# L_2020417EN.01019701.xml

| 11.12.2020 | EN | Official Journal of the European Union | L 417/197 |
| --- | --- | --- | --- |

11.12.2020

EN

Official Journal of the European Union

L 417/197

---

RESOLUTION (EU) 2020/1896 OF THE EUROPEAN PARLIAMENT

of 14 May 2020

with observations forming an integral part of the decision on discharge in respect of the implementation of the budget of the European Union Agency for Network and Information Security (ENISA) (now ENISA (the European Union Agency for Cybersecurity)) for the financial year 2018

THE EUROPEAN PARLIAMENT,

| — | having regard to its decision on discharge in respect of the implementation of the budget of the European Union Agency for Network and Information Security (ENISA) for the financial year 2018, |
| --- | --- |

—

having regard to its decision on discharge in respect of the implementation of the budget of the European Union Agency for Network and Information Security (ENISA) for the financial year 2018,

| — | having regard to Rule 100 of and Annex V to its Rules of Procedure, |
| --- | --- |

—

having regard to Rule 100 of and Annex V to its Rules of Procedure,

| — | having regard to the report of the Committee on Budgetary Control (A9-0039/2020), |
| --- | --- |

—

having regard to the report of the Committee on Budgetary Control (A9-0039/2020),

| A. | whereas, according to its statement of revenue and expenditure (1), the final budget of the European Union Agency for Network and Information Security (the ‘Agency’) for the financial year 2018 was EUR 11 473 788, representing an increase of 2,67 % compared to 2017; whereas the budget of the Agency derives mainly from the Union budget (2); |
| --- | --- |

A.

whereas, according to its statement of revenue and expenditure (1), the final budget of the European Union Agency for Network and Information Security (the ‘Agency’) for the financial year 2018 was EUR 11 473 788, representing an increase of 2,67 % compared to 2017; whereas the budget of the Agency derives mainly from the Union budget (2);

| B. | whereas the Court of Auditors (the ‘Court’), in its report on the Agency’s annual accounts for the financial year 2018 (the ‘Court’s report’), states that it has obtained reasonable assurances that the Agency’s annual accounts are reliable and that the underlying transactions are legal and regular; |
| --- | --- |

B.

whereas the Court of Auditors (the ‘Court’), in its report on the Agency’s annual accounts for the financial year 2018 (the ‘Court’s report’), states that it has obtained reasonable assurances that the Agency’s annual accounts are reliable and that the underlying transactions are legal and regular;

Budget and financial management

| 1. | Notes with satisfaction that the budget monitoring efforts during the financial year 2018 resulted in a budget implementation rate of 99,98 %, representing a decrease of 0,01 % compared to 2017; notes furthermore that the payment appropriations execution rate was 88,56 %, representing a slight increase of 0,37 % compared to 2017; |
| --- | --- |

1.

Performance

| 2. | Notes that the Agency uses certain key performance indicators (KPIs) to measure the added value provided by its activities and to enhance its budget management, focusing more on qualitative indicators for the assessment of the achievement of its operational goals and more on quantitative indicators for its administrative goals; notes that, in order to better meet its stakeholders’ expectations, the Agency is enhancing its reporting package by tailoring its qualitative and quantitative KPIs to measure its activity impact more efficiently; |
| --- | --- |

2.

| 3. | Calls on the Agency to step up its action to tackle the security vulnerabilities of 5G and to disseminate information on the subject as widely as possible in order to ensure that the existing technical solutions are adopted by the industry; |
| --- | --- |

3.

| 4. | Regrets that, following the study on the external evaluation of the Agency’s performance over the 2013 to 2016 period carried out on behalf of the Commission in 2017, no action plan has been formalised; nevertheless, notes that relevant recommendations have been implemented and that an internal audit carried out by the Commission’s internal audit service made overlapping recommendations for which a formal remedial action plan has been agreed upon; |
| --- | --- |

4.

| 5. | Encourages the Agency to pursue the digitalisation of its services; |
| --- | --- |

5.

| 6. | Calls on the Commission to conduct a Feasibility Study in order to assess the possibility of setting up shared synergies with the Cedefop which has its headquarters in Thessaloniki; calls on the Commission to evaluate both scenarios, namely the transfer of the Agency to the Cedefop headquarters in Thessaloniki, and the transfer of the Agency’s headquarters to its Heraklion headquarters; notes that the transfer of the Agency to the Cedefop headquarters would entail the sharing of corporate and support services and the management of the common premises, as well as shared ICT, telecommunications and internet-based infrastructures, saving very significant amounts of money which would be used for the further funding of both agencies; |
| --- | --- |

6.

Staff policy

| 7. | Notes with concern that, on 31 December 2018, the establishment plan was executed only to 93,62 %, with 44 temporary agents appointed out of 47 temporary agents authorised under the Union budget (compared with 48 authorised posts in 2017); notes that, in addition, 27 contract agents and three seconded national experts worked for the Agency in 2018; |
| --- | --- |

7.

| 8. | Notes that in 2015, the Agency planned to relocate staff engaged in its administration to Athens while Regulation (EU) No 526/2013 of the European Parliament and of the Council (3) provides that such members of staff should be based in Heraklion, and that it is likely that costs could be further reduced if all members of staff were centralised in one location; notes that only seven members of staff are currently working at the Heraklion premises; notes that the Agency will further study the relevance of the facilities in line with the current seat agreement and the programmes developed in those facilities; |
| --- | --- |

8.

| 9. | Notes with concern that the Agency finds it difficult to recruit, attract and hold suitably qualified staff, mainly due to the types of post that are advertised, namely contract agent posts, and to the low correction coefficients applied to the salaries of the Agency’s members of staff in Greece; notes with satisfaction, however, that the Agency has implemented a number of social measures in order to increase its attractiveness; |
| --- | --- |

9.

| 10. | Notes that the Agency does not have the necessary appropriations to advertise all vacant posts in all EU languages as required by EPSO; notes, however, that the Agency, like other Union decentralised agencies, publishes vacancy notices on several websites, in publications across the Union and on the EU Agencies Network website; |
| --- | --- |

10.

| 11. | Notes that the handover process to new members of staff is currently being reviewed in order to better transfer knowledge to new staff in the future and that this process is considered to be included in the sensitive posts policy; invites the Agency to inform the discharge authority when that review has been concluded; |
| --- | --- |

11.

| 12. | Notes with concern the lack of gender balance in 2018 among senior managers (8 men and 2 women) and among the members of the management board (25 men and 5 women); |
| --- | --- |

12.

Prevention and management of conflicts of interests and transparency

| 13. | Notes the Agency’s existing measures on and ongoing efforts to secure transparency and the prevention and management of conflicts of interests and notes that the CVs of the members of the management board and their declaration of conflicts of interests have now been published on the Agency’s website; recalls that the Agency does not publish the senior management members’ declarations of conflicts of interests on its website; reiterates its calls on the Agency to publish the CVs of all the members of the management board and the declarations of conflicts of interests of its senior management and to report to the discharge authority on the measures taken in that regard; |
| --- | --- |

13.

Internal controls

| 14. | Notes with concern that the Court’s report finds that the Agency does not have a sensitive post policy for the purpose of identifying sensitive functions, keeping them up to date and establishing appropriate measures to mitigate the risks of vested interests; calls on the Agency to adopt and implement such a policy without delay; |
| --- | --- |

14.

| 15. | Notes that in 2018, the Commission’s internal audit service issued an audit report on ‘Stakeholders’ involvement in the Production of Deliverables in ENISA’ for which the Agency is preparing an action plan to address any potential areas of improvement; |
| --- | --- |

15.

Other comments

| 16. | Notes that the impact of the United Kingdom’s decision to withdraw from the Union on the Agency’s operations and administration is very limited; notes, however, that the Agency has reviewed its internal processes to mitigate any risks linked to the United Kingdom’s withdrawal from the Union, and that none of those risks are considered to be critical but that they are, rather, considered to be very low; |
| --- | --- |

16.

| 17. | Regrets the fact that the Agency has not yet formalised a strategy to ensure an environmentally friendly work place; calls on the Agency to do so as a matter of urgency; |
| --- | --- |

17.

| 18. | Calls on the Agency to focus on disseminating the results of its research to the public, and to reach out to the public via social media and other media outlets; |
| --- | --- |

18.

| 19. | Refers, for other observations of a cross-cutting nature accompanying its decision on discharge, to its resolution of 14 May 2020 (4) on the performance, financial management and control of the agencies. |
| --- | --- |

19.

---

(1)  OJ C 120, 29.3.2019, p. 205.

(2)  OJ C 120, 29.3.2019, p. 206.

(3)  Regulation (EU) No 526/2013 of the European Parliament and of the Council of 21 May 2013 concerning the European Union Agency for Network and Information Security (ENISA) and repealing Regulation (EC) No 460/2004 (OJ L 165, 18.6.2013, p. 41).

(4)  Texts adopted, P9_TA(2020)0121.

---