TABLE OF CONTENTS

IMPACT ASSESSMENT............................................................................................................ 5

1........... Scope............................................................................................................................ 6

2........... Procedural issues and consultation of interested parties.................................................... 6

2.1........ Identification................................................................................................................... 6

2.2........ Organisation and timing................................................................................................... 6

2.3........ Impact assessment process........................................................................................... 11

3........... Policy context in the area of NIS................................................................................... 12

4........... Problem statement........................................................................................................ 12

4.1........ Problem definition: What is the problem?....................................................................... 12

4.1.1..... Disruptions to the EU internal market............................................................................ 12

4.1.2..... Rising number, frequency and complexity of NIS incidents, and incomplete view of their frequency and gravity 14

4.1.3..... Affecting all actors in the society and economy.............................................................. 16

4.1.4..... Sectors where the well-functioning of network and information security is key to preserve the well-functioning of the internal market........................................................................................................ 17

4.1.5..... What will happen if further measures are not adopted.................................................... 20

4.1.5.1.. Undermined consumer confidence in the internal market................................................. 20

4.1.5.2.. Insufficient business investments in NIS......................................................................... 21

4.1.5.3.. Lack of credibility in the international scene................................................................... 22

4.2........ Problem drivers: What is the reason behind the problem?............................................... 23

4.2.1..... Uneven level of capabilities across the EU..................................................................... 23

4.2.1.1.. Preparedness................................................................................................................ 24

4.2.1.2.. Response..................................................................................................................... 25

4.2.2..... Insufficient sharing of information on incidents, risks and threats...................................... 25

5........... Effectiveness of existing measures.................................................................................. 26

5.1........ There are loopholes in the existing regulatory framework................................................ 26

5.2........ The limits of a voluntary approach................................................................................. 28

5.3........ Approach in other regions of the world.......................................................................... 29

5.4........ Need of EU intervention, subsidiarity and proportionality............................................... 32

5.4.1..... The EU right to act – Legal basis................................................................................... 32

5.4.2..... Subsidiarity test............................................................................................................ 33

5.4.3..... Proportionality of the approach..................................................................................... 34

6........... Objectives.................................................................................................................... 35

6.1........ Overview of general, specific and operational objectives................................................ 35

6.2........ Intervention logic.......................................................................................................... 36

7........... Policy options............................................................................................................... 38

7.1........ Discarded Option......................................................................................................... 38

7.1........ Option 1 – Business as usual (‘Baseline scenario’)......................................................... 38

7.2........ Option 2 – Regulatory approach................................................................................... 39

7.3........ Option 3 - Mixed approach.......................................................................................... 46

8........... Analysis of impacts....................................................................................................... 47

8.1........ Option 1 – Business as usual (‘Baseline scenario’)......................................................... 47

8.2........ Option 2 – Regulatory approach................................................................................... 49

8.2.1..... Cost estimations........................................................................................................... 52

8.3........ Option 3 – Mixed approach.......................................................................................... 57

9........... Comparing the options.................................................................................................. 58

9.1........ Overall comparison of the assessment........................................................................... 58

9.2........ Overall cost-benefit analysis.......................................................................................... 59

10......... Monitoring and evaluation............................................................................................. 61

ANNEX 1: PUBLIC CONSULTATION ON NETWORK AND INFORMATION SECURITY ACROSS THE EU.................................................................................................................................................. 65

ANNEX 2: ACTION PLANS AND STRATEGIES ADOPTED SO FAR IN THE FIELD OF NIS IN THE EU 68

ANNEX 3: ASSESSMENT OF NIS RISK MANAGEMENT COMPLIANCE COSTS FOR PUBLIC ADMINISTRATIONS AND KEY PRIVATE PLAYERS......................................................... 71

ANNEX 4: ASSESSMENT OF COSTS RELATED TO THE REQUIREMENT TO NOTIFY NIS INCIDENTS WITH A SIGNIFICANT IMPACT AND ASSOCIATED MECHANISMS/PROCESSES................. 96

ANNEX 5: THE SME TEST.................................................................................................... 100

ANNEX 6: CURRENT STATE OF CAPABILITIES IN THE EU........................................... 101

ANNEX 7: INTERNATIONAL ORGANISATIONS AND BODIES DEALING WITH INTERNET/CYBERSECURITY............................................................................................. 117

ANNEX 8: OVERVIEW OF CURRENT REGULATORY INCENTIVES FOR NIS IN THE SECTORS CONSIDERED FOR THE EXTENSION OF ART 13 TELECOM FWD IN OPTION 4 – REGULATORY APPROACH........................................................................................................................... 122

ANNEX 9: EU EARLY WARNING AND INCIDENT HANDLING NETWORKS IN OTHER DOMAINS THAN NIS.......................................................................................................................................... 130

ANNEX 10: COOPERATION FRAMEWORKS ESTABLISHED AT EU LEVEL FOR PREPAREDNESS AND RESPONSE TO CROSS-BORDER THREATS IN SPECIFIC AREAS................................. 138

ANNEX 11: LEGAL AND REGULATORY ASPECTS OF INFORMATION SHARING AND CROSS-BORDER COLLABORATION OF NATIONAL/GOVERNMENTAL CERTS IN EUROPE................ 149

ANNEX 12: INTERNET 2011 IN NUMBERS....................................................................... 153

ANNEX 13: IMPACT ASSESSMENT MATRIX................................................................... 160

ANNEX 14: LIST OF ACRONYMS...................................................................................... 168

COMMISSION STAFF WORKING DOCUMENT

IMPACT ASSESSMENT

Accompanying the document

Proposal for a Directive of the European Parliament and of the Council

Concerning measures to ensure a high level of network and information security across the Union

1. Scope

This impact assessment covers policy options to improve the security of the Internet and other networks and information systems underpinning services which support the functioning of our society (e.g. public administrations, finance and banking, energy, transport, health and certain Internet services enabling key economic and societal processes, such as e-commerce platforms and social networks). This issue is referred to as Network and Information Security (NIS).

Under Article 4(c) of Regulation (EC) No 460/2004 establishing the European Network and Information Security Agency (ENISA): "network and information security" means the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted data and the related services offered by or accessible via these networks and systems.

This impact assessment does not cover Member States activities concerning national security and defense.

2. Procedural issues and consultation of interested parties

2.1. Identification

Lead DG: Communications Networks, Content and Technology (CONNECT) Directorate General, former Information Society and Media (INFSO) Directorate-General.

Agenda planning: 2012/CNECT/003

2.2. Organisation and timing

The different aspects of the initiative have been discussed with a wide range of stakeholders. We have adopted an inclusive approach and respected the principles of participation, openness, accountability, effectiveness and coherence. The consultation included:

· Member States representatives responsible for enhancing the level of NIS and/or Critical Information Infrastructure Protection (CIIP). Discussions took place in the context of the European Forum for the Member States (EFMS) as well as in the form of dedicated meetings organised at the request of individual Member States. DG CONNECT received written inputs from 7 Member States.

A stocktaking exercise on the state of play of existing NIS capabilities and mechanisms in the Member States was carried out by Commission Vice-President (VP) Neelie Kroes via a letter sent to relevant Ministers in the Member States on 28 November 2011. Almost all the Member States took part in this exercise. A follow-up letter was sent by VP Kroes to the relevant Ministers following the Telecom, Energy and Transport Council of 8 June 2012.

Five Member States prepared a non-paper prior to the EU Conference on Cyber-Security that took place in Brussels on 6 July 2012 and that was jointly organised by the European Commission and the European External Action Service.

· Private sector representatives, including:

– Individual electronic communications service and network providers, Internet service providers, and industry associations (e.g. ETNO, EuroISPA, EuroIX, etc.);

– suppliers of hardware and software components for electronic communications networks and services, and industry associations (e.g. DigitalEurope, which represents large companies and SMEs);

– providers of products and services for Network and Information Security;

– representatives from the banking and financial sector and from the energy sector

Discussions with the private sector took place in the frame of the European Public-Private Partnership for Resilience (EP3R)[1], in the Expert Group on Security and Resilience of Communications Networks and Information Systems for Smart Grids[2] as well as in bilateral meetings. A number of relevant private sector players sent written contributions to the Commission.

· The European Parliament, in particular in the Industry, Research and Energy (ITRE) and Security and Defence (SEDE) Committees.

· The European Network and Information Security Agency (ENISA) and the Computer Emergency Response Team (CERT) for the EU institutions (CERT-EU).

· An online public consultation[3] feeding directly into this impact assessment was open on the European Commission website from July 23 to October 15 2012[4]. A total of 169 responses were received via the online tool. A further 10 responses were received in writing by the Commission, bringing the total number of replies to the public consultation to 179. The public consultation focused on a) the scale of the problem and evidence of its impact b) options for improving NIS though an EU strategic approach c) options for improving NIS through risk management and reporting of incidents. A summary of the questions addressed and the answers received to the public consultation is provided in Annex 1.

The total breakdown by type of respondent is the following: 88 individuals (of which 57 intend to remain anonymous); 11 public authorities (of which 5 intend to remain anonymous); 80 organisations or institutions such as businesses, research institutions and NGOs (of which 41 intend to remain anonymous). Amongst the companies that responded:

– 46% were large companies

– 20% were Small and Medium Enterprises (SMEs)

– 34% were micro enterprises

· A discussion with the general public was organised in the context of the 2012 Digital Agenda Assembly[5].

An impact assessment Inter-Service Steering Group was set up. The following Commission services participated in the group: SG, SJ, DG AGRI, DG COMM, DG ESTAT, JRC, DG CLIMA, DG COMP, DG ECFIN, DG EAC, DG EMPL, DG MOVE DG ENER, DG ENTR, DG ENV, DG SANCO, DG MARKT, DG HOME, DG JUST, DG REGIO, DG RTD, DG TAXUD, DG TRADE, DG BUDG, DG DIGIT, DG HR. The EEAS also participated in the group.

The Inter-Service Steering Group met four times: a kick-off meeting on 27 April 2012, a second meeting on 15 May 2012, a third meeting on 4 June 2012 to discuss the draft impact assessment report submitted on 13 June. A fourth meeting took place on 11 October 2012 to discuss the draft impact assessment report before re-submission on 15 October 2012. Before and after the meetings, written contributions and comments on the draft impact assessment were sent by the services.

The key questions addressed to the Member States and to the private sector in the context of all the relevant consultations listed above concerned the need to improve NIS across the EU. To this end, the Commission consulted on the need to foster cooperation at EU level; the importance of building up a minimum common level of national capabilities to enable such cooperation; the pros and cons of requiring the private sector to share information with the public sector and to adopt state-of-the-art protection measures; the establishment of such requirements at EU or national level.

Stakeholders' views on the seriousness of the problem and the options to address it are reported throughout this impact assessment where appropriate.

In general, the respondents to the public consultation:

– Expressed the view that governments in the EU should do more to ensure a high level of NIS (82.8% of respondents)

– Expressed the view that users of information and systems are unaware of the existing NIS threats and incidents (82.8% of respondents) and that businesses, governments and consumers in the EU are not sufficiently aware of the behavior to be adopted to minimize the impact of the NIS risks they face (84%).

– Would in principle be favourable to the introduction of a regulatory requirement to manage NIS risks (66.3% of respondents) at EU level (84.8% of those respondents).

– Expressed the view that it would be important to adopt NIS requirements in particular in the following sectors: banking and finance (91.1% of respondents), energy (89.4%), transport (81.7%), health (89.4%), Internet services (89.1%), public administrations (87.5%).

– Expressed the view that requirement to adopt NIS risk management according to the state of the art would entail for them no additional significant costs (43.6%) or no additional costs at all (19.8%).

– Expressed the view that if a requirement to report NIS security breaches to the national competent authority were introduced, it should be set at EU level (65.1%) and affirmed that also public administrations should be subject to it (93.5%).

– Affirmed that a requirement to report security breaches would not cause significant additional costs (52.5%) and 19.8% said that it would not cause additional costs at all.

In the EFMS and in written inputs to the Commission, the Member States expressed the following views:

– The Commission should develop current NIS actions and mechanisms (Germany, France) especially by means of targeted binding measures (France)

– The development of cyber-security capabilities should be accelerated within the Member States, particularly within the least advanced ones (France)

– That NIS protection levels vary across Europe (Germany) and that there are no mechanisms for engaging in existing cooperation mechanisms with those Member States who are less active in NIS nor are there paths for these Member States to get involved (Estonia).

– An EU framework establishing mechanisms for cooperation on preparedness and response amongst the Member States should be set up (France, Romania, Estonia, Germany, and Finland). In particular:

· Cooperation between the Member States should be underpinned by confidentiality agreements and mechanisms to exchange sensitive data (Spain, Romania).

· Information exchange on good practices and expertise; early warning and crisis management including via cyber-incident exercises should be promoted (Germany, Finland).

· Cooperation should be built on mutual trust (Germany, Finland).

· A functional and effective network of national/governmental CERTs in Europe in which information is exchanged according to the necessary confidentiality standards is needed (France, Romania).

· An approach focused on preparedness and prevention should use harmonized requirements regarding minimum security standards across the EU by maintaining the conditions for fair competition (Germany)

Moreover, the Member States:

– Expressed support for considering the extension of the security provisions in the regulatory framework for electronic communications to new sectors (France) with the appropriate involvement of the Member States in the related discussions (such discussions took place already within the EFMS)

– Expressed support for an EU initiative on NIS covering the ICT sector but also, in a horizontal manner, the ICT component virtually underpinning all sectors (Germany)

– Expressed support for the development of a risk management culture in the private sector (Germany).

The UK questions the merits of a regulatory intervention on NIS at EU level and favours a voluntary cooperation approach facilitated by the Commission. It has particular concerns about the extension of mandatory reporting requirements to sectors other than telecoms.

The European Parliament Resolution of 12 June 2012 on "Critical Information Infrastructure Protection: towards global cyber-security[6]" recommends the Commission to:

– "Propose binding measures via the EU cyber incident contingency plan for better coordination at EU level of the technical and steering functions of the national and governmental CERTs";

– "Propose binding measures designed to impose minimum standards on security and resilience and improve coordination among national CERTs"

– "Propose an EU framework for the notification of security breaches in critical sectors such as energy, transport, water and food supply, as well as in the ICT and financial services sectors, to ensure that relevant Member State authorities and users are notified of cyber incidents, attacks or disruptions"

2.3. Impact assessment process

A first version of this impact assessment report was submitted on 13 June to the European Commission Impact Assessment Board and discussed at a meeting convened on 5 July 2012. A revised version of the impact assessment was submitted on 15 October. This new version took into account the various comments from the Board , in particular: a better explanation of the relation between the problem and its cross-border dimension (Chapters 4 and 5); the insufficiency of existing policy measures to solve the problem; the integration of stakeholders' views on various aspects of the problem statement and on all key points of the preferred option; the identification of the sectors and players that would be covered by the preferred option (Chapter 7) and an estimation of the corresponding costs (Chapter 9 and Annexes 2 and 3) that highlighted with more precision the proportionality of the preferred option.

Following the opinion of the Board of 24 October, the following further amendments were made to this impact assessment:

· Insertion of a table showing the extent to which existing obligations address NIS issues and the gaps that still need to be addressed.

· A better explanation of the lack of motivation and incentives for companies and the public sector to invest in NIS (Section 4.1.5.2).

· A description of the nature of the risks in the sectors covered including the extent to which and how networks and services may be affected (Section 4.1.4); strengthening the evidence base and better explaining the rational for the choice of the relevant sectors in the preferred option (Section 4.1.4).

· Additional details on the content of the preferred option (Option 2) and in particular on what NIS risk management requirements would entail in practice (Section 7.2).

· A better explanation of the reasons for not considering other combinations of "soft" and "regulatory" approaches (Section 7.3)

· Improved assessment of social/employment impact, on competitiveness in particular for the preferred option, impact on international cooperation (Section 8 on Assessment of impact of the Options).

· A description and rough estimate of the benefits (i.e. decreasing the cost of NIS incidents and the improved level of security) (Section 9)

· Insertion of a summary table of all costs and benefits per option (Section 9).

· Insertion of a summary of the questions asked and of the responses received in the public consultation (Annex 1).

· Inclusion of the views of stakeholders throughout the text and in the preferred Option.

· Inclusion of the indication of the tools for monitoring and evaluation (Section 10).

3. Policy context in the area of NIS

The increasing importance of NIS for our economies and societies was recognised for the first time by the Commission in a Communication from 2001[7] .

The approach adopted so far by the European Union in the area of NIS has mainly consisted in the adoption of a series of action plans and strategies urging the Member States to increase their NIS capabilities and to cooperate to counter cross border NIS problems.

Annex II provides a description of the "Action plans and strategies adopted so far in the field of Network and Information Security in the EU".

Companies, with the exception of telecommunication operators (‘undertakings providing public communications networks or publicly available electronic communications services’[8]) and public administrations are not subject to NIS requirements and are not required to report security incidents[9].

4. Problem statement

4.1. Problem definition: What is the problem?

The problem can be described as an overall insufficient level of protection against network and information security incidents, risks and threats across the EU undermining the proper functioning of the Internal market. The problem is further detailed in the following sections.

4.1.1. Disruptions to the EU internal market

Given that networks and information systems are interconnected and given the global nature of the Internet, many NIS incidents transcend national borders and undermine the functioning of the internal market.

The effects of an incident originating in a particular country, if not appropriately contained, may spread quickly to other countries. Even, incidents that are local by nature may have unforeseen consequences across borders, e.g. the disruption to a major airport's IT systems may affect air traffic across Europe.

Cross-border services can become unavailable, suspended or interrupted due to security breaches. eBay has experienced web-based attacks that have made all or portions of its websites unavailable for periods of time in 2010 and likewise PayPal[10], thereby affecting e-commerce in the internal market.

The case of Diginotar illustrates the risks posed by not reported security breaches. The Dutch certification company Diginotar did not report that its systems were hacked and did not revoke the digital certificates (i.e. the certificates ensuring the security of communications over the Internet) that were fraudulently issued. This resulted in a large number invalid certificates circulating online, compromising the security of Internet services and eventually affecting trust in the Internet. A report[11] by the security firm Fox-IT, which investigated the case, found out that there were a number of problems in the security practices of the company, revealing the need for better risk management and mitigation practises. It must be borne in mind that in the aftermath of the Diginotar incident, the Dutch Government acknowledged that "the risk of security breaches affects the internal market […and] hampers cross-border services and product supplies". For this reason the Dutch Government is preparing a system of mandatory security breach notifications for relevant critical infrastructure and national services[12].

In January 2011, the Commission had to suspend trading in the Emissions Trading System due to security breaches at national registries[13] and companies were prevented from selling and buying emission allowances within the EU.

In the wake of past incidents Member States are starting to introduce their own regulations. As already remarked, the Netherlands are considering introducing security breach notification requirements and Luxembourg[14] has introduced a disclosure requirement for incidents that can have financial consequences for the companies concerned. The UK has taken a sector-specific approach to put in place reporting requirements for critical sectors such as finance, energy, transport and health. Uncoordinated regulatory interventions may result in fragmentation and give rise to Internal market barriers generating compliance costs for companies operating in more than one Member States.

Those businesses which replied to the public consultation emphasised the role that the EU could play in creating a truly integrated and harmonised internal market for NIS products and services and the existence of market barriers which undermine cybersecurity across the EU.

4.1.2. Rising number, frequency and complexity of NIS incidents, and incomplete view of their frequency and gravity

The availability, authenticity, integrity and confidentiality of information and networks can be compromised due to various causes, such as natural events, human errors or malicious attacks.

The outcome of the public consultation confirms the seriousness of the problem, in particular:

56.8% of the respondents reported having experienced over the last year NIS incidents (caused by human mistakes, natural events, technical failures or malicious attacks) which have had a serious impact on their activities.

27.8% of the respondents to the public consultation affirm that human/technical errors are very frequently the cause of NIS incidents, and 39.6% affirm that this is the case quite frequently.

40.8% of the respondents to the public consultation affirm that malicious attacks are quite frequently the cause of NIS incidents.

36.1% of the respondents to the public consultation affirm that software/hardware failure is quite frequently the cause of NIS incidents.

47.3% of the respondents to the public consultation affirm that third party/external failure is quite frequently the cause of NIS incidents.

The flooding of the river Elbe in 2002[15] illustrates how communications systems can be disturbed by a natural disaster. Human error or ignorance can also be the cause of cyber incidents by leading to accidental events. In August 2012 a sub-sea cable was mistakenly snapped between the UK and the Netherlands causing certain Internet Service Providers, e-commerce service providers and customers to be cut off the Internet for more than 24 hours[16]. Incidents of this kind (cable cuts) had already happened in the Mediterranean in 2008 and in the Suez canal in 2011.

The human factor is of the utmost importance for NIS. Non-compliance with security requirements (e.g. by negligence or distraction, using infected USB sticks, opening unsolicited e-mails, failing to apply security patches or revealing passwords) can cause an outage or facilitate the intrusion of malicious software.

The spread of malicious software (malware) and malicious attacks have been increasing steadily. Web based attacks increased by 36% in 2011 compared to 2010 and the total number of attacks by 81%. Malware can mutate as they spread, and attackers are able to generate an almost unique version of their malware for each potential victim[17], which makes their detection ever more challenging. Figure 1 shows the raise in the number of incidents reported to the US-CERT in 2006-2011.

Figure 1: Incidents reported to US-CERT: Fiscal Years 2006-2011[18]

In addition to the elements presented above, there is reason to believe that a large proportion of attacks go unnoticed. The recent outbreak, in late May 2012, of the ‘Flame[19]’ cyber-spying software, revealed that malware can be spreading undetected over a number of years. There is moreover reason to believe that only a fraction of incidents, when discovered, are disclosed. The reluctance to disclose comes from the potential significant damages for the organizations involved, including reputational damages and loss of business opportunities.

The lack of information on incidents slows down the capability to react and take the appropriate mitigating measures, in particular in cases where the incident has repercussions outside the organisation and the other parties affected are unaware of an imminent threat or an incident/intrusion that has already taken place.

The most serious of these cross-border incidents may be the state-sponsored stealthy attacks such as ‘Shady Rat’ etc.[20], where the same techniques are applied in one country then another. Trusted sharing of information about such attacks could help prevent attacks spreading to further countries.

4.1.3. Affecting all actors in the society and economy

Over the last decade, the digital ecosystem has become essential to economic growth and societal welfare. It has enabled the creation of high-quality jobs and supported smart and sustainable economic growth.

Indeed, the ICT sector is one of the growth engines of the EU. In Europe, the ICT sector and investments in ICT deliver around half of our productivity growth. The World Bank estimates that with 10% increase in high speed Internet connections, economic growth would increase by 1.3%. The ICT sector alone represents almost 6% of the European GDP[21].

Public administrations, businesses and consumers reap huge economic and social benefits from the usage of ICT, including online services. Because of the critical role of networks and information systems, possible failures or attacks could impact all parts of society – Member States/governments, organisations/business and citizens/consumers.

Security incidents are capable of rendering critical government functions unavailable for several days, as demonstrated by the cyber-attacks against Estonia in 2007, which severely affected not only the provisioning of online services such as e-government and e-banking within the country, but also prevented citizens from accessing online services across borders. EU institutions have been the target of attacks in 2011 and 2012.

Businesses and other organisations can be seriously affected if the networks and information systems underpinning their industrial processes are compromised. In 2009, 16 % of enterprises in the EU-27 had experienced some kind of NIS incident[22] . Incidents can be costly. The cyber-attacks targeting Sony in April 2011 cost the company nearly $175 million[23]. An outage that affected BlackBerry in 2011 cost the company $50 million[24]. Beginning in July 2009, two U.S. stock exchanges were victims of cyber-attacks[25]. The remote attack temporarily disrupted public websites. In September 2012, six major US banks were hit by cyber-attacks[26]. The loss of intellectual property, trade secrets and financial data ensuing from cyber-attacks also result in considerable losses for businesses concerned. The UK estimates the loss of intellectual property to be largest cost category, accounting for 30% of total losses, resulting from illegal intrusions and cyber-crime, with identity theft and loss of customer data accounting for a much smaller proportion of losses[27].

Consumers can face interrupted e-mailing, instant messaging and browsing services, as it was the case in October 2011, when BlackBerry handsets were affected by a network outage at one of its data centres in the UK and almost all of its 70m users worldwide experienced problems at some point during the three days that the incident lasted[28]. In January 2010, German card holders were suddenly unable to conduct banking or ATM withdrawals and purchases with their bank cards both at home and abroad, due to software problems in the microchips. In the EU, nearly one third of users have already been confronted with a computer virus (or similar infection). Also, 74% of EU Internet users in 2012 think that the risk of becoming a victim of cybercrime has increased in the past year[29]. 82.8% of respondents to the public consultation expressed the view that users of networks and information systems are not sufficiently aware of the level of NIS threats and incidents 84% of the respondents affirmed that businesses, governments and consumers in the EU are not sufficiently aware of the behavior to be adopted to minimize the impact of the NIS risks they face.

4.1.4. Sectors where the well-functioning of network and information security is key to preserve the well-functioning of the internal market

While the problem described above affects all actors of society and economy in the EU, a number of sectors and a number of infrastructure and service providers in those sectors are particularly vulnerable, due to their high dependence on correctly functioning network and information systems and due to their essential role in providing key support services for our economy and society, including health, safety, security and the economic and social well-being of people. As a result, the security of their systems is of particular interest to the functioning of the Internal Market.

The public consultation underlined the importance of ensuring the security of network and information systems, in particular for the following sectors:

· Energy – 89.4% of respondents

· Transport - 81.7% of respondents

· Banking and finance – 91.1% of respondents

· Health – 89.4% of respondents

· Internet services – 89.1% of respondents

· Public administrations –87.5% of respondents

At the same time, 31% of respondents (both business and consumers) to the public consultation affirmed to have no process in place to manage NIS risks. Also, 54.2% affirmed not to have any budget dedicated to NIS.

All the sectors, which provide services which are key for the functioning of our economies and well-being of our society, rely heavily on network and information systems.

Banking activities should be secured since banks are the backbone of our financial system and because they are common targets of fraudsters. Indeed there are signs that attacks are increasing in this sector. McAfee reported recently[30] that fraudsters, using malware, and replicating the same scheme in several countries, have attempted to steal up to €2 billion from accounts in Europe, the United States and Columbia. Consumers and businesses using online banking have increasingly experienced theft, particularly through viruses infecting their computers. Especially in this sector, we observe an increasing usage of third party business applications (such as those used for mobile banking). These applications, which are often cloud-based, are not part of the network and systems of the credit institution, which has no control over their security.

The stock exchange increasingly adopts networks and information systems and Internet-based commerce systems. Accidental disruptions or malicious attacks affecting the stock exchange in a country or affecting particularly critical stock exchanges such as the ones in London, Paris or Milan may have very significant impact on trade both in the internal market and internationally. In 2010 the London Stock Exchange experienced a serious cyber-attack at its headquarters, which compromised its trading system[31].

Generation, transmission and distribution of energy are highly dependent on secure network and information systems. Ensuring the resilience of utilities is particularly important since virtually all other sectors and the well-being of our society depend upon them.

For example, many major gas companies suffer increased amounts of cyber-attacks motivated by commercial and criminal intent. These attacks are posing a great risk to machinery, which can cost lives, stop production and cause environmental damage.

The same considerations are valid for other network industries, such as air, maritime transport and railways and for key transport infrastructure, such as airports, ports, railways, and traffic management systems and logistics. For example, aviation infrastructure (including ground and in-flight Air Traffic Management) relies on continuous and uninterrupted information flows and databases, which cannot be allowed to fail. Airports and border gateways are dependent on information assurance regarding data, control systems, networks and protocols that support the effective functioning of aviation[32].

Both the energy and the transport sector heavily rely on Industrial Control Systems (ICS), i.e. complex computer and information systems that can be located either in one site (e.g. power plants) or distributed over a geographical area (energy and transport networks).

There are numerous interconnection points between ICS, including over the Internet, and securing them is of the essence. Also, many ICS were designed in the past without anticipating the security threats posed by technological advancements. For example, remote controlling of ICS is often done via simple laptops or other mobile devices which may have a lower level of security than the rest of the system.

The Expert Group on Security and Resilience of Communications Networks and Information Systems for Smart Grids recently concluded in its report to the Commission that "Electricity Critical infrastructures converging with ICT-infrastructures require scenario-building that includes consideration of highly unlikely types of events. ICT security considerations need to be integrated within the wider risk management of the whole grid. ICT is therefore needed to carry out a risk analysis, and to define high level security requirements to enhance the security and resilience of ICT for Smart Grids."[33] Such risk analysis will build upon the positive results of the Commission-led Smart Grids Task Force. The Commission supports the work of the Smart Grids Task Force's Expert Group on Privacy, Data Protection and Cybersecurity, where stakeholders from the energy and ICT sectors are developing a cybersecurity assessment framework, which includes the identification of Best Available Techniques (BATs) for smart metering systems as well as the evaluation of methodologies for a trustworthy network sharing vulnerabilities and threats analysis of Smart Grid and Smart Metering systems.

Hospitals and clinics are becoming the more and more reliant on sophisticated ICT systems which need to be secure to ensure continuity of service and avoid fatal disruptions. The proliferation of electronic medical devices presents unique challenges in ensuring that only known, authorized devices are able to connect to the network.

Also, personal health and financial information is often target of cybercrime, particularly as the healthcare industry continues its conversion process to full patient electronic medical records. Networks, mobile devices, workstations, servers and medical devices are particularly critical in this regard and securing them is of the essence.

It is important to ensure the security of Internet companies (e.g. cloud providers, social networks, e-commerce platforms, search engines), which provide key inputs enabling important economic and societal processes. This is essential to preserve trust in the digital ecosystem.

It is key to ensure the resilience and reliability of public on-line services to citizens to build and preserve their trust in e-government. E-Government and e-participation are increasing with citizen demand for timely and cost- effective services and so are the NIS risks for state and local administrations. The risk for public online services to be hindered by NIS problems exist at all levels of government.

Finally, there are NIS problems that are common to all the sectors referred to above. For example, malware is one of the most significant threats as it may disable security or other software in an organisation and cause a breach or a gap that can be exploited by external parties. Also, exposure to threats grows as companies and public administrations invest in technologies like mobile, social, and cloud. Notably, due to the increasing use of mobile devices and applications, employees in virtually all sectors can now access corporate data and look at it remotely without necessarily complying with the security policies and controls of the organisation.

Also, in all the sectors identified above, ensuring NIS in large companies and in SMEs is equally critical. Small and medium businesses have become the low-hanging fruit for cyber criminals and they need to be secure given that we are as strong as our weakest link.

On the other hand, micro companies are less critical for the overall continuity of the services given that incidents affecting them may not have a sufficiently wide reaching impact on society as those incidents affecting larger businesses.

4.1.5. What will happen if further measures are not adopted

4.1.5.1. Undermined consumer confidence in the internal market

The number of NIS incidents and their negative consequences will continue to increase and this will have a negative effect on the use of online public and private services, on consumers' trust in the on-line economy and in the integrity of the Internal Market.

The 2012 Eurobarometer on cyber-security found that 38% of users had concerns with the safety of on-line payments and have changed their behaviour because of concerns with security issues: 18% are less likely to buy goods on-line and 15% are less likely to use on-line banking[34]. The perceived lack of security on the Internet is thus having a negative effect on the functioning and development of the Internal Market. It is estimated that, by stimulating the development of the digital single market, Europe could gain 4% GDP by 2020[35]. This GDP increase corresponds to a gain of almost €500 billion (€494 billion) or more than €1.000 for every citizen. In a time of economic downturn, this is not negligible.

Figure 2: Reasons for Internet users not buying on-line in the EU countries, 2009. Percentage of individuals with Internet access that did not buy on-line in the last 12 months

4.1.5.2. Insufficient business investments in NIS

Currently, businesses lack effective incentives to conduct serious risk management which involves the adoption of appropriate NIS measures (see also the relevant responses to the public consultation provided in Section 4.1.3). From an economic perspective security is an externality leading to a market failure[36], i.e. market players do not see the economic rationale to bear the full social costs of increasing the level of security but rather prioritise time-to-market or a low pricing for their end products. By leaving the decision on the level of security entirely to market players the societal benefits of a more secure digital environment would not be fully reached.

Often companies consider NIS a purely technical matter and do not address it as a key component of their business strategy, as a lynchpin for safeguarding their most precious assets notably intellectual property, financial information, and their reputation. Companies are often unaware of the risks faced until significant incidents occur and hence only adopt a reactive approach when circumstances require it. The same considerations apply to public administrations which do not yet see the importance of investing in NIS to ensure the continuity and reliability of the public services they provide more and more online.

According to Eurostat[37], by January 2012, 26 % of enterprises in the EU-27 had a formally defined ICT security policy with a plan for regular review; this share rose to over 50 % among those enterprises whose principal activity was information and communication activities. As shown in Figure 3, among the Member States, the highest shares of enterprises with a formally defined ICT security policy were recorded in Sweden and Denmark where more than two fifths of enterprises had such policies. The lowest shares of enterprises with a formally defined ICT security policy were on the other hand recorded in Bulgaria, Hungary, Romania, Poland and Estonia.

Figure 3 Enterprises having a formally defined ICT security policy with a plan of regular review, EU-27, January 2010 (% of enterprises) - Source: Eurostat (isoc_cisce_ra)

Businesses are often unaware of the IT security risks faced and are overconfident about their actual level of protection; they perceive security costs as too high and see no business case for the return on investment on security[38]. Indeed, businesses fail to see the potential savings induced by NIS investments. For example, the Ponemon 2011 Cost of Data Breach Studies for France, Germany and the UK showed that by appointing a Chief Information Security Officer (CISO) businesses could save up to half of the cost of a data breach.

The CSI 2007 Computer Crime and Security Survey found that the majority of companies (61%) allocate 5% or less of their overall IT budget to information security.

To counter the increasing number of web-based attacks, only 20% of business uses a secure protocol for the reception of orders via Internet[39].

As shown in Figure 4, small and medium-sized companies in the EU adopt less NIS measures than large companies.

Figure 4: Enterprises using internal security facilities or procedures, EU-27, January 2010 (% of enterprises) - Source: Eurostat (isoc_cisce_fp)

4.1.5.3. Lack of credibility in the international scene

Without further actions at EU level, the Member States will act individually and will cooperate largely on a bilateral, multilateral or regional level. This would reduce the credibility of the EU at the international level, which would lead to the decay of existing cooperation arrangements, i.e. the EU-US Working Group on Cyber-security and Cybercrime[40] and would hinder discussions with other international partners. This will represent a lost opportunity to coordinate activities at global level and to achieve higher efficiency in addressing the problems.

Furthermore, higher credibility in NIS could boost economic potential and support as such the Internal Market.

4.2. Problem drivers: What is the reason behind the problem?

The problem of insufficient level of protection against network and information security incidents, risks and threats across the EU undermining the proper functioning of the Internal market stems from a range of factors.

4.2.1. Uneven level of capabilities across the EU[41]

Member States have very different levels of capabilities. This situation hinders the creation of trust among peers in the Member States which is an important prerequisite for cooperation and information sharing. While research[42] suggests that certain Member States have now reached a high level of spending on NIS, some others have not.

According to a market study[43], Member States can be divided into four groups on the basis of the maturity of their NIS markets:

Group 1, the Champions: Denmark, Finland, the Netherlands, Sweden, the United Kingdom

Group 2, the Pillars: Austria, Belgium, Germany, Luxembourg, France, Ireland

These two clusters account representing together 69% of the EU GDP but 82% of total security spending. These clusters are characterized by high average security spending, a strong presence of high profile security business users, and greater adoption of advanced security solutions.

Group 3, the Runners Up include the Southern European countries: Cyprus, Greece, Italy, Malta, Portugal, and Spain and: Czech Republic, Hungary and Slovenia.

This cluster shows some delay with the advanced clusters but a good potential for growth. They represent 30% of the EU population, 26% of EU GDP but 16% of the total EU NIS revenues

Group 4, the Learners: Bulgaria, Estonia, Latvia, Lithuania, Poland, Romania, Slovakia,

This cluster includes the remaining Member States with the lowest level of NIS spending and maturity. It represents 5% of EU GDP, but only 2% of NIS revenues) and shows a low number of connected PCs, with very low average security spending per connected PC.

Moreover, important considerations can be made following the stocktaking exercise that VP Neelie Kroes conducted across the Member States. The table below summarises the information provided by the Member States to Vice-President Kroes on their national capabilities. According to the information received, only group 1 countries and a large majority of group 2 countries have a level of preparedness which corresponds to the targets pursued by the Commission since 2009 (CIIP Action plan and CIIP Communication of 2011).

Group of countries || N/G CERTs || CERTs EGC[44] group || NIS Strategy || Contingency/Cooperation Plan

1 - DK, FI, NL, SE, UK || DK, FI, NL, SE, UK || DK, FI, NL, SE, UK || DK*, FI, NL, SE, UK || DK, FI, NL, SE, UK

2 - AT, BE, DE, FR, IE, LU || AT, BE, DE, FR, IE*, LU || AT, DE, FR, || AT, DE, FR, IE, LU || AT, DE, FR, LU

3 - CY, GR, IT, MT, PT, ES, CZ, HU, SL || CY*, GR, IT*, MT, PT*, ES, CZ, HU, SL || ES, HU || CY, EL, ES,CZ, HU || CY, EL

4 - BG, EE, LV, LT, PL, RO, SK || BG, EE, LV, LT, PL, RO, SK || || EE, LV, LT, PL, RO, SK || EE, LV

* In the process of adoption

4.2.1.1. Preparedness

Public sector players dealing with NIS in the EU include a large variety of ministries, agencies and National Regulatory Authorities[45]. The existence of a plethora of bodies, each with different competences and responsibilities, makes it difficult for the Member States to identify their counterparts with whom to cooperate in other Member States. Not all the Member States have an operational national/governmental CERT in place to handle NIS incidents and prevent them from happening by monitoring threats. This uneven level of preparedness hinders cooperation on a European scale, as confirmed by a study undertaken by ENISA in 2012[46].

The European Government CERTs (EGC) group, which performs operational tasks, comprises only 10 Member States, which are the top performers. As indicated in the group's website[47]: "Its members effectively co-operate on matters of incident response by building upon a fundament of mutual trust and understanding due to similarities in constituencies and problem sets".

Only some Member States have to date adopted national cyber security strategies.

4.2.1.2. Response

Not all Member States have in place a cyber-incident contingency/cooperation plan, providing protocols for communications and coordinated action in crisis situations, and not all the Member States have carried out or regularly carry out cyber incident exercises, which are major tools to put in place and test response capabilities.

All the Member States, supported by ENISA, have participated in the first pan-European cyber-incident exercise in 2010 (Cyber Europe 2010[48]). According to the evaluation report of the exercise, the communication protocols differ from one Member State to another and there is hence a need for harmonisation of the existing communication processes, which also need to be made more secure[49].

In any serious crisis situation affecting networks and information systems, an appropriate response is vital and time critical. When threats or incidents have potential or actual cross border-nature, they need to be handled by the Member States in a coordinated and timely manner.

4.2.2. Insufficient sharing of information on incidents, risks and threats

Most security breaches go unreported and unnoticed mainly due to the reluctance of companies to share this information because of fear of reputational damages or liability. Often, people responsible for NIS share related information only with small groups they trust rather than going through official channels.

The insufficient sharing of information on threats and risks results in sub-optimal preparedness; the insufficient sharing of information on incidents results in sub-optimal response. The unavailability of reliable data and information on NIS threats and incidents makes it difficult for governments to conduct evidence-based policy making and to respond to incidents affecting governments' networks timely.

The lack of NIS data and information does not allow conducting appropriate analysis and compiling statistics that could be used to raise awareness of the rising threats and to plan appropriate measures to tackle them.

There is currently also no framework for trusted information sharing on security threats, risks and incidents amongst the Member States and between the private and the public sector. The UK stressed that mandatory reporting of security breaches may be a disincentive for those governments and businesses that are highly advanced in terms of NIS and that already pursue voluntary and cooperative arrangements. The UK would also favour a sector-specific approach to NIS given that risks and impact of incidents may differ from one sector to the other.

38% of respondents (both business and consumers) to the public consultation considered that effective sharing of information on threats and incidents would be best achieved by a requirement to report significant NIS security breaches to the national competent authority while 37% considered that it would be best achieved by stronger public-private cooperation mechanisms.

5. Effectiveness of existing measures

5.1. There are loopholes in the existing regulatory framework

The only sector where companies are currently required under EU law to take NIS risk management steps and to report serious NIS incidents is the electronic communications sector[50].

The regulatory framework for electronic communications[51] requires providers of public electronic communications networks and services to appropriately manage the risks posed to the security of their networks and services to prevent and minimise the impact of security incidents on users and interconnected networks. It requires providers to notify the competent national regulatory authority of a breach of security or loss of integrity that has had a significant impact on the operation of networks or services. These provisions had to be transposed at national level by 25 May 2011.

However, all players relying on network and information systems face security risks. This leads to an uneven playing field since the same incident affecting for example a telecommunications provider and a company providing voice over IP services would have to be notified to the national competent authority in the former case, but not in the latter.

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data[52] requires controllers of personal data to implement appropriate technical and organisational measures to protect personal data. Having regard to the state of the art and the cost of their implementation, such measures shall ensure a level of security appropriate to the risks presented by the processing and the nature of the personal data to be protected. In 2012, the Commission proposed a major reform of the EU legal framework on the protection of personal data[53]. Article 30 of the proposed General Data Protection Regulation[54] requires the data controller and the data processor to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected, having regard to the state of the art and the costs of their implementation. The controller and the processor shall, following an evaluation of the risks, take security measures to protect personal data against accidental or unlawful destruction or accidental loss and to prevent any unlawful forms of processing, in particular any unauthorised disclosure, dissemination or access, or alteration of personal data.

All players who are data controllers (e.g. a bank or a hospital) are hence already obliged to put in place security measures that are proportionate to the risks faced. On the other hand, data controllers would only be required to notify only those security breaches compromising personal data. A NIS breach affecting the provision of the service without compromising personal data (e.g. an ICT outage of a power company which results in a blackout) does not have to be notified.

The co-legislators are currently discussing the Commission proposal for a Directive on attacks against information systems[55]. The proposed Directive focuses on penalising the exploitation of cybercrime tools. This proposal covers only the criminalization of specific conducts, but does not address the prevention of NIS risks and incidents, the response to NIS incidents and the mitigation of their impact.

Council Directive 2008/114/EC on the identification and designation of European Critical Infrastructures and the assessment of the need to improve their protection[56] covers the energy and transport sectors. According to the Directive, the Member States had to go through a process of identifying potential European Critical Infrastructures (ECIs), with the help of the Commission if needed. The Directive also requires operators of identified European Critical Infrastructures to put in place security plans The Directive does not put obligations on operators to report significant breaches of security and does not set up mechanisms for Member States to cooperate and respond to incidents. To date, only few European Critical Infrastructures have been identified as such by the Member States. The vast majority of the energy and transport players (e.g. airports, ports, electricity generators and gas distributors) are not covered.

In sum, the current rules do not require businesses other than telecommunication companies to adopt security measures and report NIS incidents, which do not affect personal data. The Diginotar case referred above illustrates the limits of this approach. Another striking example is the BlackBerry outage in 2011, which caused interruptions in basic communications services such as e-mail and SMS but did not have to be reported since the company is not a telecommunications operator and the incident did not compromise personal data.

Annexes 9 and 9 present the outcome of two specific benchmarking exercises that directly relate to how different aspects of the problem drivers have been dealt with in other sectors.

More precisely, Annex 8 provides an overview of current (regulatory) incentives for risk assessment and NIS in a number of sectors that strongly depend on NIS for the supply of their services. It is concluded that, in general, such incentives are insufficient in sectors other than the telecoms sector.

Annex 9 identifies and analyses a number of EU Early warning and incident handling networks in sectors other than NIS. These networks are used to share confidential information at EU level. Annex 8 provides useful insights on how such networks have been set up in the absence of mechanisms for effective cooperation at EU level.

5.2. The limits of a voluntary approach

The voluntary approach followed so far has resulted in an uneven level of preparedness and limited cooperation, as highlighted above. As a result the effectiveness of NIS capabilities varies considerably across the EU; cooperation takes place only amongst Member States who are well prepared, the others being left out or choosing themselves not to be involved.

The European Forum for Member States (EFMS) facilitates policy discussions and exchange of best practices between Member States. The limited remit of EFMS means that the Member States do not share information on incidents, risks and threats within the EFMS nor do they cooperate to counter cross border threats. The EFMS has no power to require its members to have minimum capabilities in place.

ENISA provides support and advice to the Commission and the Member States with a view to improving the overall level of NIS in the EU. ENISA has, however, no operational powers and, for example, cannot intervene to fix NIS problems. The external evaluation[57] of ENISA in 2007 concluded that the value added of ENISA is its ability to provide an independent platform at the EU level for stakeholders and experts to discuss and compare problems and solutions regarding NIS and that the consensual view is that ENISA should be a well-established single European voice for security but that it should not be given more powers or an operational role. In addition, it must be borne in mind that there is no guarantee that the mandate of the Agency will be actually renewed after 2013.

The European Public-Private Partnership for Resilience (EP3R) is a platform which facilitates the exchange of best practices among the Member States and ICT companies. The EP3R has no formal standing and cannot require the private sector to report incidents to the national authorities. A framework for trusted information sharing and for communicating information on NIS threats, risks and incidents is absent within the EP3R.

It can be reasonably assumed that without providing further directions to existing voluntary mechanisms, and specifically to the EFMS and the EP3R, the interest and the added-value in participating will decrease and this might lead to the possible dissolution of these mechanisms over time.

5.3. Approach in other regions of the world

Other regions of the world have adopted initiatives to address issues corresponding to the main problem drivers identified in this impact assessment.

In order to raise the level of security of critical information infrastructures, the US established in 1998 the National Infrastructure Protection Center (NIPC).

The National Cyber-security and Communications Integration Center (NCCIC) is an umbrella organisation set up in 2009 to coordinate national initiatives to address threats and incidents, including the US-CERT, National Coordinating Center for Telecommunications (NCC), the National Cyber-security Center (NCSC), and DHS Office of Intelligence and private sector partners from several ISACs.

Along with setting up dedicated capabilities of this kind, the US launched a series of Information Sharing and Analysis Centers (ISACs) for critical sectors[58] (including electricity, finance, health, maritime, ICT, nuclear, water), with the aim to ensure information sharing on threats and vulnerabilities between public and private sectors. The Industrial Control System Information Sharing and Analysis Center (ICS-ISAC) is the Private/Public center for knowledge sharing regarding Industrial Control System[59] (ICS) cybersecurity.

The lesson learnt from these experiences is that their effectiveness depends on the fact that the private sector shares information with the government and vice versa.

The US approach has inspired countries such as the UK, the Netherlands and Australia in setting up NIS capabilities. Although the US was first to establish a CERT already in 1988, the first government CERTs were established in the late 90’s/early 2000’s in UK, France, Germany, Netherlands and others and several of these came together to form the European Government CERTs group (EGC).

Regarding the reporting of security breaches, under US law companies are required to report security breaches for critical infrastructures does exist (Data Security and Breach Notification Act of 2012).

As a recent development, the Division of Corporation Finance of the US Securities and Exchange Commission released in 2011 guidance regarding public companies' disclosure obligations relating to cybersecurity risks and cyber incidents[60], due to concerns for the cyber-security risks faced by financial institutions. This shows that the US is now adopting an approach to cyber-security which covers key sectors where protection is essential, such as finance.

In Canada, "Industry Canada" is the lead agency for the Communications and Information Technology Sector and is responsible for CIP and emergency management. It has established the sector network – the Canadian Telecommunications Cyber Protection Working Group (CTCP) – to promote industry-to-industry, government-to-industry and industry-to-government co-operation in protecting Canadian networks. Industry Canada and CTCP have also established the Canadian Network for Security Information Exchange (CNSIE) to promote collaboration between a larger community of cyber security stakeholders such as the telecommunications, financial, energy, and vendor communities and government departments.

Regarding operational cooperation, the Organisation of American States has attempted to establish a ‘hemispheric contact network’ of CERTs but as yet the initiative has not flourished.

In the Asia-Pacific region, APCERT (Asia Pacific Computer Emergency Response Team) is a group of 30+ CERTs, mostly government CERTs. Membership is voluntary.

Japan's CERT capabilities were set up in 1996. JPCERT/CC coordinates with network service providers, security vendors, government agencies, as well as the industry associations and is acting as "CERT of CERTs" in the Japanese community. JPCERT/CC helped to set up APCERT. Also relevant is the Japanese Information-technology Security Center (ISEC) established in 1997 as the public information sharing center for promoting information security in Japan, and the recently created Cyber Security Information Sharing Partnership (J-CSIP) providing a platform among critical infrastructures manufacturers.

In Australia the "Trusted Information Sharing Network (TISN)" is a forum in which the owners and operators of critical infrastructures work together, share information on threats and vulnerabilities and develop strategies and solutions to mitigate risk. It comprises seven critical infrastructure Sector Groups and two Expert Advisory Groups, Communities of Interest (CoI) and a Critical Infrastructure Advisory Council (CIAC).

Stakeholders mentioned the Australian Internet Security Initiative (AISI) as a cost-effective black-listing of IP addresses that are apparently compromised by malware and to dispatch that information to relevant ISPs and their customers.

5.4. Need of EU intervention, subsidiarity and proportionality

5.4.1. The EU right to act – Legal basis

The Union is empowered to adopt measures with the aim of establishing or ensuring the functioning of the internal market, in accordance with the relevant provisions of the Treaties (Article 26 Treaty on the Functioning of the European Union - TFEU).

In particular, Article 114 TFEU (former Article 95 EC) allows for the adoption of "measures for the approximation of the provisions laid down by law, regulation or administrative action in Member States which have as their object the establishment and functioning of the internal market" (emphasis added). Following the entry into force of the Lisbon treaty, the internal market is among the areas of "shared competence" between the Union and the Member States.

The ECJ held in Case C-66/04 that "by the expression ‘measures for the approximation’ in Article 95 EC the authors of the Treaty intended to confer on the Community legislature a discretion, depending on the general context and the specific circumstances of the matter to be harmonised, as regards the harmonisation technique most appropriate for achieving the desired result, in particular in fields which are characterised by complex technical features.” (Paragraph 45).

Furthermore, in the international roaming case C-58/08, the ECJ held that:

“32. (…) the Community legislature may have recourse to (art. 114 TFEU) in particular where there are differences between national rules which are such as to obstruct the fundamental freedoms and thus have a direct effect on the functioning of the internal market (…) or to cause significant distortions of competition (…).

33. Recourse to that provision is also possible if the aim is to prevent the emergence of such obstacles to trade resulting from the divergent development of national laws. However, the emergence of such obstacles must be likely and the measure in question must be designed to prevent them (…)."

Several EU legislative acts based on Article 114 TFUE are related to NIS, showing that the EU legislator has already recognised the need to harmonise NIS rules to ensure the development of the internal market.

This was, in particular, the case for the ENISA regulation, [61] whose the Internal market legal basis was endorsed by the Court of Justice. The Court recognised[62] that [it] "was an appropriate means of preventing the emergence of disparities likely to create obstacles to the smooth functioning of the internal market in the area"[63]; and "the smooth functioning of the internal market risks being undermined by a heterogeneous application of the technical requirements"[64].

Regulation 460/2004/EC, establishing ENISA, states in Recital 3 that "the technical complexity of networks and information systems, the variety of products and services that are interconnected, and the huge number of private and public actors that bear their own responsibility risk undermining the smooth functioning of the internal market".

The 2010 Commission's proposal aimed at modernising and strengthening ENISA[65], currently under legislative procedure, is coherently based on Article 114 TFEU. As remarked in the Impact Assessment[66] accompanying the recent proposal for Regulation on ENISA "Uneven national policies and practices are a clear disruption of the internal market, due to the clear negative externalities resulting from NIS (inadequate policies impacting markets in other Member States), but also due to the positive externalities of good NIS practices (good practices in one Member State positively impact NIS as a whole, thus creating a clear societal good)".

The disparities resulting from uneven situations across the Member States in terms of capabilities, planning and level of protection, constitute at the same time a barrier to the internal market and justify EU action in cases with cross-border relevance, where coordination at the level of planning and at the level of response, including assistance, are needed.

Furthermore, information asymmetry and lack of transparency in the NIS market risk undermining the supply by market operators and manufacturers of networks, services and products as well as the trust of the users, which is one of the key drivers of the internal market.

Last, but not least, well-functioning networks and systems are essential for the functioning of our economy. Disruptions are increasing in frequency and magnitude undermining achievement of the digital agenda, which would have direct negative consequences for growth and jobs.

5.4.2. Subsidiarity test

Regulatory obligations are required to create a level playing field and close some legislative loopholes. A purely voluntarily approach has resulted in cooperation taking place only amongst a minority of Member States with a high level of capabilities. In order to ensure cooperation encompassing all the Member States it is necessary to make sure that all of them have the required minimum level of capabilities.

European intervention in the area of NIS is justified by the subsidiarity principle, due to the:

Cross-border nature of the problem

Given the cross-border nature of NIS threats and problems, a complete non-intervention at EU level would lead to a situation where each Member State is left to only guard its own backyard, with disregard of the interdependence between existing network and information systems. An appropriate degree of coordination among the Member States, on the other hand, would ensure that NIS risks can be well managed in the cross-border context in which they also arise, and therefore respects the subsidiarity principle.

According to a recent study[67], differences in security regulations represent a (barrier to operating in multiple countries and to achieving global economies of scale. These differences lead to replication costs (up to 27 times) for pan-European operators. Harmonisation could lead to some economies of scale, but these differences are more or less inherent to the level of discretion enjoyed by the individual Member States regarding security and privacy. Harmonising the implementation of regulation aimed at security and consumer protection is seen as an 'avoidable barrier'.

Effectiveness of the actions

Action at EU level would improve the effectiveness (and thus add value) to existing national policies, where they exist, or would facilitate their development.

In addition, it is clear that concerted and collaborative NIS policy actions can have a strong beneficial impact on the effective protection of fundamental rights, and specifically the right to the protection of personal data and privacy. European citizens are increasingly entrusting their data to complex information systems, either out of choice or out of necessity, without necessarily being able to correctly assess the related data protection risks. When incidents occur, they will therefore not necessarily be able to take suitable steps, nor is it certain that the Member States would be able to effectively address incidents with cross-border dimension in the absence of EU-wide NIS coordination. For this reason too, further policy action at the EU level seems to be widely justified.

5.4.3. Proportionality of the approach

The measures in the preferred option do not go beyond what is needed to achieve the objectives and do not impose disproportionate costs, as will be illustrated below.

The costs (see Section 8.2) that according to the preferred option would have to be incurred by those Member States lagging behind to put in place the necessary capabilities are not significant; for the others the costs will be negligible.

The costs for ensuring systematic cooperation amongst Member States according to the preferred option would be small when compared to the economic and societal losses and damages which may be caused by NIS incidents.

As to the private sector, should security requirements be set at EU level, they would apply only to some sectors for which the public consultation (see Section 4.1.4) underlined the importance of ensuring the security of network and information systems and markets and in which a serious NIS incident would have a direct and real-time effect on the EU economy and society. In any event, as indicated below, the measures proposed to ensure a basic level of protection would be proportionate to risks faced and hence reasonable and generally corresponding to the interest of the entities involved in ensuring continuity and quality of their services.

Moreover, many of these companies, as data controllers (e.g. banks and social networks) are already required by the current data protection rules to secure the protection of the personal data they control. For these companies the additional costs of the security requirements are likely to be marginal.

6. Objectives

The general objective is to increase the level of protection against network and information security incidents, risks and threats across the EU.

6.1. Overview of general, specific and operational objectives

Specific objectives || Operational objectives

1. To put in place a minimum common level of NIS in the MS and thus increase the overall level of preparedness and response. || – To ensure that all Member States are adequately equipped at national level both in terms of technical and organisational capabilities to prevent, detect, mitigate and respond to NIS risks, threats and incidents. – To ensure that all Member States develop and update national cyber security strategies and national cyber incident contingency/cooperation plans.

2. To improve cooperation on NIS at EU level with a view to counter cross border incidents and threats effectively. || – To ensure that national competent authorities share NIS information and best practices regularly. – To make sure that such bodies can exchange information cross-border in a reliable and confidential manner.

3. To create a culture of risk management and improve the sharing of information between the private and public sectors. || – To make sure that key private sector players and public administrations engage in assessment of the risks and risk management practices. – To ensure that NIS breaches with a significant impact are reported to the national competent authorities.

6.2. Intervention logic

The intervention logic, linking the main problem and the drivers behind this problem to the specific objectives is illustrated in the next figure:

7. Policy options

The Policy options that have been considered in this Impact Assessment are: Business as usual, Regulatory approach and Mixed approach.

7.1. Discarded Option

The possible Option consisting of ceasing all EU activities on NIS has been discarded.

The Option would imply to stop pursuing the actions under the CIIP action plan and dismantling EFMS and EP3R.

All efforts undertaken in the area of NIS would be left entirely in the hands of the Member States and cooperation would remain limited to a small number of countries, with no virtually mechanisms in place for increasing trust among all of them.

The existing gap between the highly advanced and the less-advanced Member States would likely increase and so would the internal market failures associated to the divergences in the capabilities across the Member States. Such outcomes would not be consistent with DAE "digital single market" and Europe 2020 "smart and sustainable economy" objectives nor would it be efficient or effective for the Member States to tackle NIS cross-border problems on their own.

7.1. Option 1 – Business as usual (‘Baseline scenario’)

Under this Option the Commission, with the assistance of ENISA, would continue with its voluntary approach. With a view to put in place a minimum common level of NIS in the Member States and thus increase the overall level of preparedness and response, the Commission would continue issuing Communications addressing the Member States. Member States would be encouraged to set up well-functioning CERTs and to adopt a national cyber incident contingency/cooperation plan and a national cyber security strategy.

In order to improve cooperation on NIS at EU level, the Commission would recommend to the Member States to establish a network of CERTs across Europe and to adopt a European cyber incident contingency/cooperation plan. The Commission could also dedicate specific funds for building up one or more secure communication network across the EU.

The remit of the EFMS could be expanded to include discussions on the take-up of NIS best practises (e.g. how to best manage risks) by public administrations.

The Commission would also continue to stimulate the creation a culture of risk management and improve the sharing of information between the private and public sector by using platforms such as the EP3R.

Under this Option, ENISA would continue offering its support and expertise to the Member States and to the private sector, for example by issuing technical guidelines and recommendations on NIS capabilities and cooperation.

7.2. Option 2 – Regulatory approach

Under this Option, in order to reach a minimum common level of NIS across the EU and thus increase the overall level of preparedness and response, the Commission would propose to require all the Member States to:

· Set up a well-functioning national/governmental CERT, responsible for handling security incidents and risks according to a well-defined process and complying with essential requirements in terms of mandate and service provided. CERTs would need to have adequate staff and financial resources to carry out their tasks effectively.

· Appoint a national competent authority for NIS which would have a coordination role for NIS and act as a focal point for cross-border cooperation. The authority should be given appropriate technical, financial and human resources and be tasked with the elaboration of the national cyber security strategy (see below). The Member States may decide to have one single body acting both as a CERT and as a competent authority. The CERT would act under the supervision of the competent authority.

· Adopt a national contingency/cooperation plan defining protocols for communication and cooperation among relevant players at national level in case of NIS incidents of a certain scale.

· Adopt a national cyber-security strategy that would outline the strategic objectives and announce the concrete policy actions that each Member State intends to undertake to pursue a high level of NIS.

The establishment of such a common and comparable level of capabilities would be a precondition to enable cooperation across the EU.

In order to improve cooperation on NIS at EU level, the Commission would propose to mandate the national competent authorities to form a network, together with the Commission, to cooperate against EU level. ENISA would support the competent authorities in their cooperation by providing its expertise and advice.

Within the network the competent authorities would exchange information on serious threats and incidents and would cooperate via coordinated response to counter cross-border threats and incidents. This would occur in organised fashion according to the European NIS contingency/cooperation plan that the Commission would adopt following consultation with the Member States via Comitology.

The competent authorities would also ensure timely and regular publication on a common website of non- confidential information on on-going significant threats and incidents and on the coordinated responses adopted.

To build capacity and knowledge in the Member States, the competent authorities would within the network exchange best practices assist each other in building NIS capacities, organise regular peer reviews and pan-European NIS exercises.

The exchange of sensitive and confidential information between the competent authorities would take place through an infrastructure ensuring security and confidentiality.

The Member States would be able to access this secure infrastructure following a decision of the Commission to be taken by means of delegated acts and following assessment that the minimum NIS capabilities at national level described above are in place. The transposition/implementation period would allow the necessary delays for the Member States to comply with the requirements on national NIS capabilities.

Under this Option the Commission would also propose to impose NIS risk management and reporting requirements on public administrations (e.g. central ministries, local authorities, land registries) and key private players thus creating a comprehensive framework to stimulate the creation of a culture of risk management and improve the sharing of information between the private and public sectors. More specifically, the Commission would propose that operators in specific critical sectors, i.e. banking, energy (electricity and natural gas), transport, health, enablers of key Internet services and the public administration, be required to assess the risks they face and to adopt appropriate and proportionate measures to dimension the actual risks.

A detailed list of the entities that would be covered is provided at the end of this Section. An estimation of the actual number of those operators is provided along with the cost assessment in Annex 3. Micro companies (i.e. companies with less than 10 employees[68]) would in any case not be in the scope of these obligations.

This requirement mirrors the one set out in Article 13a&b of the Framework Directive for electronic communications and would hence contribute to ensure a level playing field.

In order to give an indication of what this requirement may entail in practice, the ENISA guidelines on the security measures in Article 13a of the Framework Directive[69] can be taken as a sample. The activities that could fall under this requirement are:

· Regular risk analysis of specific assets for example information, software, physical assets, services and people. A number of standard methodologies exist for performing risk assessments, such as for example the ISO 27005 standard.

· Governance and risk management including establishing and maintaining an appropriate security policy; a governance and risk management framework to identify and address risks; an appropriate structure of security roles and responsibilities.

· Human resources security, i.e. adopting security measures to enhance the security of personnel such as employees, contractors and third-party users. This may include background checks; ensuring that personnel have sufficient knowledge and follows regular trainings; a process for handling security breaches committed by employees.

· Security of systems and facilities, that may include establishing and maintaining physical and environmental security of facilities; security of supplies and supporting facilities such as electric power, fuel or cooling; appropriate (logical) access controls for access to network and information systems; appropriate security of network and information systems.

· Operation management, i.e. security of operation and management of network and information systems. This may include establishing and maintaining operational procedures and responsibilities and asset management procedures in order to verify asset availability and status.

· Incident management, i.e. establishing and maintaining standards and procedures for managing incidents. This may include establishing capabilities for detecting incidents and forwarding them to the appropriate departments within an appropriate time frame; processes for incident response and escalation; incident reporting and communication plans.

· Business continuity management, i.e. monitoring, testing and auditing of network and information systems, facilities and security measures, for example including policies for testing network and information systems.

Moreover, the entities indicated above would be required to report incidents with a significant impact on the services provided[70]. This would also be in line with Article 13a&b of the Framework Directive.

These entities would have to report to the national competent authorities those incidents seriously compromising the operation of networks and information systems and thus having a significant impact on the continuity of services and supply of goods which rely on network and information systems.

For example, an incident affecting an e-commerce platform and preventing the conclusion of on-line transactions over several hours would have to be reported. Likewise, a maintenance incident of an information system of a power plant, which results in stopping the distribution of electricity to a small city during several hours, would also have to be reported. National competent authorities would be empowered to request information, order security audits, issue instructions and carry out investigations on the players covered.

44.4% of respondents to the public consultation expressed the view that a requirement to notify and report incidents to NIS authorities would be needed to make private companies and public administrations systematically report about cyber security incidents.

57.4% of respondents to the public consultation expressed the view that support from NIS authorities to respond to incidents would be needed to the same purpose.

The reporting of breaches would be tightly linked to the cooperation among the competent authorities at EU level, given that the information fed to them would have to be shared with other competent authorities via the network when it has an actual or potential cross-border dimension. Also, competent authorities would have to prepare annually a summary report on the notifications received that would have to be provided to the Network.

Under this Option, ENISA would continue offering its support and technical expertise to the Member States and to the private sector, for example by issuing technical recommendations and guidelines on capabilities, on EU-level cooperation, on risk management and on the reporting of NIS incidents.

Entities that would be covered by risk management and NIS incidents reporting obligations are (more detailed indications are provided in Annex 3):

· Energy (electricity market and gas market):

– Main electricity generating companies (i.e. those dealing with at least 5% of the country’s electricity or gas)

– Electricity retailers for final consumers

– Entities bringing natural gas into the country

– Retailers selling natural gas to final customers

The estimated total number of businesses affected in this sector would be approximately 4000.

· Transport

– Air carriers (Freight and passenger air transport)

– Maritime carriers (sea and coastal passenger water transport companies[71] and the number of sea and coastal freight water transport companies[72])

– Railways (infrastructure managers[73], integrated companies[74] and railway transport operators[75])

– Airports (EU airports with more than 15.000 passenger unit movements per year)

– Ports

– Traffic management control operators

– Auxiliary logistics services (a) warehousing and storage[76], b) cargo handling[77] and c) other transportation support activities[78])

The estimated total number of businesses affected in this sector would be approximately 14600.

· Banking: credit institutions[79] and stock exchanges

The estimated total number of businesses affected in this sector would be approximately 7706 for credit institutions and 25-30 for stock exchanges.

· Health sector: Hospitals including private clinics

The estimated total number of businesses affected in this sector would be approximately 15 000.

· Enablers of Internet services

These would include e-commerce platforms, social networks, search engines, cloud providers (Table 8 in Annex 2 provides a thorough indication of relevant players that would be in the scope). Software editors and providers would be excluded. The estimated total number of businesses affected in this sector would be approximately 1400.

· Public administrations[80], including local administrations

It should be noted that this represent just an overall indication of the number of businesses that would be in the scope. Annex 3 provides a detail analysis of the process that led to these results.

The importance of ensuring NIS in these sectors has already been highlighted in Section 4.1.4 which also provides the views of the respondents to the public consultation on the importance to set NIS requirements for those who operate in these domains[81].

The same players should engage in NIS risk management and report NIS incidents with a significant impact to national competent authorities.

Only those players operating critical infrastructure and providing vital services relying on ICT significantly would be subject to these obligations. As explained in section 4.1.4 given their dependency on network and information systems, these players are particularly vulnerable to NIS incidents. These sectors are also critical for the economy and society and a serious NIS incident affecting them may produce significant negative side costs and often impair the functioning of the internal market. In many of these sectors a significant "network effect" can be observed, i.e. energy transmission or key online services are by definition provided over a network, the energy grid on the first case and the Internet in the latter. For these reasons the spill-over effects of an incident may be more difficult to contain.

It can be reasonably presumed that most of the players indicated above are, as data controllers, already required under the data protection regulatory framework to implement appropriate technical and organizational security measures to protect the personal data they handle. The following players are also data controllers:

· Energy distributors;

· Air, maritime, railway carriers;

· Credit institutions;

· Hospitals and private clinics;

· E-commerce platforms, social networks, booking engines; payment systems; operators of cloud computing platforms (in many cases)

· Public administrations

The table below (Figure 5) shows the extent to which existing obligations address NIS issues and what gaps would be filled by the preferred option.

|| Covered by existing EU legislation || Not covered by existing EU legislation

Measures to ensure a high level of NIS || Data controllers across all sectors to adopt technical and organizational measures to protect personal data (Article 17, Directive 95/46/EC) || Technical and organisational measures to secure network and information systems beyond the purpose of protecting personal data across all sectors

|| Providers of electronic communications networks and services to do NIS risk assessment and risk management (Article 13a&b, Directive 2002/21/EC) ||

|| Put in place security plans in European Critical Infrastructure in the European Critical Infrastructure in the energy and transport sector ( around 20 infrastructure identified so far) (Directive 2008/114/EC) ||

Measures to cooperate at EU level || Where appropriate, the national regulatory authority concerned shall inform the national regulatory authorities in other Member States (Article 13a, Directive 2002/21/EC) || Cooperation at EU level among authorities dealing with NIS or among sector-specific authorities sharing information on NIS risks and incidents

|| Where appropriate, in particular if a breach of security or loss of integrity concerns two or more Member States, the supervisory body concerned shall inform supervisory bodies in other Member States and ENISA (Article 15, Proposal for Regulation on e-identification and trust services) ||

Measures to report NIS incidents || Notification of personal data breaches by data controllers across sectors to the supervisory authority and in specific cases to the data subject (Article 31 and 32, Proposal for Regulation on data protection Article 31 and 32) || Notification of security breaches which do not involve breaches of personal data across sectors

|| Notification of personal data breaches by electronic communications providers to the competent national authority and in specific cases to the individual or subscriber (Article 4(3) of e-Privacy Directive 2002/58/EC) ||

|| Electronic communications operators to notify to the competent authorities breaches of security or loss of integrity with a significant impact on the operation of electronic communications networks and services (Article 13a, Directive 2002/21/EC) ||

|| Trusted service providers to notify to the competent national body breaches of security of loss of integrity with a significant impact on the trust service provided and the personal data maintained therein (Article 15, Proposal for Regulation on e-identification and trust services) ||

Figure 5: Table on existing regulatory gaps

7.3. Option 3 - Mixed approach

Under this Option, the Commission would combine voluntary initiatives based on the goodwill of the Member States, aimed at setting up or strengthening Member State NIS capabilities and at establishing mechanisms for EU-level cooperation, with regulatory requirements for key private players and public administrations on the adoption of NIS risk management measures and the notification of NIS incidents with a significant impact.

With a view to reach a minimum common level of NIS across the EU and thus increase the overall level of preparedness and response, the Commission would encourage the Member States, via Communications or Recommendations, to build national capabilities and particularly CERTs, to appoint a national competent authorities for NIS, to adopt national cyber incident contingency/cooperation plans and to adopt a national cyber security strategy.

In order to improve cooperation on NIS at EU level with a view to counter cross border incidents and threats effectively, the Commission would recommend to the Member States to establish a network of CERTs across Europe and to adopt a European cyber incident contingency/cooperation plan.

The remit of information sharing platforms such as EFMS could be further extended to include in the public policy exchanges taking place therein also public authorities from critical sectors such as banking, energy, transport or health.

These soft measures would be accompanied by regulatory requirements aimed at closing existing regulatory loopholes and create a level playing field across the EU.

In a view to stimulate the creation a culture of risk management and improve the sharing of information between the private and public sector, the Commission would propose to legally require public administrations and key private players in specific sectors (banking, energy - electricity and natural gas -, transport, health, postal services, Internet services and public administrations, see Option 2) to carry out risk management by assessing the risks they face and adopting measures appropriate to meet those risks.

In addition, public administrations and key private players will have to report to national comp