EUROPEAN COMMISSION Brussels, 13.9.2017 SWD(2017) 501 final COMMISSION STAFF WORKING DOCUMENT



EXECUTIVE SUMMARY OF THE IMPACT ASSESSMENT

Accompanying the document Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on ENISA, the "EU Cybersecurity Agency", and repealing Regulation (EU) 526/2013, and on Information and Communication Technology cybersecurity certification (''Cybersecurity Act'') {COM(2017) 477 final}

{SWD(2017) 500 final}

{SWD(2017) 502 final}



A.Need for action What is the problem and why is it a problem? Digital technologies and the Internet are the backbones of EU economy and society. Critical economic sectors such as transport, energy, health or finance have become increasingly dependent on network and information systems to run their core businesses. The Internet of Things connects objects and people through communication networks. This new reality creates unprecedented opportunities and also vulnerabilities. Cyber incidents are indeed booming. Their complexity, frequency and the "surface" of their impact - from access to essential services to democratic processes - is set to increase still further. In this context, the following interrelated problems have been identified: •A fragmentation of policies and approaches to cybersecurity across Member States. •Dispersed resources and approaches to cybersecurity of the EU institutions, agencies and bodies. •An insufficient awareness of citizens and companies of cyber threats and insufficient information concerning the security properties of the ICT products and services they purchase, coupled with the growing emergence of multiple national and sectoral certification schemes. These problems impact on the overall cyber resilience of the EU and the effective functioning of the internal market. What should be achieved? The specific policy objectives of the initiative are the following: 1.Increase capabilities and preparedness of Member States and businesses, in particular regarding critical infrastructures. 2.Improve cooperation and coordination across Member States and EU institutions, agencies and bodies. 3.Increase EU level capabilities to complement the action of Member States, in particular in the case of cross-border cyber crises. 4.Increase awareness of citizens and businesses on cybersecurity issues. 5.Increase the overall transparency of cybersecurity assurance of ICT products and services to strengthen trust in the digital single market and in digital innovation. 6.Avoid fragmentation of certification schemes in the EU and related security requirements and evaluation criteria across Member States and sectors. What is the added value of action at the EU level? As the digitalisation and interconnection of the economy and society has a global reach, the dimension of the problems goes well beyond the territory of a single Member State. This therefore requires an intervention at Union level. In the current context and looking at the future scenarios, it appears that individual actions by Member States and a fragmented approach to cybersecurity, and especially its strong cross-border dimension, cannot increase the collective cyber-resilience of the Union.

B.Solutions What are the various options to achieve the objectives? Is there a preferred option or not? This Impact Assessment explores a specific set of policy options, covering the review of the European Union Agency for Network and Information Security (ENISA) and ICT security certification. ENISA Review Option 0 - Baseline scenario - This option is about the preservation of the status quo. ENISA's mandate would be extended and the objectives and tasks of the Agency would remain mostly unchanged, while taking into account the tasks entrusted to ENISA by subsequent EU law (e.g. the NIS Directive). Option 1 - Expiry of ENISA mandate (terminating ENISA). This option would lead to the termination of ENISA at the end of its mandate (June 2020), and possibly to a redistribution of competences/activities at EU and/or national level. Option 2 - 'Reformed ENISA'. This option would build on the current mandate of ENISA with a view of adopting selective changes which take the evolution of the cybersecurity landscape into account. The Agency would gain a permanent mandate, based on the following key building blocks: support to EU policy development and implementation; capacity building; knowledge and information; market related tasks; research and innovation; and operational cooperation and crisis management. Option 3 - EU cybersecurity agency with full operational capabilities. This option implies reforming ENISA by bringing together three main functions: 1. A policy/advisory function; 2. A centre of information and expertise, and 3. A Computer Emergency Response Team (CERT). To a large extent this option would imply the same change in the scope of the mandate as option 2. However, additional tasks would be added in the area of incident response and crisis management, so that the Agency would cover the entire cybersecurity lifecycle and deal with prevention, detection and response to cyber incidents. Certification Option 0 - Baseline scenario - Do-nothing. Under this option, the Commission would maintain the status- quo and not undertake any policy or legislative action. Option 1 - Non-legislative (”soft law”) measures. Under this option, the Commission would use soft policy instruments (e.g. interpretative communications, support of EU-wide self-regulatory initiatives and standardisation activities) in order to improve transparency and reduce fragmentation. Option 2 - An EU legislative act to extend SOG-IS agreement to all Member States. Under this policy option, the Commission would propose a legislative act to legally extend the membership to all Member States. Option 3 - An EU general ICT security certification framework. This option implies the establishment of a European ICT Security Certification Framework (including an Expert Group made up of national authorities) by building on existing ICT security certification schemes, as much as possible. In essence, the framework would enable the establishment of EU certification schemes that will be accepted across Member States. The preferred option is a combination of Option 2 for ENISA and Option 3 for certification. What are the different stakeholders? Who supports which option? The vast majority of stakeholders across all categories (Member States, industry, EU institutions, research community) that took part in the consultations appear to welcome the preferred option as they favour the reinforcement of ENISA and the creation of a European ICT security certification framework. In particular, there is consensus on the need to have (as a minimum) a well-functioning EU agency with a permanent mandate, which is adequately resourced and mandated to face the present and future cybersecurity challenges. There is also broad agreement amongst stakeholders on the creation of a voluntary, scalable European framework. On the industry side, this solution for certification is supported by businesses which are already subject to certification requirements, and which would benefit from an EU-wide mechanism based on mutual recognition of certificates. It is also supported by SMEs, which would suffer the most if they already have to or would have to embark on different certification processes across Member States. Some Member States, in particular those with fewer resources, and some representatives from industry and EU institutions expressed positive views also regarding option 3 for ENISA. C. Impacts of the preferred option