Areas of Union competence deriving from the Treaty (Article 114 of the Treaty on the Functioning of the European Union) The European Parliament and the Council shall, acting in accordance with the ordinary legislative procedure and after consulting the Economic and Social Committee, adopt the measures for the approximation of the provisions laid down by law, regulation or administrative action in Member States which have as their object the establishment and functioning of the internal market. The Internal Market responsibility is a shared competence between the Union and the Member States (Article 4(2)(a) TFEU).

Competences of the Agency (Regulation (EU) No 526/2013 of the European Parliament and of the Council) Objectives 1. The Agency shall develop and maintain a high level of expertise. 2. The Agency shall assist the Union institutions, bodies, offices and agencies in developing policies in network and information security. 3. The Agency shall assist the Union institutions, bodies, offices and agencies and the Member States in implementing the policies necessary to meet the legal and regulatory requirements of network and information security under existing and future legal acts of the Union, thus contributing to the proper functioning of the internal market. 4. The Agency shall assist the Union and the Member States in enhancing and strengthening their capability and preparedness to prevent, detect and respond to network and information security problems and incidents. 5. The Agency shall use its expertise to stimulate broad cooperation between actors from the public and private sectors. Tasks 1. The Agency shall perform the following tasks: (a) support the development of Union policy and law, by: (i) assisting and advising on all matters relating to Union network and information security policy and law; (ii) providing preparatory work, advice and analyses relating to the development and update of Union network and information security policy and law; (iii) analysing publicly available network and information security strategies and promoting their publication; (b) support capability building by: (i) supporting Member States, at their request, in their efforts to develop and improve the prevention, detection and analysis of and the capability to respond to network and information security problems and incidents, and providing them with the necessary knowledge; (ii) promoting and facilitating voluntary cooperation among the Member States and between the Union institutions, bodies, offices and agencies and the Member States in their efforts to prevent, detect and respond to network and information security problems and incidents where these have an impact across borders; (iii) assisting the Union institutions, bodies, offices and agencies in their efforts to develop the prevention, detection and analysis of and the capability to respond to network and information security problems and incidents, in particular by supporting the operation of a Computer Emergency Response Team (CERT) for them; (iv) supporting the raising of the level of capabilities of national/governmental and Union CERTs, including by promoting dialogue and exchange of information, with a view to ensuring that, with regard to the state of the art, each CERT meets a common set of minimum capabilities and operates according to best practices; (v) supporting the organisation and running of Union network and information security exercises, and, at their request, advising Member States on national exercises; (vi) assisting the Union institutions, bodies, offices and agencies and the Member States in their efforts to collect, analyse and, in line with Member States’ security requirements, disseminate relevant network and information security data; and on the basis of information provided by the Union institutions, bodies, offices and agencies and the Member States in accordance with provisions of Union law and national provisions in compliance with Union law, maintaining the awareness, on the part of the Union institutions, bodies, offices and agencies as well as the Member States of the latest state of network and information security in the Union for their benefit; (vii) supporting the development of a Union early warning mechanism that is complementary to Member States’ mechanisms; (viii) offering network and information security training for relevant public bodies, where appropriate in cooperation with stakeholders; (c) support voluntary cooperation among competent public bodies, and between stakeholders, including universities and research centres in the Union, and support awareness raising, inter alia, by: (i) promoting cooperation between national and governmental CERTs or Computer Security Incident Response Teams (CSIRTs), including the CERT for the Union institutions, bodies, offices and agencies; (ii) promoting the development and sharing of best practices with the aim of attaining an advanced level of network and information security; (iii) facilitating dialogue and efforts to develop and exchange best practices; (iv) promoting best practices in information sharing and awareness raising; (v) supporting the Union institutions, bodies, offices and agencies and, at their request, the Member States and their relevant bodies in organising awareness raising, including at the level of individual users, and other outreach activities to increase network and information security and its visibility by providing best practices and guidelines; (d) support research and development and standardisation, by: (i) facilitating the establishment and take-up of European and international standards for risk management and for the security of electronic products, networks and services; (ii) advising the Union and the Member States on research needs in the area of network and information security with a view to enabling effective responses to current and emerging network and information security risks and threats, including with respect to new and emerging information and communications technologies, and to using risk-prevention technologies effectively; (e) cooperate with Union institutions, bodies, offices and agencies, including those dealing with cybercrime and the protection of privacy and personal data, with a view to addressing issues of common concern, including by: (i) exchanging know-how and best practices; (ii) providing advice on relevant network and information security aspects in order to develop synergies; (f) contribute to the Union’s efforts to cooperate with third countries and international organisations to promote international cooperation on network and information security issues, including by: (i) being engaged, where appropriate, as an observer and in the organisation of international exercises, and analysing and reporting on the outcome of such exercises; (ii) facilitating exchange of best practices of relevant organisations; (iii) providing the Union institutions with expertise. 2. Union institutions, bodies, offices and agencies and Member State bodies may request advice from the Agency in the event of breach of security or loss of integrity with a significant impact on the operation of networks and services. 3. The Agency shall carry out tasks conferred on it by legal acts of the Union. 4. The Agency shall express independently its own conclusions, guidance and advice on matters within the scope and objectives of this Regulation.

Governance Management Board The Management Board is composed of one representative of each Member State, and two representatives appointed by the Commission. All representatives have voting rights. Each member of the Management Board has an alternate to represent the member in his/her absence. Members of the Management Board and their alternates are appointed in light of their knowledge of the Agency’s tasks and objectives, taking into account the managerial, administrative and budgetary skills relevant to fulfil the tasks of a member of the Management Board. The term of office of members of the Management Board and of their alternates is four years. That term is renewable. Permanent Stakeholders Group The Management Board, acting on a proposal by the Executive Director, sets up a Permanent Stakeholders’ Group composed of recognised experts representing the relevant stakeholders, such as the ICT industry, providers of electronic communications networks or services available to the public, consumer groups, academic experts in network and information security, and representatives of national regulatory authorities notified under Directive 2002/21/EC as well as of law enforcement and privacy protection authorities. The term of office of the Permanent Stakeholders’ Group’s members is two-and-a-half years. The Permanent Stakeholders’ Group advises the Agency in respect of the performance of its activities. In particular, it advises the Executive Director on drawing up a proposal for the Agency’s work programme, and on ensuring communication with the relevant stakeholders on all issues related to the work programme. Executive Director The Executive Director is appointed by the Management Board, from a list of candidates proposed by the Commission, following an open and transparent selection procedure, for a term of five years which is renewable. Executive Board The Executive Board is made up of five members appointed from among the members of the Management Board and includes the Chairperson of the Management Board, who may also chair the Executive Board, and one of the representatives of the Commission. External audit European Court of Auditors. Internal audit Internal Audit Service of the European Commission. Discharge authority European Parliament on a recommendation from the Council.

Resources made available to the Agency in 2014 (2013) Final Budget 9,7 million euro (9,7 million euro) of which the Union subsidy is 94 % (93 %). Staff at 31 December 2014 48 (47) posts in the establishment plan, of which occupied: 46 (43). Other posts occupied: 14 (13) contract staff, two (three) Seconded National Experts. Total staff: 62 (59), undertaking the following tasks: operational: 44 (42) administrative: 18 (17)