JOINT COMMUNICATION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL

Report on implementation of the EU's Cybersecurity Strategy for the Digital Decade

I.Cyber resilience, operational capacity and openness more essential than ever

Cybersecurity is indispensable to the deployment of smarter and greener technology in the post-pandemic world. It is indispensable overall to the EU’s security and it is a pillar of the Security Union. Social, political and economic development requires technological sovereignty and a global, open and secure cyberspace, grounded in the rule of law and respect for human rights and fundamental freedoms. This was the core premise of the Joint Communication of the Commission and High Representative for Foreign Affairs and Security Policy on the EU's Cybersecurity Strategy for the Digital Decade, adopted on 16 December 2020. All critical entities are potential subjects of cyberattacks. The developments in the past six months have vindicated the strategy’s focus on stepping up regulatory reforms, on investment and on collective operational response.

Recent cyberattacks have demonstrated, in particular, the increased pervasiveness of ransomware and cyberespionage operations and their growing risk for all sectors of the economy and society at large. The scale of the incidents has been extraordinary: hundreds of thousands of servers affected in the attacks on Microsoft Exchange; 18 000 organisations potentially affected by the SolarWinds Orion campaign; sensitive data on hundreds of patients stolen and medical services disrupted in the ransomware attack on Ireland’s health service; a fuel emergency and massive data theft in the cyberattack on the Colonial Pipeline billing system; and disruption of operations of the world’s largest beef supplier. While the full extent of the damage remains unclear, each incident highlights the potential far-reaching consequences of malicious exploitation of vulnerabilities in information and communication technology products, services, systems and networks. Such cyberattacks can be expected to increase in impact and frequency and to undermine our security.

It is essential, therefore, for the European Union to accelerate progress on all fronts - legislative, operational, investment-related and diplomatic - as set out in the strategy. The proposals for a Directive on measures for a high common level of cybersecurity across the Union (‘the NIS2 Directive’), for a Directive on the resilience of critical entities, as well as for a Regulation and Directive on Digital Operational Resilience, should be adopted as soon as possible. In this context, it is essential to pursue an ambitious approach notably regarding supply chains, in view of how vulnerabilities in recent cyberattacks were traced back to software vendors, and to take measures ensuring the resilience of public administrations and the swift notification of incidents. The need to establish a network of Security Operations Centres (or ‘SOCs’) for early detection of signals of cyberattacks has become more pressing than ever, as has the need to develop a credible, effective and collective EU response, including at operational level, to major incidents through the Joint Cyber Unit. Given the increase of cyberattacks conducted by state or state-sponsored actors, responsible state behaviour must continue to be promoted in the United Nations, as well as through cyber dialogues and structured exchanges with regional organisations, including the African Union, the ASEAN Regional Forum, the Organisation of American States (OAS), and the Organisation for Security Cooperation in Europe (OSCE), along with effective diplomatic action to prevent, discourage, deter and respond to malicious behaviour in cyberspace. Of particular importance will be cooperation with like-minded third countries and the priorities of the transatlantic agenda; notably the EU-US cooperation on specific cybersecurity aspects should be further explored, including on information sharing and combatting ransomware.

II.Overview of first six months of implementation

A number of strategic actions are already well advanced.

II.1 Resilience, Technological Sovereignty and Leadership

Around the world, supply chains and critical infrastructure, including hospitals battling the COVID-19 pandemic, are now at constant risk of cyberattack. The Commission is supporting the co-legislators to ensure the swift adoption of the proposed reform of the NIS Directive, which will in particular expand coverage of the health sector including research labs and manufacturing of critical medical devices and medicines, and new energy sector activities such as hydrogen production, district heating, electricity production and central oil stockholding.

The Regulation setting up the Cybersecurity Competence Centre and the Network of National Coordination Centres was adopted on 20 May 2021. It will pool resources from the EU, Member States and industry to improve and strengthen technological and industrial cybersecurity capacities, enhancing the EU's open strategic autonomy, and offering a possibility to consolidate part of the cybersecurity-related activities funded under Horizon Europe, the Digital Europe Programme and the Recovery and Resilience Facility – funding streams totalling up to EUR 4.5 billion over the next six years. This will support the development by 2023 of an EU Cyber Shield for early detection of cyberattacks composed of a network of Security Operations Centres, which may be public or private and will leverage Artificial Intelligence-powered tools. Several Member States have included the development of such national centres under their respective Recovery and Resilience plans. The Commission will complement these efforts by allocating funds from the Digital Europe Programme and support their phased connection. The financial programmes will also support the EuroQCI initiative to build a secure quantum communication infrastructure spanning the whole EU, including its overseas territories, using the best combination of ground-based and space-based technologies, and a specific budget line to support cyber resilience in the health sector.

Ensuring 5G cybersecurity is a continuous process that will accompany the gradual deployment of 5G and implementation of the EU 5G Toolbox. Most Member States have already - or soon will have - in place frameworks for imposing appropriate restrictions on 5G suppliers. Requirements on mobile network operators are being reinforced through the transposition of the Electronic Communications Code, and the EU Agency for Cybersecurity, ENISA, is preparing a candidate EU cybersecurity certification scheme for 5G networks. Looking at new trends and developments in the 5G supply chain, Member States authorities have decided to launch an in-depth analysis of the security implications of open, disaggregated and interoperable network technology solutions (‘Open RAN’) under the EU toolbox. The result of this work will further contribute to the EU’s concerted approach to the security of 5G networks.

Greater efforts are required, notably through the EU’s Digital Education Action Plan, to address the massive skills shortage predicted to reach almost two million unfilled cybersecurity posts globally by 2022 and 350 000 in Europe alone, and the severe underrepresentation of women – women make up only 11% of the global cybersecurity workforce and even less - 7% - in Europe. Other ongoing policy initiatives include preparatory work for future initiatives for security of the Internet of Things and, on internet standards, the development of a non-profit domain name resolution service (‘DNS4EU’).

II.2 Building Operational Capacity to Prevent, Deter and Respond

With the rise in state and state-sponsored as well as criminal attacks on networks and information systems, and the increasing reliance on databases of sensitive information, the EU requires closer interconnection of the cyber communities. They need to respond coherently to the civilian, criminal, diplomacy and defence aspects of large-scale cyberattacks that many sensitive economic sectors have recently been experiencing. Efforts by all communities are therefore necessary to complete the four steps outlined in the Commission’s Recommendation on building the Joint Cyber Unit, adopted at the same time as this report, as a mechanism for further coordination and filling gaps in the EU’s response to cyber threats. In the fight against cybercrime, political agreement was reached on the temporary regulation against child sexual abuse online, which will shortly be adopted, and the Commission’s new Organised Crime Strategy focuses on the need to equip law enforcement with the digital tools they need. The Commission also adopted in February 2020 an Action Plan on synergies between civil, defence and space industries which identifies a new flagship project for the establishment of an EU space-based global secure connectivity system. It aims to “enable access to high-speed connectivity for everyone in Europe, and provide a resilient connectivity system allowing Europe to remain connected whatever happens”.

From the international perspective, in line with the ambition set under the Strategic Compass, the High Representative is currently preparing the review of the Cyber Defence Policy Framework that is to be presented to Member States in the second half of 2021. The High Representative has worked to improve the EU's ability to prevent, discourage, deter and respond to malicious cyber activities, including by strengthening international cooperation. On 17 May 2021, the European External Action Service (EEAS), in cooperation with the Portuguese Presidency and the European Union Institute for Security Studies (EUISS), organised a scenario-based discussion with EU Member States and international partners to improve the mutual understanding of the respective diplomatic approaches to prevent, discourage, deter and respond to malicious cyber activities, and to identify opportunities for further reinforcing international cooperation to this end. To strengthen further the EU’s cyber diplomacy toolbox, the EEAS is collecting lessons learnt and may review the implementing guidelines of the framework for a joint EU diplomatic response to malicious cyber activities.

As announced in the EU cybersecurity strategy for the digital decade, the Commission is launching a study to develop awareness-raising tools aimed at improving the preparedness and resilience of EU businesses against cyber-enabled intellectual property theft. The Commission also intensified enforcement actions in relation to the 2013/40/EU Directive on Attacks against information systems by launching additional infringement proceedings against several Member States in June 2021. The Commission will consider further action as necessary. Improving the availability of cybersecurity skills in the EU’s workforce will also be key; the Cybersecurity Competence Centre will deliver key actions in this respect with the aim of improving knowledge and capacity and of encouraging interdisciplinary skills to be developed in the area of cybersecurity.

II.3 Advancing a Global and Open Cyberspace

The threat landscape is compounded by geopolitical tensions over the global and open Internet and over technologies across the whole supply chain. Restrictions of and on the Internet, the increase in malicious cyber activities and those affecting the security and integrity of information and communication technology products and services, are a threat to a global and open cyberspace, as well as the rule of law, human rights, fundamental freedom and democratic values. The High Representative, together with Member States, is therefore working to advance responsible state behaviour in cyberspace, notably by establishing a Programme of Action (PoA) to Advance Responsible State Behaviour at United Nations level, together with the 53 other co-sponsors, building on the recommendation of the 12 March 2021 consensus report from the United Nations Open Ended Working Group on Developments in the Field of Information and Telecommunications in the Context of International Security. The EU is working on strengthening and expanding the relations with third countries, international and regional organisations as well as the multi-stakeholder community through cyber dialogues, as set out in the strategy, by the establishment of an EU Cyber Diplomacy Network. Furthermore, the EU Cyber Capacity Building Board is being set up, allowing EU institutions, bodies and agencies to better coordinate and cooperate on the EU’s external cyber capacity-building efforts.