certification may be used as a ‘presumption of compliance’ with the cybersecurity requirements with respect to a specific regulation.
The CSA states that the European Commission must evaluate the need for compulsory certification by no later than 31 December 2023.

CSA security levels Basic, Substantial and High
The CSA defines three distinct levels of security, known as assurance levels, on the basis of which products services and processes can be certified: Basic, Substantial and High.
In essence, each CSA assurance level defines how resilient a specific product, service or process has to be against a cyberattack with a certain level of skill and resources. For example, High level certification means protection against advanced attacks from attackers with significant skills and resources.
The details of the CSA assurance levels will be worked out separately in every CSA certification scheme due to the need for a tailor-made security approach to products, services and processes.

ENISA hands over each developed certification scheme to the European Commission, which turns it into a European scheme. Once a certification scheme has been published, the relevant requirements for products and services are the same throughout the EU. The schemes are then managed by ENISA in cooperation with the member states, which come together in the ECCG. ENISA will be in charge of public communication regarding the certification schemes and the certificates issued by means of a dedicated website.

EXPLAIN FOR MY NOTES FOR MY EXAM. EXPLAIN CLEARLY SO THAT I CAN UNDERSTAND