WRITTEN QUESTION E-0182/04 by Charlotte Cederschiöld (PPE-DE) to the Commission. Network and information security.
Date: 2004-01-29
Institutions: European Parliament, Provisional data
Subjects: European Union Agency for Cybersecurity, computer network, data protection, international standard, product safety, software, standardisation

C 84 E/766

Official Journal of the European Union

EN

3.4.2004

and are not being considered by all Member States during the procurement of ICT products? Has the
Commission considered how the European Network and Security Agency can promote further European
uptake of the Common Criteria?

(2004/C 84 E/0861)

WRITTEN QUESTION E-0182/04

by Charlotte Cederschiöld (PPE-DE) to the Commission

(29 January 2004)

Subject: Network and information security

Does the Commission agree that ICT products should be designed with specific security standards in mind,
and with the goal of being evaluated and certified as having an internationally recognised level of security?
If so, how can the European Network and Information Security Agency use the ‘Common Criteria’ to
promote this goal?

(2004/C 84 E/0862)

WRITTEN QUESTION E-0183/04

by Charlotte Cederschiöld (PPE-DE) to the Commission

(29 January 2004)

Subject: Network and information security

Information technology security continues to be an area where the Commission and other EU-level bodies
must take care to protect their internal systems. Does the Commission agree that the ‘Common Criteria’
provide internationally accepted standards for judging the security of ICT products and, if so, how can the
European Network and Information Security Agency use the Common Criteria when procuring its own
products and providing procurement guidance to EU and Member State bodies?

Joint answer
to Written Questions E-0181/04, E-0182/04 and E-0183/04
given by Mr Liikanen on behalf of the Commission

(10 March 2004)

With regard to network and information security standardisation and on Common Criteria in particular,
the Commission has contributed throughout the whole process of the development of Common Criteria
ever since the work with the predecessor, ITSEC, in 1991. The Commission has also worked with Member
States in defining the Mutual Recognition Agreement of the Common Criteria standard ISO/IEC 15408.

is also mentioned by the
The European Network and Information Security Agency (ENISA),
Honourable Member as a possible vehicle for promoting this standard further in Europe, is about to start
its operations within the coming months. The Commission is presently contributing to the drafting of the
ENISA’s work programme. In this reply the Commission suggests some tasks related to standardisation for
ENISA, but no definitive answers can, at this stage, be given as to what ENISA’s coming work programme
will look like.

that

From the Commission’s perspective, the use of recognised standards for evaluation and certification of ICT-
products has been an important component of the policy for network and information security. The use of
such standards in procurement activities was promoted in the Council Recommendation (95/144/EC) of
7 April 1995 (1). In the Commission Communication Network and Information Security: Proposal for A
European Policy Approach (2), the Commission emphasised the importance of security certification of
products as a key element to contribute to the users’ trust and confidence. In this respect, the Common
Criteria standard represents a solid,
internationally recognised, framework for security certification of
products. As such, it is widely used in procurement activities.