EUROPEAN COMMISSION Brussels, 15.9.2022 SWD(2022) 282 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT REPORT

Accompanying the document Proposal for a Regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020 {COM(2022) 454 final} - {SEC(2022) 321 final} - {SWD(2022) 283 final}



Table of contents 1.Introduction: EU Political and legal context 2.Problem definition 3.Why should the EU act? 4.Objectives: What is to be achieved? 5.What are the available policy options? 6.What are the impacts of the policy options? 7.How do the options compare? 8.Preferred option 9.How will actual impacts be monitored and evaluated? Glossary of abbreviations Glossary of terms and definitions List of tables 1.Introduction: EU Political and legal context In a more and more digitalised world, the number of high-profile cyberattacks keeps on increasing and the global annual cost of cybercrime was estimated to amount to EUR 5.5 trillion by 2021. Digital hardware and software products constitute one of the main avenues for successful cyberattacks. In a connected environment, a cybersecurity incident in one product can affect an entire organisation or a whole supply chain, often propagating across the borders of the internal market within a matter of minutes. This can lead to severe disruption of economic and social activities or even become life threatening. While the cybersecurity of providers of digital services is regulated at EU level under the Directive concerning measures for a high common level of security of network and information systems across the Union (‘NIS Directive’), the security of products with digital elements and in particular of software products is so far not subject to any comprehensive piece of EU regulation. Products with digital elements (examples): End devices, e.g.: laptops, smartphones, sensors and cameras; smart robots; smart cards; smart meters; mobile devices; smart speakers; routers; switches; industrial control systems + Software: firmware; operating systems; mobile apps; desktop applications; video games + Components (both hardware as well as software): computer processing units; video cards; software libraries. There are numerous examples of noteworthy cyberattacks resulting from suboptimal product security, such as the Pegasus spyware, which exploits vulnerabilities in mobile phones and has been used by governments to spy on critics and opponents, as well as against prominent political leaders in Europe; the WannaCry ransomware worm, which exploited a Windows vulnerability that affected 200 000 computers across 150 countries in 2017 and caused a damage amounting to billions of USD; the Kaseya VSA supply chain attack, which used Kaseya’s network administration software to attack over 1 000 companies and forcing a supermarket chain to close all its 500 shops across Sweden; or the many incidents in which banking applications are hacked to steal money from unsuspecting consumers.

The EU framework comprises several pieces of horizontal legislation that cover certain aspects linked to cybersecurity from different angles (products, services, crisis management, and crimes), including measures to improve the security of the digital supply chain. In 2013, the Directive on attacks against information systems, harmonising criminalisation and penalties for a number of offences directed against information systems came into force. In August 2016, the NIS Directive entered into force as the first piece of EU-wide legislation on cybersecurity. It introduced obligations on entities operating in key sectors of the European economies and societies, with a view to make them more resilient against cyber-attacks. More recently, the Commission proposed a review of this Directive (‘NIS2 Directive proposal’), which will most likely enter into force in 2022. The upcoming NIS2 Directive raises the EU common level of ambition, through a wider scope, clearer rules, stronger supervision tools, a strengthened framework for operational capabilities and crises management and increased information sharing and cooperation. The new upcoming Directive also provides for supply chain security obligations and related risk management measures. In 2019, the EU Cybersecurity Act entered into force, aiming to enhance the security of ICT products, services and processes by introducing a voluntary certification mechanism. Cybersecurity of the entire ecosystem is ensured only if all its components are cyber-secure. The above-mentioned EU legislation has however substantial gaps in this regard, as it does not cover the security of products with digital elements (see gap analysis in Annex 13). Improving the cybersecurity of key services through the NIS Directive will not be enough to effectively improve cybersecurity throughout the supply chain. Nor the voluntary cybersecurity certification schemes issued under the Cybersecurity Act where manufacturers do not have a legal obligation to certify their products would be enough to affectively address cybersecurity challenges. The current EU framework applicable to products that may also have digital elements comprises several pieces of legislation, including EU legislation on specific products covering safety-related aspects and general legislation on product liability. However, the current legislation covers only certain aspects linked to the cybersecurity of tangible products with digital elements and, where applicable, embedded software concerning these products (e.g. Radio Equipment Directive – RED – and its relevant delegated act). The EU regulatory framework on products (e.g. the General Product Safety Directive (GPSD) and the Machinery Directive (MD), both currently under review) does not prescribe comprehensive specific cybersecurity requirements. These findings were also confirmed by an exploratory study contracted by the Commission and conducted in 2020-2021 to assess the need for horizontal cybersecurity requirements for products with digital elements, which also indicated that the benefits of the regulatory intervention would outweigh its potential costs. A follow-up study was also contracted by the Commission in early 2022, supporting this impact assessment. While commonly accepted that an incident concerning products with digital elements can affect the whole system, it also appears more and more likely that the market will not be able to meet these constantly rising cybersecurity risks without an appropriate intervention from the policy makers. At global level, security of supply chain and security of products with digital elements became prominent in recent years. Given that most products with digital elements are sold globally and not only within specific countries (for example, most organisations worldwide are using the same operating systems and a majority of smartphones across the globe is outfitted with the same types of microprocessor), the problems associated with the security of products with digital elements as described in the problem definition of this report are not specific to the EU but impact the rest of the world too. While cybersecurity product regulation is almost non-existing across the globe, several countries around the world have started to introduce measures (mainly voluntary) to address this issue. One of the most comprehensive sets of measures was taken by the Unites States of America as a result of significant supply chain attacks that affected the US administration. The measures focus software and range from guidelines establishing best practices to detect vulnerabilities to requirements for critical software delivered to government customers or a pilot program on cybersecurity labelling for Internet of Things (IoT) products. The UK is re-evaluating supply chain risks linked to ICT services and software and considering introducing soft law or regulatory measures. In Asia, various approaches are considered for supply chain security, such as a potential IoT security framework in Japan or cybersecurity labelling schemes of the likes of those recently introduced in Singapore. For more details on these global developments see Annex 6. Noting the above-mentioned gaps in the EU legislative framework, various programmatic and political documents have called for specific EU cybersecurity requirements for digital or connected products. The need for horizontal cybersecurity requirements for all products with digital elements on the internal market as the missing piece of the puzzle completing the picture of EU cybersecurity policies was not only identified in the context of development and implementation of recent EU cybersecurity legislation but also by relevant strategic and programmatic documents: The EU’s Cybersecurity Strategy for the Digital Decade of 16 December 2020 had already announced the establishment of common European cybersecurity standards for connected products. In her 2021 State of the Union address, President von der Leyen announced a new European Cyber Resilience Act (CRA), planned for Q3/2022 under the Commission Work Programme 2022. Council Conclusions of 2 December 2020 and of 23 May 2022 have called for “a horizontal regulation introducing cyber-security requirements” covering “the whole lifecycle of products with digital elements”. The European Parliament, in its Resolution of 10 June 2021, welcomed “the Commission’s plans to propose horizontal legislation on cyber-security requirements for connected products and ancillary services”. A horizontal intervention would put in place a framework for improving the security of products with digital elements. It would require manufacturers of hardware and software to take cybersecurity measures and improve transparency. This will reduce the number of vulnerabilities in such products and empower users to choose products matching their security needs and to use these products in a secure manner. It would aim to be one building block in the EU’s endeavor to ensure a high level of cybersecurity throughout different supply chain levels, as well as in relation to its key concerned actors. At the same time, it would take a coherent and effective approach to preventing and countering cybercrime, all these ultimately for the benefit of consumers and citizens. In the run-up to this impact assessment, the Commission has extensively consulted all relevant stakeholders. Member States, manufacturers, users, and other stakeholders were also invited to participate in the Open Public Consultation and in the surveys and workshops organised by the study supporting the Commission preparatory work for the upcoming regulatory intervention. The Commission has also published a Call for Evidence, to which stakeholders could submit feedback. See also Annex 2 on stakeholder consultation. 2.Problem definition 2.1.What are the problems and what are their consequences? Cybersecurity in products with digital elements is characterised by two major problems leading to a wide range of consequences and in particular to costs for users, both organisations and consumers, and society as a whole, mainly: (1) a low level of cybersecurity of products with digital elements, which is primarily reflected by the widespread prevalence of vulnerabilities and the insufficient and inconsistent provision of security updates, but also (2) an insufficient understanding among users as regards the cybersecurity of products because they are often not provided with the information necessary to choose products with appropriate cybersecurity features or to use products in a secure manner, leading to inadequately configured products. The cybersecurity of products with digital elements has a particularly strong cross-border dimension, as products manufactured in one country (including third-countries), such as operating systems or laptops, are often used by organisations and consumers across the entire internal market. In addition, given the borderless nature of the Internet, incidents initially affecting only a single entity or a single Member State often spread within minutes across the entire internal market. The widespread presence of vulnerabilities in products with digital elements used by organisations, such as critical infrastructure, or by consumers, as well as misconfigured products due to the users’ inadequate choice of security settings, have far-reaching consequences. Businesses and other organisations bear significant cost associated with mitigating the risks related to cybersecurity. In addition, they must respond to and recover from cyberattacks, which often propagate across national borders and throughout the internal market. There is also a cost to society when digital solutions are not taken up for fear of security risks. Finally, there is a risk that Member States may start to regulate products security at national level, leading to internal market fragmentation. While fewer vulnerabilities in products with digital elements and more transparency on the side of manufacturers as regards the security properties and secure use of products would not eliminate such costs altogether, more secure hardware and software and better documentation and instructions could lead to a notable reduction in costs. Given that most attacks rely on vulnerability exploits, there would be fewer incidents to manage and recover from. If incidents became less likely, a number of risk mitigation measures, such as cybersecurity insurance, could become less expensive. 2.1.1.Problem 1: Low level of cybersecurity of products with digital elements marketed in the Union

The vast majority of attacks on critical infrastructure or other essential services are the result of vulnerabilities in products with digital elements. The Commission’s proposal for a revision of the NIS Directive requires companies to integrate supply chain security measures into their risk management processes. However, the security of such entities also depends a lot on the availability of secure products. Even the most diligent risk management process cannot offer a high level of organisational security if the market for products with digital elements does not cater to the security needs of organisations. While a number of factors, such as badly configured systems and credential theft (e.g. through phishing), can facilitate or enable cyberattacks, the main attack vector for security breaches is the exploitation of vulnerabilities in hardware and software. Estimates of the share of incidents resulting from exploits against weaknesses in the computational logic and design of software range from 62 % for operators of essential services identified under the NIS Directive to 90 %. A large majority of vulnerabilities are exploitable over the Internet and do not require physical access to networks, which explains why malicious actors are carrying out their attacks on European organisations from anywhere in the world. Cyberattacks against individuals or organisations exploit vulnerabilities in software and hardware products deployed within the victim’s network. To achieve their mission, malicious actors usually exploit multiple vulnerabilities at various stages of an attack . Preventing vulnerabilities during product development and identifying and closing vulnerabilities in products before they can be exploited could bring cyberattacks to halt at various stages of their development. For example, attackers might first exploit a vulnerability allowing them to breach the server hosting a company’s website before making their way through the company’s network to more crucial systems, such as key workstations and the sensitive data stored thereon. The number of vulnerabilities recorded in vulnerability databases is increasing year-on-year. For example, vulnerabilities recorded under the US Common Vulnerabilities and Exposures (CVE) system have increased from 18 325 in 2020 to 20 150 in 2021. This is also valid for the high-profile vulnerabilities that are exploited by malicious actors and for which manufacturers have to date not provided any patch (“zero-days”). According to cybersecurity researchers and databases tracking vulnerabilities, to date the year 2021 has seen the so-far highest number of zero-day vulnerabilities in products with digital elements actively exploited. As a result, the attack surface that malicious actors can exploit increased significantly. At the same time, the threat landscape has evolved, with the number of documented major state-sponsored cybercrime groups increasing year-on-year. While there is no universally applicable measurement of the aggregate level of security of products with digital elements marketed in the Union, a number of observations indicate that the security of products with digital elements is low across the board. Vulnerabilities are regularly identified in all types of products, both hardware and software. When it comes to hardware, vulnerabilities are discovered both in integrated products sold in the market (such as smartphones, laptops or smart household appliances) as well as in hardware components, such as in memory, central processing units (CPUs) and other chipsets. Similarly, software vulnerabilities are found in all types of products, ranging from operating systems to user applications and even those products actually designed to help prevent incidents, such as anti-virus software. Again, vulnerabilities are not only found in final products but also in intermediate software components, such as libraries, and including in open-source components. The Apache Log4j logging utility is the most recent example of a major vulnerability in a widely used open-source software component that has affected entities across the entire internal market. Log4j has been used by a wide range of major software manufacturers and the vulnerability, which has existed since 2013 but was only discovered in 2021, has led to security incidents across the globe. Moreover, the number of vulnerable devices connected to the Internet is increasing. For example, manufacturers are connecting more and more ICSs to the Internet. Between 2017 and 2018, the number of ICSs increased by 27 %. According to a 2021 study, many companies are connecting operational technology (OT) directly to the Internet. Almost all devices analysed by the study contain at least one vulnerability, with Europe and North America being the most affected. Security is not only a concern in products deployed in an industrial or organisational setting, but also when it comes to consumer devices. A recent Euroconsumers probe into connected home devices, such as alarm systems and food processors, has revealed that two-thirds of devices contain vulnerabilities considered as ‘of high severity’ or ‘critical’, affecting both low-cost devices of unknown brands as well as products developed by well-known manufacturers. Vulnerabilities in connected products are not only a theoretical concern, but their exploitation has a very real impact on consumers. For example, in 2019 cybercriminals breached Ring Home Security Cameras to observe citizens in their private homes and to speak with a small child in the child’s room. Manufacturers of products with digital elements do not only place vulnerable products on the market, but they often also do little to improve security throughout the life cycle of their products. For example, a 2018 survey of smartphone manufacturers revealed that 14 out of 19 device manufacturers provide security updates for less than three years. In addition, when manufacturers do provide updates fixing vulnerabilities, they often take too long. Even security flaws discovered by Google’s Project Zero, which pressures manufacturers of browsers and other software into swiftly fixing vulnerabilities by threatening to disclose them after 90 days, are on average only fixed after 52 days. Finally, many manufactures do not even provide for means to contact them to report discovered vulnerabilities. Weaknesses in products with digital elements are not only discovered by the manufacturer of a product or a malicious actor, but also by other manufacturers, security researchers, ethical hackers and even customers. Ideally, organisations should therefore develop their own vulnerability disclosure policies to facilitate interaction with these actors. At the very least, organisations should provide for a means to report vulnerabilities to them. According to the European Telecommunications Standards Institute, “As of early 2022 only about only about 20 % of ICT and IoT companies have a publicly identifiable dedicated means to notify a company of a potentially serious security issue with their products or services." The problems associated with non-secure products are exacerbated by the fact that in a range of markets for products with digital elements, the number of available products is very limited, creating a monoculture. As a result, whenever a new vulnerability is exploited, a relatively large number of users is affected at the same time. This monoculture is explained by the fact that in some instances the utility of products with digital elements, in particular software, increases with the number of people that use it. The importance of such network effects that dissuade users from diversifying the products that they use and their impact on cybersecurity have been long recognised. In addition, exploiting known vulnerabilities has never been easier and does often not require a particularly high degree of familiarity with the underlying weaknesses in the computational logic of targeted systems. Asked to rate the overall level of security of products with digital elements in the Union, the respondents to the Commission’s public consultation on the initiative gave on average a 2.82 (on a scale from 1 to 5 with 5 indicating a very high level of cybersecurity)products with digital elements. The responses of the different stakeholder groups were as follows: national market surveillance bodies (1.5), consumer associations (1.7), public administrations as users (2.5), SMEs as users (2.5), hardware manufacturers (3.2), software manufacturers (2.8), SMEs in their role as manufacturers (3.2). In addition, an overwhelming majority of 95 % of respondents said that the level of risk of cybersecurity incidents affecting products with digital elements has increased during the last five years. 2.1.2.Problem 2: Insufficient understanding among users as regards the cybersecurity of products While it is crucial to make products with digital elements more secure, cybersecurity incidents are in many cases also the result of users choosing products ill-fitted for their purposes or wrongly configuring hardware and software, thereby unnecessarily increasing the security risk of their device or network. This is the result of a number of factors, including a lack of cybersecurity awareness and skills of users, and a lack of information provided by manufacturers on security properties, vulnerabilities and secure use. For example, a study of a Dutch consumer protection organisation covering 86 manufacturers across 18 different product groups has revealed that only 1 out of 5 manufacturers provides information to customers about available security updates. Nothing is more revealing of the lack of understanding amongst users than the notorious neglect of urgent security updates. A survey from 2014 interviewing Microsoft Windows users suggested a lack of awareness and knowledge by users as well as a lack of clear information provided by manufacturers to users. According to 2020 Eurostat data, around 48 % of EU citizens have never restricted or refused access to personal data, when using or installing an app on a smartphone. Asked in the consultations held by the study supporting this impact assessment to which extent an insufficient understanding of users of the security of products with digital elements has a negative impact on the security of individuals or organisations, 69 % of participants replied that the impact was at least moderate. Asked to rate consumers’ awareness and understanding of cybersecurity properties of products with digital elements, consumer organisations gave an average rating of 2.33 (on a scale from 1 to 5). Asked in the public consultation to rate their own awareness of the cybersecurity risks associated with products with digital elements, consumer organisations gave a rating of 2.3 on behalf of consumers. Similarly, when asked to rate their understanding of the cybersecurity properties of products with digital elements and the skills to operate them securely, consumer organisations provided a rating of 1.7. 2.2.What are the problem drivers? 2.2.1.Driver 1: Lack of incentives for manufacturers to take security seriously Manufacturers often neglect the security of their products. Almost 50 % of manufacturers knowingly place products with digital elements on the marked that contain vulnerabilities. One of the main reasons for this is that manufacturers lack the necessary incentives to invest in a secure development life cycle (SDLC). This is the result of strong negative externalities in markets for products with digital elements, information asymmetries between manufacturers and users, a faced-paced market and the costs associated with secure development.

A recent international survey amongst almost 100 software development professionals of mobile health applications has revealed that “little or no budget for employing security” is considered the main challenge when it comes to application security, followed by “insufficient security knowledge [amongst developers]”. Other important challenges that were identified highlight deficiencies in the development life cycles of manufacturers, such as a “lack of involvement of security experts”, “poor security decisions during development process” and a “lack of security testing”. Asked in the public consultation whether manufacturers of software were effectively addressing cybersecurity vulnerabilities and incidents affecting their customers, the respondents gave an overall rating of 2.96 (on a scale from 1 to 5), with consumer organisations rating the effectiveness of manufacturers very low (1.33). The responses of the other stakeholder groups were as follows: national market surveillance bodies (2.0), public administrations as users (2.8), SMEs as users (2.3), hardware manufacturers (3.7), software manufacturers (3.4), SMEs in their role as manufacturers (3.5). Users bear the costs associated with incidents and the market has negative externalities While manufacturers of products with digital elements can sometimes face reputational damage when their products are found to be lacking security, the cost of vulnerabilities is predominantly borne by the users, such as operators of essential services, but also consumers. Examples of costs borne by users are risk mitigation costs, such as taking out cybersecurity insurance or putting in place a security operation centre, as well as the costs resulting from a cybersecurity incident, such as the cost involved in recovering lost data. This limits the incentives of manufacturers to invest into secure design and development and to provide security updates. While it might seem intuitive to assume that manufacturers have an incentive to make their products secure and avoid the fallout of incidents involving their products, in reality it is rarely the companies affected by major cybersecurity incidents that suffer significant negative long-term consequences, but rather the users or customers. One of the reasons why reputational damage often does not translate into users actually switching products consists of the high switching costs associated with replacing a product by another one: products are often heavily tied into existing operations. Moreover, in many cases products markets do not provide for a wide range of alternative products with digital elements. For example, there are only very few widely used operating systems for desktop computers and smartphones. Similarly, the chipset market is highly concentrated with only few companies offering desktop CPUs, video card chipsets and other components. Respondents to the public consultation have identified costs borne by users as an important driver for the low level of security of products with digital elements: Respondents rated the “The user bears additional cost when affected by a cybersecurity incident” with 4.13 (on a scale from 1 to 5). The responses of the different stakeholder groups were as follows: national market surveillance bodies (4.7), consumer associations (5.0), public administrations as users (4.6), SMEs as users (4.6), hardware manufacturers (3.4), software manufacturers (3.9), SMEs in their role as manufacturers (3.6). In addition, it is often not even the manufacturers or the users bearing the costs of incidents but unrelated third parties, such as the victims of DDoS attacks carried out using infected devices: Given the structural and persistent nature of such negative externalities in the markets for products with digital elements, a recent study on IoT device security has concluded that “The costs of security failures are often borne by other stakeholders than the owners of the device or the manufacturers. So, there is a market failure here that justifies government intervention.” Information asymmetries While the manufacturers of products with digital elements are normally not bearing the cost associated with vulnerabilities, they would have to bear the additional cost of making their products more secure. This raises the question if there could be any other incentives leading to an adequate level of investment in product security, such as competitive advantage derived from placing products with a high level of security on the market. However, users are often unaware of the security risks associated with products with digital elements. While they may attribute value to secure products, they do not have the knowledge to understand the value stemming from a product that has been developed with security considerations mind. In addition, given the complexity of products with digital elements and the fact that users usually do not have any knowledge of the internal workings of a product, it is very difficult for them to make purchasing decisions based on such properties. This leads to “bad products driving out good ones”. While information asymmetry applies to both professional users (such as critical infrastructure) as well as consumers, it is in particular the case for consumers. As a result, manufacturers cannot gain a competitive advantage from investing in the security of their products, such as by adopting a SDLC. Cybersecurity as a potential barrier to fast market entry (first-mover advantage) Not only do manufacturers lack positive incentives to invest in security, emphasising product security can sometimes even be detrimental to the success of an undertaking: In a competitive market, companies can only bear additional marginal cost stemming from cybersecurity if their competitors are taking investments in cybersecurity equally seriously, unless they can increase prices because users value the integration of additional security properties. Hardware and software, however, are often characterised by the presence of strong network effects and economies of scale, making markets for products with digital elements a winner takes it all economy. Due to the fast-paced nature of markets for products with digital elements, manufacturers are usually trying to bring new products or features for existing products onto the market as quickly as possible, prioritising feature development and compatibility with existing products, treating the development of security properties as an afterthought: “From the economic perspective of the manufacturers, there are less benefits in strongly securing IoT devices compared to the benefits that arise from shorter development cycles omitting these security measures.” Nothing epitomises the fast market entry approach more than the motto that Facebook had adopted in its early years of development: Move fast and break things. Securing products comes at a cost While it is possible to improve the security of products through investment, companies tend to shy away from the costs associated with building a SDLC. The cost associated with improving product security depends on both the maturity of the entity as regards cybersecurity as well as the level of ambition. According to a recent study on the cost of required security, the cost associated with the additional effort made to improve the security of software products is at least 19 % of the development costs, depending on the security objectives to be achieved. Traditionally, researchers believed that rational manufacturers should invest in cybersecurity (such as by setting up a SDLC), as it would be cheaper to prevent vulnerabilities in the first place than to fix them at a later stage (delayed issue effect). More recently, however, researchers have begun to challenge this notion, bringing forward new evidence suggesting that patching security holes in a product at a later stage is no more expensive than resolving security issues early during development. This further substantiates the view that, given the cost of cybersecurity, manufactures have no natural incentive to develop secure products. 2.2.2.Driver 2: Piecemeal coverage of cybersecurity in EU policies Currently there are no specific cybersecurity requirements comprehensively and systematically applicable to all products with digital elements, hardware or software, accessing the internal market. Cybersecurity of software (embedded in hardware and upload-able or of generic use, i.e. standalone ) in particular, of key importance for cybersecurity policies, is the least regulated even at the level of sector- or product-specific legislation with limited scope. In order to effectively ensure the security of products as per the problems identified, comprehensive and systematic cybersecurity requirements applicable to all digital products, should entail as key minimum elements, that: (i) cybersecurity is factored in the design and development of the digital products and that due diligence is exercised by manufacturers on security aspects when designing and developing their products, (ii) transparency is ensured on cybersecurity aspects that need to be made known to customers and (iii) security support (updates and handling of vulnerabilities) are provided after the placement on the market. Nonetheless, there is a small set of EU legal acts providing for product-related cybersecurity requirements. This is the case of the Radio Equipment Directive (RED) together with a recently adopted delegated regulation, which covers IoT devices outfitted with a radio interface, or the Medical Devices Regulation (MDR), which covers both tangible medical products as well as software. In addition, there are a few European product laws that provide some rules regarding the cybersecurity of products, albeit only in a partial manner, such as the Toy Safety Directive (TSD).

However, most hardware, such as wired IoT devices or computer components, including chipsets, memory chips or processors, as well as the vast majority of software products, such as operating systems, user applications, server software or software libraries, are not covered by any European legal act dealing with their cybersecurity. The exploratory study contracted by the Commission and conducted in 2020-2021 to assess the need for horizontal cybersecurity requirements for products with digital elements, conducted a gap analysis comparing the cybersecurity objectives set out in the Cybersecurity Act (Article 51) against the identified cybersecurity-relevant requirements of 37 pieces of EU legislation concerning products with digital elements. This included all legislation related to the New Legislative Framework (NLF), as well as legislation with a strong link with cybersecurity and data protection, which can affect indirectly and to a limited extent manufacturers (e.g. the eIDAS Regulation, General Data protection Regulation (GDPR), the NIS Directive, RED and GPSD). The NLF is a package of measures that streamline the obligations of manufacturers, authorised representatives, importers and distributors, improve market surveillance and boost the quality of conformity assessments. It also regulates the use of CE marking and creates a toolbox of measures for use in product legislation. This framework was introduced in 2008 to depart from the ‘old approach’ where technical legislation was going into great detail, usually motivated by a lack of confidence in the rigour of economic operators on issues of public health and safety. The gap analysis concluded that the current EU legislative framework does not cover all security objectives, that legislation related to the NLF does not address fully the cybersecurity requirements for products with digital elements and that there are different levels of granularity of cybersecurity requirements in the legislation in scope. In addition, the study concluded that requirements regarding software are very rarely covered by such legislation. For more details on existing European legislation, see section 1 in Annex 5. As a result of the regulatory gaps described, no piece of EU legislation requires currently comprehensive cybersecurity requirements for all products with digital elements. While there is a variety of international standards concerning several aspects of product cybersecurity (consumer IoT, assurance of security throughout lifecycle or vulnerability handling, access control, etc.), there are no harmonised European standards for products with digital elements across sectors (see Annex 14). A detailed regulatory gap analysis can be found in Annex 13. 2.2.3.Driver 3: Manufacturers do not provide information on security properties and vulnerabilities Markets for products with digital elements exhibit strong information asymmetries. This is in particular for closed source products, but also applies to open source products, given the high degree of complexity of products with digital elements. Against the backdrop of a user base that for the most part lacks the skills to evaluate the security properties of products with digital elements, manufacturers in products with digital elements markets are facing a moral hazard, being incentivised to further deprioritise product security and transferring the risk onto users. This leads to a situation in which manufacturers compete with one another on product features, such design or usability, but not on advertised security properties. In many cases, the information provided by manufacturers does not even allow proficient users or companies, such as operators of essential services under the NIS Directive, to compare security requirements with security properties and to make informed purchasing decisions about products. This is not only true when it comes to products with digital elements developed for end-users, but also with regard to intermediate software components used by other software manufacturers to build final products. Asked in the public consultation if they agreed with the statement that “There is sufficient and clear information made available on the cybersecurity properties of products with digital elements”, participants gave an average rating of 2.50 (on a scale from 1 to 5), with consumer organisations giving a rating of only 1.33, users (business and consumers) giving a rating of 2.34, hardware manufacturers rating the information they provide with 2.85. SMEs and organisations representing SMEs in general rated it at 2.4 and 2.6 out of 5, similar to the average, with a slightly higher rating of 3.00 for organisations representing SME manufacturers, and those representing SME users rating it at 2.0. 2.2.4.Driver 4: Manufacturers do not provide information on secure use Apart from not disclosing relevant information about the security properties of products with digital elements, manufacturers often also fail to provide information helping users employ products in a secure manner, such as by including information on secure use in the manual or installation instructions. A recent survey of IoT device manufacturers revealed that only 43 % of manufacturers provide information on how users can change default passwords and only 26 % of manufacturers provide additional advice on how to protect their products from cybersecurity breaches. 2.2.5.Additional drivers not addressed by this intervention In addition to the drivers listed above, there are a number of additional problem drivers that have an impact on the security of products with digital elements as well as on the understanding of users as regards such products. However, given the nature of the product-related intervention considered, these additional drivers would not necessarily be addressed directly. ·Lack of bargaining power of users: Products with digital elements markets are often characterised by the presence of a few large manufacturers due to economies of scale and vendor lock-in, the latter being the result of a lack of compatibility between hardware and software platforms. As a result, users of products with digital elements lack the bargaining power necessary to ensure that manufacturers develop products matching the security needs of specific users. ·Lack of qualified security professionals: Manufacturers of products with digital elements often struggle to hire qualified security professionals: For example, the gap in cybersecurity professionals in Europe amounted to 199 000 in 2020. The Union is trying to address the skills gap through a variety of measures, including funding through the Digital Europe Programme. ·Lack of cybersecurity awareness and skills of users: Studies show that users often lack even the most basic cybersecurity skills. While this applies in particular to consumers, who are often not even familiar with basic internet security terminology, it also affects businesses and other organisations: For instance, only half of business leaders and only a third of their employees acknowledge the risk that cybercrime poses to their organisations. More details on additional drivers identified can be found in section 2 of Annex 5. 2.3.Consequences of the problems identified 2.3.1.Consequence 1: Increased number of cybersecurity incidents with material and non-material harm to citizens and companies The importance and impact of cyberattacks have increased dramatically in recent years. On the one hand, both companies and consumers are growing more dependent on products with digital elements. This trend has been exacerbated by the COVID-19 crisis, which gave rise to widely spread telework and accelerated the digitisation of society. In addition, critical infrastructure as well as manufacturers are increasingly connecting their industrial control systems (ICSs) to the Internet. On the other hand, cyberattacks are sharply increasing and they are used as an economic and geopolitical weapon.

The 2020 Annual Cost of a Data Breach Report of the Ponemon Institute estimates that the average cost of a data breach for individual businesses was EUR 3.5 million in 2018, which is an increase of 6.4 % over the previous year. Such costs include, but are not limited to, getting systems and manufacturing processes back online, managing the reputational fallout, paying a ransom, recovering or compensating for lost or stolen data, and cleaning, reinstalling or replacing affected hardware. In many cases, it takes months for companies to fully recover from an incident. As incidents affect the availability, integrity, authenticity and confidentiality of services, they often affect customers (e.g. a service might become unavailable or sensitive customer data might be stolen) and sometimes propagate across organisations and supply chains throughout the internal market, generating considerable costs. For example, ransomware attacks alone are estimated to have cost the world roughly USD 20 billion in the year 2021. Statistically speaking, every 11 seconds another organisation is hit by a ransomware attack. Supply chain attacks represented a major problem in recent years: cybercriminals introduce malicious code into legitimate products with digital elements for the purpose of attacking the users of such products. One of the most prominent recent examples is the SolarWinds attack in 2020. Vulnerabilities and badly configured systems not only affect the security of organisations but also have a major impact on consumers. Impacts can be financial, as well as related to privacy or health. For instance, when it comes to financial harm, certain types of malware infect the devices of citizens with the goal of collecting online banking credentials and secretly executing payments. Incidents can also have an impact of the safety of citizens. For example, cybersecurity incidents in hospitals have been found to lead to a small increase in mortality rate. In a number of instances, IoT consumer devices have been hacked to track the lives of citizens. A phenomenon of particular relevance to consumers is the hacking of IoT devices for the purpose of integrating them into a botnet, a larger network of devices stretching across the internal market and beyond, controlled by a malicious actor and used to conduct so-called DDoS attacks affecting the availability of services provided by organisations, such as critical infrastructure, and to send out unwanted spam messages to email users. Cross-border botnets create significant negative externalities, as it is usually not the device owners that have to bear the cost of device abuse but rather the victims of DDoS attacks or the recipients of spam. It is estimated that an individual small company targeted by a DDoS attack can face costs up to USD 120 000, while for larger companies the cost can go as high as USD 2 million. In 2021 alone cybercriminals were able to leverage hacked devices and launch 9.75 million DDoS attacks worldwide. Generally speaking, entities across all economic sectors tend to fall victim to cybersecurity attacks. This is first and foremost explained by the fact that “in many cases the threats manifest themselves by exploiting vulnerabilities in underlying ICT systems that are being used in a variety of sectors”. Nonetheless, certain sectors are more affected than others: According to the EU’s cybersecurity agency (ENISA), public administrations, digital service providers, healthcare and finance are the sectors experiencing the highest number of incidents, while sectors such as water utilities, postal and courier services, space and semiconductors are the least affected. These differences are explained by the relative economic importance of certain sectors as well as by the maturity of organisations when it comes to cyber resilience, an issue being addressed by the revision of the NIS Directive. Respondents to the public consultation have overall rated the consequences of cybersecurity incidents as very high. SMEs consistently rated on average the material consequences of cybersecurity incidents higher than other organisations. 2.3.2.Consequence 2: Increased cost to society to mitigate cyber risks In addition to the costs following an incident, businesses and other organisations are also forced to invest significantly into incident prevention, handling and mitigation as a result of non-secure products with digital elements. Such investments include taking out cybersecurity insurance or putting in place entire company departments dedicated to security, such as cybersecurity incident response teams (CSIRTs) or security operations centres (SOCs). According to the Commission’s impact assessment for the revision of the NIS Directive, the average ICT security spending of companies in 2020 is of approximately 9.14 % of their ICT spending. In the public consultation, both consumers as well as respondents identifying themselves as users agreed with the statement that “The user bears additional costs due to highly priced cybersecurity insurance”, rating it at 4.50 and 3.48 respectively (on a scale from 1 to 5). Similarly, consumers and users agreed with the statement that “The user bears additional costs due to the need to deploy highly priced technical security solutions”, rating it at 3.67 and 4.03 respectively. In particular SMEs in their role as users agreed with the two statements (3.80 and 4.20 respectively). 2.3.3.Consequence 3: Reduced uptake of digital solutions Finally, lacking cybersecurity also creates opportunity costs for businesses, governments and society as whole, when modern technologies are not deployed as quickly as possible for fear of being unable to manage the risks associated with them. This may seem counterintuitive given the recent substantial increase in digitisation caused by the pandemic. But irrespective of the exceptional circumstances in recent years, security concerns are considered as one of the main barriers to the adoption of products with digital elements. In fact, security concerns are one of the main reasons why decision makers are shying away from investments in IoT solutions. A reduced uptake of digital solutions can have a negative impact on innovation, efficiency gains and, as a result, economic growth. 2.3.4.Consequence 4: Risk of emergence of internal market fragmentation While only few Member States have so far introduced measures to regulate the security of products with digital elements at national level (both Germany and Finland have introduced labelling schemes, see section 6.3), the scale of the problems associated with insecure products with digital elements could in the future lead to targeted product-specific interventions at national level. The Council considers the security issues associated with products with digital elements as a matter of urgency and has repeatedly called upon the Commission to propose regulation in this area. Member States are aware that, given the impact on the internal market, measures need to be taken at EU level. In the absence of EU regulation however, they are likely to take further action, within then limits allowed by the treaties. This could be the case particularly to achieve objectives in the areas of safety, health, environment and consumer protection, these being areas where national regulations of this sort could be acceptable without being considered a breach of free movement of goods in the internal market. This could lead to a situation in which manufacturers would be facing an unsystematic approach to product security across the internal market. This could result in internal market fragmentation with negative consequences for the cost-effectiveness and competitiveness of European hardware and software manufacturers (see section 6.3). In the public consultation, respondents rated the question “To what extent do you agree that there is a risk of increasing costs and legal uncertainty for market stakeholders, in the absence of an EU initiative?” with 4.38 out of 5 (with 5 indicating that they fully agree). SMEs responded with 4.4 out of 5, and organisations representing SMEs with 4.5. Finally, in absence of harmonised rules, users, such as critical infrastructures obligated under the revised NIS Directive to take their supply chain security more seriously, may start putting in place diverging contractual requirements for manufacturers of products with digital elements. 2.4.How likely are the problems to persist? There have been numerous efforts to improve the cybersecurity of products with digital elements both by academia and by the manufacturing and development community. For instance, new programming languages, such as Rust or Go, have been developed that minimize the risk of certain types of vulnerabilities, such as memory corruption. Several mostly large manufacturers have started adopting a SDLC with a view to improve software and hardware security. As a result, security software, such as static and dynamic testing tools, has become available on the market, helping manufacturers to verify the security of computer code. Moreover, some manufacturers of products, such as operating systems, browsers and routers, are outfitting their products with automated updating features, ensuring that also inexperienced users can benefit from the latest security updates. In addition, the Cybersecurity Act, which came into force in 2019, provides for the possibility to certify, on a voluntary basis, ICT products, services and processes. A number of product-specific international standards have also emerged, such as ETSI’s Consumer Mobile Device Protection Profile, standards for industrial automation and control systems, or a set of guidelines released by the Open Web Application Security Project (OWASP). Some of the problem drivers described in the previous section may diminish in the future. For example, the labour market may adjust and provide manufacturers with more qualified security professionals, either as a result of market forces or following government measures. Similarly, as a result of awareness raising campaigns and adapted school curricula, users could become more aware of cybersecurity risks and more proficient in using products with digital elements securely. However, while some of the recent market developments and standardisation and certification efforts are steps in the right direction, most of the problem drivers are very unlikely to disappear, given that they are the direct result of persistent structural market failures. The lack of incentives for manufacturers to take the cybersecurity of their products seriously will persist in the presence of negative externalities and information asymmetries, but also against the backdrop of a fast-paced industry that rewards early market entry above everything else. Given that existing standards are voluntary and non-comprehensive, manufacturers have little incentive to apply them. In addition, while new supply chain security requirements for critical infrastructure and other essential entities under the reviewed NIS Directive will help put pressure on hardware and software manufacturers, business users and other organisations, such as public administrations, will continue to lack negotiating power in more concentrated products with digital elements markets.

While there have been various attempts within the market to improve the security of products with digital elements, the overall assessment that many products with digital elements are highly vulnerable is unlikely to change without government intervention. A recent study on software vulnerabilities has concluded that “in 15 years, the vulnerability landscape hasn’t changed; through the lens of the metrics in this paper we aren’t making progress.” As a result, regulators have little reason to believe that the situation will substantially improve without regulatory intervention. In the absence of European legislation, Member States are likely to introduce national regulations laying down security requirements on such categories of products, within the limits allowed by EU law. While national intervention could contribute to reducing the problem of low product security, it would inevitably also lead to internal market fragmentation, preventing manufacturers on an otherwise global products market from providing hardware and software solutions across the internal market in a cost-effective manner (see section 6.3 for more details). 3.Why should the EU act? 3.1.Legal basis This intervention will be based on Article 114 of the Treaty on the Functioning of the European Union (TFEU), whose objective is the establishment and functioning of the internal market by enhancing measures for the approximation of national rules. The measures must be intended to improve the conditions for the establishment and functioning of the internal market and must genuinely have that objective, actually contributing to the elimination of obstacles to the free movement of goods or services, or to the removal of distortions of competition. Article 114 TFEU may be used as a legal basis to prevent the occurrence of these obstacles resulting from diverging national laws and approaches on how to address the legal uncertainties and gaps in the existing legal frameworks. Furthermore, the Court of Justice has recognised that applying heterogeneous technical requirements could be valid grounds to trigger Article 114 TFEU. The present intervention would aim to improve the internal market’s functioning by streamlining and supplementing existing rules. The current EU legislative framework applicable to products with digital elements is based on Article 114, and comprises several pieces of legislation, including on specific products and safety-related aspects or general legislation on product liability. However, it covers only certain aspects linked to the cybersecurity of tangible products with digital elements and, as applicable, software embedded in these products. As explained in more detail in section 6.3, at national level, Member States are starting to take national measures requiring manufacturers of products with digital elements to enhance their cybersecurity. At the same time, the cybersecurity of products with digital elements has a particularly strong cross-border dimension, as products manufactured in one country are often used by organisations and consumers across the entire internal market. Incidents that initially concern a single entity or Member State often spread within minutes across organisations, sectors and several Member States. The various acts and initiatives taken so far at EU and national levels only partially address the problems identified and risk creating a legislative patchwork within the internal market, increasing legal uncertainty for both manufacturers and users of these products and adding unnecessary burden on companies to comply with a number of requirements for similar types of products. Therefore, the envisaged intervention would harmonise and streamline the EU regulatory landscape by introducing cybersecurity requirements for products with digital elements and avoid overlapping requirements stemming from different pieces of legislation. A horizontal regulatory intervention on cybersecurity of products would do away with legal uncertainty on these aspects triggered by a patched approach taken in various product-specific or general product-related pieces of legislation. It would create greater legal certainty for operators and users across the Union, as well as a harmonisation of the European single market, creating more viable conditions for operators aiming at entering the EU market. 3.2.Subsidiarity: Necessity of EU action The strong cross-border nature of cybersecurity in general and the growing risks and incidents, which have spill-over effects across borders, sectors and products, mean that the objectives of the present intervention cannot effectively be achieved by Member States alone. Taking into account the global nature of markets for products with digital elements, Member States face the same risks with respect to the same product with digital elements on their territory. For example, a recent study on infected IoT products across the internal market has revealed that it is the same nine manufacturers in each country that are responsible for placing the highest number of IoT devices on the market that have been infected as a result of vulnerabilities, concluding that “international collaboration among regulators in various countries is a feasible path. This would not only bundle scarce resources on the side of governments, but is also more likely to influence manufacturer behaviour through collective action. An obvious starting point would be coordination at the level of the European Union.” An emerging patchy framework of potentially diverging national rules also risks hampering an open and competitive single market for products with digital elements. Some Member States, such as Germany and Finland have already taken first (non-binding) measures to improve the security of products with digital elements (see section 6.3). National approaches in addressing the problems, and in particular approaches introducing mandatory requirements, will only create additional legal uncertainty and legal barriers. Companies could be prevented from seamlessly expanding into other Member States, depriving users of the benefits of their products. Given the lack of negotiation power of individual users on a global products market with large multinational manufacturers (see section 2.2.5), regulation at national level would not be effective. In a 2021 report, the Dutch Safety Board concluded that the products with digital elements market “can hardly be influenced by users in the Netherlands alone. Influencing such a global market requires a larger power block, for example at EU or UN level, or based on joint actions by end users.” Joint action at EU level is therefore necessary to establish a high level of trust among users, increasing the attractiveness of EU products with digital elements. It would also benefit the (digital) single market and internal market in general by providing legal certainty and achieving a level playing field for manufacturers of products with digital elements. Ultimately, as referred to in section 1, the Council Conclusions of 23 May 2022 on the development of the European Union’s cyber posture call upon the Commission to propose, by the end of 2022, common cybersecurity requirements for connected devices. 3.3.Subsidiarity: Added value of EU action The objectives of the initiative can be better achieved at Union level so as to avoid a further fragmentation of the single market into potentially contradictory national frameworks. A single framework regarding cybersecurity requirements for products with digital elements would provide legal certainty and avoid overlapping or contradictory requirements stemming from different pieces of legislation. Harmonised EU requirements would facilitate compliance for manufacturers of products with digital elements and create more viable conditions for operators aiming at entering the EU market. Users’ trust that products with digital elements acquired in any Member State comply with a harmonised set of requirements would increase their trust in and demand for these products. Given the global and cross-border nature of the digital market and the internet, the intervention would reduce negative cross-border spill-overs and costs to society linked to mitigating risks of non-secure products. As regards the proportionality of the intervention, the measures in the policy options considered would not go beyond what is needed to achieve the general and specific objectives and would not impose disproportionate costs. More specifically, the intervention considered would ensure that products with digital elements would be secured throughout their whole life cycle and proportionally to the risks faced through objective-oriented and technology neutral requirements that remain reasonable and generally corresponding to the interest of the entities involved. 4.Objectives: What is to be achieved?

4.1.General objectives Based on the main problems identified in the section 2.1, the main objectives of the intervention should be as follows: General Objective 1 (GO1): Ensure the proper functioning of the internal market and prevent market fragmentation by creating harmonised conditions for the development of secure products with digital elements. The intervention should ensure that hardware and software products are released to the market with fewer vulnerabilities and that manufactures take the security seriously throughout a product’s entire life cycle, in particular by providing timely security updates. In addition, it is important that manufacturers prevent malicious actors from tampering with production code. General Objective 2 (GO2): Ensure the proper functioning of the internal market and prevent market fragmentation by creating harmonised allowing users to take cybersecurity into account when selecting and using products with digital elements. The intervention should ensure that both consumers as well as business users and other organisations are able to select products whose security properties match their security requirements. In addition, measures should be taken to support users in operating technical in a secure manner. 4.2.Specific objectives Based on the problem drivers identified in section 2.2 and with a view to reaching the two general objectives defined above, the specific objectives of the intervention should be as follows: To address the problem of low level of cybersecurity of products with digital elements marketed in the Union: SPO1 Ensure that manufacturers improve the security of their products with digital elements since the design and development phase and throughout the whole life cycle of those products SPO2 Ensure a coherent cybersecurity framework, facilitating compliance for hardware and software manufacturers To address the problem of insufficient understanding among users as regards the cybersecurity of products: SPO3 Enhance the transparency as regards the security properties of products with digital elements SPO4 Enable organisations and consumers to use products with digital elements securely As referred to in section 2.2.5, there are certain additional problem drivers that will not be addressed by the proposed intervention. This is not to say that the intervention will have no impact at all on these drivers (see section 6.7). 5.What are the available policy options? This section presents the policy options, including the baseline scenario, that have been considered for addressing the problems identified in section 2 and meeting the objectives set out in section 4.





Problem drivers Specific policy objectives Policy options PO1 (soft law) PO2 (ad-hoc interv.) PO3 (mixed appr.) PO4 (horiz. interv.) PO4 a) (horiz. interv. only critical software) PO4 b) (horiz. interv. all software) PO 3 i) PO 3 ii) PO 4 a) i) PO 4 a) ii) PO4 b) i) PO4 b) ii) DR1: Lack of incentives for manufacturers to take security seriously SPO1: Ensure that manufacturers improve the security of their products with digital elements since the design and development phase and throughout the whole life cycle of those products —Communications, guidance and recommendations for supply side stakeholders, including on non-embedded software —Recommendation on public procurement of products with digital elements — Development of additional European cybersecurity certification schemes —Amendments to existing product specific legislation —Integrate cybersecurity into future product-specific NLF legislation —Horizontal regulatory intervention for tangible products with digital elements (excluding non-embedded software) —A potential legal act on non-embedded software at a later stage (staggered approach) —Horizontal regulatory intervention for a broad scope of tangible and only critical intangible products with digital elements (including non-embedded software) —Horizontal regulatory intervention for a broad scope of tangible and intangible products with digital elements (including non-embedded software) — self-assessment by default for all products covered — third-party assessment for a narrow share of critical tangible products — self-assessment by default for all products covered — third-party assessment for a narrow share of critical tangible and intangible products — self-assessment by default for all products — third-party assessment for a narrow share of critical tangible and intangible products DR2: Piecemeal coverage of cybersecurity in EU policies SPO2: Ensure a coherent cybersecurity framework DR3: Manufacturers do not provide information on security properties and vulnerabilities SPO3: Enhance the transparency as regards the security properties of products with digital elements (partly included in the measures addressing DR1) (partly included in the measures addressing DR1) Horizontal intervention to include transparency requirements for tangible products with digital elements on security properties Horizontal intervention to include transparency requirements for both tangible and critical intangible products with digital elements on security properties Horizontal intervention to include transparency requirements for both tangible and intangible products with digital elements on security properties DR4: Manufacturers do not provide information on secure use SPO4: Enable organisations and consumers to use products with digital elements securely (partly included in the measures addressing DR1) (partly included in the measures addressing DR1) Horizontal intervention to include transparency for tangible products with digital elements requirements on secure use Horizontal intervention to include transparency requirements for both tangible and critical intangible products with digital elements on secure use Horizontal intervention to include transparency requirements for both tangible and intangible products with digital elements on secure use 5.1.What is the baseline from which options are assessed? 5.1.1.The relevant EU markets A horizontal regulatory intervention would lay down requirements for some or all products with digital elements marketed in the Union (with the broadest scope under policy option 4). Requirements would not only cover the final product with digital elements (e.g. a smart phone), but also their components, both for hardware and software. As a result, depending on the policy options, the initiative would have an impact throughout the entire digital supply chain, and provide users with a very high level of assurance regarding the security of products. See also the illustrative example of smart phones in the description of options 3 and 4, section 5.2. The relevant markets include software and hardware products, which the policy options will impact to a different extent. Due to the absence of a consistent and comparable publicly available dataset on the dimension of the market for products with digital elements, certain proxy indicators have been used to assess the value of the relevant markets. The methodology and the market analysis is described in more detail in Annex 3. The analysis includes the value produced by both non-EU and EU companies in the EU market, while it was not possible to generate aggregated values for each of these two. 5.1.1.1.Software market Based on the data gathered by a recent study which provided for a breakdown of the software and software-based services market, the following categories can be identified: (1) Software products; (2) Software-related services; (3) Cloud computing; (4) Games. The present analysis is focused on software products (including games) and does not explore the specific markets related to software services and cloud. This is because the latter would not be included in the scope of a potential horizontal regulation (policy options 3 and 4), since only products (and hence software as a product) would be included in the scope and not services. The proxy indicator used to assess the dimension of the software market is based on a subset of NACE 2 activities of the Information and Communication sector (see Annex 3). The proxy indicates that, in 2019, the production value of the EU-27 software development amounted to over EUR 236 billion. During the same year, the sector recorded a turnover of EUR 265 billion with a total number of enterprises of 365 759. In terms of number of companies, the software industry is almost entirely composed of SMEs. Whereas the total number of enterprises for the selected sample amounted to 341 781 in 2019, the number of SMEs operating in the software market in the same year reached 340 918, accounting for 99.7 % of the total. However, when looking at the turnover generated by SMEs in the software market for sample countries, it accounts for 41 % of the EUR 305 444 billion which shows the important relative weight of big market players that may constitute only 0.3 % of enterprises in the market but generate 59 % of revenue. When referring to turnover, it is difficult to assess the share of the revenues related to B2C and B2B. Nevertheless, by looking at the German software market, it is possible to highlight that those revenues from software sales rely heavily on B2B with 67.9 % of revenue being driven from business. This split shows a high integration of the software market with other economic sectors that rely on software for their operations. The size of embedded software is valued at EUR 2.4 billion in 2020 and is expected to continue growing at a compound annual growth rate (CAGR) of 5.5 % from 2021 to 2027. Non-embedded software represents the biggest part of the industry’s sales. Globally, the revenue in the software market is projected to reach USD 608.70 billion in 2022, with nearly half of the revenue generated in the United States. Most competitive software companies are from the United States followed by Asia. According to McKinsey, in 2020, there was no European company on the list of the world’s ten most valuable software and software-enabled companies, and were only three among the top 20. Furthermore, over a third of the 100 most valuable companies in the United States came from the software sector, as did about a quarter of those in Asia. In Europe, that figure stood at just 7 %. 5.1.1.2.Hardware market To estimate the value of the hardware market, several proxies were explored based on Eurostat data in the study accompanying the impact assessment: the ICT manufacturing sector – standard classification (ICT-SC) and the extended classification (ICT-EXT-ADJ). The latter covers more manufacturing sectors than those which are ‘purely’ digital. The estimates based only on the ICT manufacturing sector are under the real values of all products with digital elements placed on the Union market. At the same time, the estimates based on the extended classification are likely over the real value: The adjustment indicators used to estimate the weight of products with digital elements as compared to non-products with digital elements within the same category are an overestimation, since the proxy used for this adjustment considered the digital intensity of the manufacturing sub-sectors, which does not necessarily match the production of digital goods (see Annex 3). In 2019, the production value of the EU-27 ICT-SC amounted to EUR 222 billion. During the same year, the sector recorded a turnover of EUR 285 billion with a total number of enterprises of 22 773. When considering the ICT-EXT-ADJ indicator, the production value of the EU-27 amounted to EUR 1 081 billion, the turnover to EUR 1 220 billion and the total number of enterprises of 249 513 in 2019. As mentioned above, this would most likely be an overestimation. The European ICT-SC manufacturing industry is almost entirely composed of SMEs. Whereas the total number of enterprises amounted to 22 773 in 2019, the number of SMEs operating in the hardware market in the same year reached 22 119, accounting for 97.13 % of the total. However, when looking at the turnover generated by SMEs in the hardware market, it accounts for 21.9 % of the global turnover which shows the very important weight of larger companies that may constitute only 2.87 % of enterprises in the market but generate 78.1 % of revenue. The weight of the ICT manufacturing on the overall European economy was stable over the past five years and still appears to be limited, amounting to 0.41 % in 2019.

When referring to turnover, it is difficult to assess the share of the revenues related to B2C and B2B. Nevertheless, by looking at the German hardware market, it is possible to highlight that revenues from hardware sales were equally split between the B2B (48.1 %) and B2C (51.9 %) sectors in 2018. The reason behind this split is the strong consumer business stream connected to the sale of smartphones, laptops and general consumer electronics. This represents an important distinction with the software and services market where the B2B component appears to be predominant, accounting for more than two-thirds of the overall sales. 5.1.1.3.Total market value The global market for products with digital elements encompassing software and hardware has a total production value in Europe of EUR 458 billion and turnover of EUR 550 billion in 2019, if the hardware market is considered as only including the elements of the ICT-SC indicator. The number of enterprises operating in this sector is 388 532, when considering the limited scope of ICT-SC, with a vast majority being SMEs (99.58%). Considering the extended classification (ICT-EXT-ADJ), these values are up to EUR 1317 billion in production value and EUR 1485 billion in turnover for 2019. The number of enterprises in this sector is 615 272, with a vast majority being SMEs (99.58%). These estimates however may be overestimated since they rely on proxies of digital intensity and not production of digital goods per se. Based on this data, under both indicators, SMEs account for about 34.4 % of the turnover generated in the market for products with digital elements for 2019. Aggregated indicators for the global market for products with digital elements in 2019 can be found in Annex 3. 5.1.2.Baseline scenario The baseline scenario entails no common (i.e. horizontal) legislation to set cybersecurity requirements for products with digital elements. As referred to in sections 1 and 2.2.2., the current EU framework applicable to products comprises several pieces of legislation that cover only certain aspects linked to the cybersecurity of tangible products with digital elements and, where applicable, embedded software concerning these products. This legislative framework was not conceived to tackle specifically the challenges linked to cybersecurity of products with digital elements. It largely covers requirements for placing the products on the market, but not necessarily for the whole life cycle of products, which is crucial in the case of products with digital elements. The current legislation also fails to cover a variety of widely used hardware. Moreover, non-embedded software is not currently addressed despite the major impact resulting from insecure non-embedded software. for a detailed gap analysis, see Annex 13. As a significant first step towards increasing the level of cybersecurity of wireless devices, the delegated act under RED, adopted in October 2021, aims to improve the cybersecurity of these devices on the European market by laying down new general requirements which manufacturers will have to follow in the design and production of the concerned products, constitutes. Non-embedded software is however not covered by these requirements. Furthermore, the act does not provide for duty of care for the whole life cycle of these products. It can be assumed that, given the pace, spread and importance of digitization for all sectors of economy, any new product-related legislation in the NLF would include certain cybersecurity-related aspects. However, these would be product- and/or sector-specific and therefore would not be able to address cybersecurity risks in a targeted and comprehensive way. Leaving the integration of cybersecurity-related requirements only for certain product legislation would leave other categories of products not covered by such measures and possibly raise the risk of different and even diverging requirements stemming from separate pieces of legislation. This would lead to a fragmented regulatory landscape, potential discrimination and legal uncertainty, affecting the well-functioning of the internal market. Maintaining this status quo would therefore mean that cybersecurity would remain only partially addressed in product-related legislation, while existing horizontal cybersecurity legislation, such as the NIS framework or the Cybersecurity Act, would not provide for the means to establish cybersecurity requirements for products with digital elements. In the scenario of maintaining the status quo, the development of European voluntary cybersecurity certifications schemes would continue as foreseen, based on the Cybersecurity Act, implying a voluntary conformity assessment. Manufacturers do not have a legal obligation to seek certification for their products. The proposal for the NIS2 Directive expected to enter into force before the end of 2022, with a transposition period of 21 months, provides for an empowerment for the Commission to adopt delegated acts specifying categories of essential entities shall be required to obtain a certificate under a European certification scheme. However, this would rather cover a limited category of products used in particular sectors and would therefore not be sufficient to address systematic cybersecurity-related issues of all products with digital elements, as described in section 2. Other voluntary national practices and measures would continue, such as voluntary labelling measures of certain categories of products, as it is currently the case in few Member States. This can raise the risk of further fragmenting the internal market. Finally, maintaining the status quo would entail no specific soft law or regulation at EU level as regards cybersecurity of standalone software. At national level, Member States may develop targeted initiatives within the boundaries of European law to better protect their consumers. For example, Member States could put in place diverging security and transparency obligations for operating systems or virtual private network software, which is becoming increasingly popular since the beginning of pandemic. In absence of harmonised rules, users, such as critical infrastructures obligated under the revised NIS Directive to take their supply chain security more seriously, may start putting in place diverging contractual requirements for manufacturers of products with digital elements. At global level, it can be assumed that the security of supply chain measures taken recently, in particular in the United States of America (notably mandatory measures for critical software under public procurement) and the UK (notably security requirements of consumer IoT), as well as potentially further similar measures, would influence the playing field for European manufacturers present on global markets, potentially putting them at a disadvantage. A horizontal European regulation in this regard would be the most comprehensive to be introduced world-wide, creating legal certainty and getting Europe to set the path forward for cybersecurity in products with digital elements at global level. As described in section 2.4, some problem drivers may diminish in the future. The labour market may for example provide more qualified security professionals, either as a result of market forces or due to government intervention. Awareness raising campaigns and adapted school curricula may also lead to users become more aware of cybersecurity risks and more proficient in using producta with digital elements securely. Additional international standards on products and processes may also emerge, helping manufacturers improve the design and development of products with digital elements. 5.2.Description of the policy options The policy options analysed range from the least interventionist and closer to the baseline scenario (option 1 – soft law approach and voluntary measures), through a lighter option that could entail certain legislative interventions on a case-by-case basis (option 2 – ad-hoc regulatory intervention), up to the most interventionist (options 3 and 4 – horizontal regulation on cybersecurity), with option 4 varying in relation to scope (option 4 b) having the most comprehensive scope, all products with digital elements, covering also non-embedded software). Both policy options 3 and 4 also vary in relation to the level of conformity assessment (with and without mandatory third-party assessment). Furthermore, the various options analysed took account of the extent to which various measures, vertical or horizontal, or combination thereof could address the type of cybersecurity risks the products with digital elements are exposed to and the problems identified and their drivers.

Policy options 3 and 4 are based on the New Legislative Framework (NLF). The NLF places obligations on manufacturers and their authorised representatives as well as on importers and distributors. A detailed description of the NLF can be found in Annex 11. The NLF is primarily a framework placing obligations on economic operators, as the aforementioned types of entities. As a result, it is not foreseen to place obligations on users, such as consumers as well as companies or other types of organisations. Departing from the status quo, the following options are therefore considered in view of the specific objectives to be achieved as set out in section 4.2 above. Option 1: Soft law approach and voluntary measures In this option, there would be no mandatory regulatory intervention. Instead, the Commission would issue communications, guidance, recommendations and potentially codes of conduct to encourage voluntary measures (self regulation), including potentially on non-embedded software, and provide guidance to support supply-side stakeholders to enhance the digital security of their products. These guidelines or recommendations could consider the elements that are referred to in options 3 and 4 below under the potential cybersecurity requirements. Such recommendations or guidelines could also be limited only to the public procurement of products with digital elements, given existing practices of public procurement which oftentimes include security-related considerations, such as due diligence in respect of cybersecurity when procuring certain products with digital elements in certain sectors or by certain agencies. Recommendations for public procurement may also ultimately have broader effects beyond strictly the public procurement framework and be also considered in private procurement a good practices. At the same time, it would be expected for the Union Rolling Work Programme for European cybersecurity certification, on the basis of Article 47(5) of the Cybersecurity Act, to consider the development of additional European cybersecurity certification schemes that would cover more categories of products for which cybersecurity is currently not being properly addressed, such as industrial IoT. These schemes would remain voluntary, unless otherwise decided via a delegated act for particular categories of products used in particular sectors through the empowerment provided to the Commission on the basis of the NIS2 Directive, once it enters into force. National schemes (e.g. labelling), voluntary or mandatory, would continue to be developed to compensate for the lack of EU horizontal rules. Option 2: Ad-hoc regulatory intervention for cybersecurity of tangible products with digital elements and respective embedded software This option would entail an ad-hoc product-specific regulatory intervention that would be limited to adding and/or amending the cybersecurity requirements in the already existing legislation or introducing new legislation as new risks emerge, including potentially on non-embedded software. A number of legislative initiatives or reviews are currently being prepared or negotiated with a view to integrate more broadly digitization and the development of new technologies, with a tendency to cover certain cybersecurity aspects, either through a safety angle (see the general product safety framework) or more specifically to certain technologies or products (e.g. AI). A scenario where this approach would be continued, in the absence of a horizontal intervention, can therefore be considered realistic. More specifically, I.For existing NLF legislation, it would entail: Øcase-by-case analyses that may lead to legislative amendments (gradually or at once) in relation to those products that have a digital element, but for which the existing legislation does not foresee any cybersecurity requirements. Øbased on a case-by-case analysis, consider amendments to legislation already containing certain cybersecurity requirements, to the extent necessary, to include more specific or targeted cybersecurity requirements, including where applicable in relation to embedded software. This could a possible amendment of the RED Directive in order to equally extend the scope of the RED delegated act and to include non-embedded software as well as a duty of care obligation for the whole life cycle of the product. II.For future NLF legislation, it would entail: Øcybersecurity requirements to be introduced when new product (NLF) legislation is developed and cybersecurity relevant. III.For ‘old approach’ product legislation, it would entail: ØWhere necessary and where the basic acts allows, introducing amendments, in particular for empowerments on complementing or further specifying cybersecurity requirements via delegated or implementing acts. Note: The next two options (3 and 4) entail a horizontal regulatory intervention varying in scope, largely following the NLF approach. This framework typically sets essential requirements as a condition for the placement of certain products on the internal market. These requirements are objective-oriented, followed at a later stage by harmonised standards developed by standardisation bodies, which elaborate on the technical means through which the requirements could be met. More information on standards can be found in Annex 14. NLF legislation also typically provides for conformity assessment, which is the process conducted by the manufacturer to demonstrate whether the essential requirements relating to a product or process have been fulfilled. Conformity assessment procedures are composed of conformity assessment modules defined by the NLF, ranging from self-assessment by the manufacturer up to the assessment in certain circumstances, or in consideration of certain risks, by independent third parties. The latter are known generally as conformity assessment bodies, or more formally as ‘notified bodies’. Member States have the responsibility to decide which of their conformity assessment bodies fulfil the necessary criteria to become notified. This may happen through an accreditation process. Accreditation is a formal system which provides an independent attestation of the competence, impartiality and integrity of conformity assessment bodies. The NLF framework also typically provides for EU market surveillance, which is under the responsibility of the Member States. For more details, see Annex 11. Option 3: Mixed approach, including horizontal mandatory rules for cybersecurity of tangible products with digital elements and respective embedded software and a staggered approach for non-embedded software This option would entail a regulation introducing horizontal cybersecurity requirements for all tangible products with digital elements and the software embedded within these, as a condition for placement on the market. Non-embedded software would not be regulated. Given its relatively broad scope and since the policy option proposes both security requirements as well as transparency requirements, policy option 3 addresses all four problem drivers as far as hardware products and their embedded software is concerned. Obligations would apply to manufacturers and to a lesser extent to also to distributors (such as online shops or brick and mortar stores) as well as to importers. The main building blocks of the regulatory intervention under this option would be as follows:

a)Scope: ·all tangible products with digital elements, i.e. hardware (e.g. end devices such as: laptops, smartphones, sensors and cameras; smart robots; smart cards; smart meters; mobile devices; smart speakers or networks, such as: routers; switches) ·the respective embedded software associated with these products, meaning firmware or other software that is essential for the function of the end-product (e.g. operating systems; network system; storage and security management, etc.). It will not cover non-embedded software, meaning software that is additional to the function of the device on which it is downloaded (e.g. extended operating system, mobile apps). Instead, a staggered approach would be considered, with soft law measures such as guidelines or recommendations taken as a first step, potentially followed by horizontal regulatory intervention, depending on the results of implementing such measures. The reason is that traditionally non-embedded software is not covered by existing product legislation within the NLF and therefore an intermediary period could be considered via soft law measures to test the potential uptake by the relevant software manufacturers. The rationale of analysing an option not covering non-embedded software in the scope is as follows: (i) it corresponds to the current NLF legislation, which covers as a rule tangible products and at most their embedded software and (ii) it is an option suggested by certain stakeholders on the grounds that more judicious consideration is necessary before imposing cybersecurity requirements on non-embedded software due to its intangible nature. The definition of “product with digital elements” would specify that “products with digital elements” refer to both hardware and software as well as hardware and software components placed on the market separately. b)Requirements and obligations: In terms of cybersecurity requirements and obligations for economic operators, it would mandate that tangible products with digital elements and their embedded software shall only be made available on the market if, where dully supplied, properly installed, maintained and used for their intended purpose or under conditions which can be reasonably foreseen, they meet the specific cybersecurity requirements. While manufacturers would be required to comply with the requirements, they would not be held accountable for how the product will be used. Nature of the requirements: These requirements would be objective-oriented, technology-neutral and future proof against a fast-evolving product and technology landscape. They would not be sector or product-specific. In terms of granularity, they would not be too prescriptive as they would be applicable to a wide category of products, yet more specific than a very generic principle that would only require that products are cyber secure or protected. Content of the requirements: The requirements would mandate manufacturers to factor in cybersecurity in the design and development of the products with digital elements, to exercise due diligence on security aspects when designing and developing their products, to be transparent on cybersecurity aspects that need to be made known to customers and to ensure security support (updates) in a proportionate way. More specifically, manufacturers would mainly be mandated to: ·Design and develop these products in consideration of the risk posed to the security of network and information systems. ·Design and develop these products in such a way that they provide adequate resilience against security threats, ensure that the products can be used securely and ensure protection of stored, transmitted or otherwise processed data and that security is taken into account, as applicable, in all phases of the design, development and production process. ·Put in place design and development solutions for the product, i.e. security by design and by default mechanisms, to deliver with a secure by default configuration; capabilities to perform or support integrity checks; authentication and access control mechanisms;guarantees for protection of the exposed attack surfaces; protection against degradation or denial of service attacks; ways for enabling adequate security updates and ensure that adequate security support can be received. ·In addition to the product-related security requirements described above, have in place vulnerability management, vulnerability disclosure policies and testing. ·In addition, to ensure the effective functioning and security of the internal market and awareness of cybersecurity risks by relevant authorities and bodies, manufacturers should report vulnerabilities that are being actively exploited and any incident having an impact on the cybersecurity of these products to the EU agency for cybersecurity, ENISA. Based on the received information, ENISA should prepare intelligence on emerging trends regarding cybersecurity risks in products with digital elements to the national competent authorities and the European Commission, e.g. in the NIS Cooperation Group, as well as provide advice to support the implementation process of this Regulation. These requirements derive from the overall objective of ensuring a high level of cybersecurity of products with digital elements. They take account of well-settled practices in terms of cybersecurity of products, factoring in the security objectives that the Cybersecurity Act establishes, as well as existing international standards for certain specific products, such as the ETSI standards for IoT consumer products. The above-mentioned requirements are inter-dependent and complementary to each other, ensuring as a whole that the respective product would be secure. For example, for certain risks and intended use cases it may be appropriate to integrate an authentication mechanism into a device to prevent unauthorised access and data theft (requirement "protection from unauthorised access by appropriate control mechanisms"). For this requirement to be effective, it is essential that other requirements are fulfilled as well: for instance, if the device is shipped with a widely-known default password, a malicious actor could access the data despite an adequate authentication mechanism being in place. The device should therefore not be shipped with any default password, but instead require users to select a strong custom password upon first use (requirement "delivered with a secure by default configuration"). In addition to the above-mentioned requirements concerning the products as such, obligations would be set up for economic operators, starting from manufacturers, up to distributors and importers, in relation to the placement on the market of the tangible products with digital elements and their embedded software, as adequate for their role and responsibilities on the supply chain. These obligations would mainly be: ·Transparency-related, including in terms of information made available to end users, keeping records or disclosure of information concerning the components of a product, ensuring duty of care, vulnerability disclosure.

·Making available technical documentation. ·Providing information and guidance to users on cybersecurity aspects. Who should respect these obligations? When placing any product with digital elements on the market, manufacturers would be required to ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out by the regulation. This would apply no matter whether the product is for end users or embedded in a final product. For tangible products with digital elements and software embedded in such products that is essential for the functions of these products, the responsibility for the compliance wit