29.9.2023
EN
Official Journal of the European Union
L 242/119
59.
Acknowledges the efforts made by the Court, also in 2021, to adapt to changing working conditions, fostering a digital transformation of auditing and an upgrade of technology and practices across the organisation to continue providing an effective public audit service in the Union; is aware that further progress in this direction requires accessible data made available in the required format by the Commission or the Member States; calls on the Commission to encourage the Member States to work towards more interoperability;
60.
Understands that, also in 2021, in consideration of the limitations imposed by the COVID-19 pandemic, the whole audit lifecycle was largely performed digitally, covering audit preparation, evidence gathering and adversarial procedures, and that missions to Member States were replaced by video calls that included remote interpretation where needed;
61.
Appreciates the important milestones that have marked the digital scene of the Court in 2021, such as the introduction of a robotic process for automation services, introduced to reduce repetitive low-value work for audit teams, the automation of the audit of the executive agencies, as part of the regular audit process, and the implementation of a brand new cloud-based translation management system;
62.
Welcomes the completed implementation of the cybersecurity plan for the 2018-2021 period and the adoption of a new cybersecurity plan for the next three years (2022-2024), which envisages a gradual move to a zero trust architecture in line with the provisions set out in the proposal for a Regulation of the European Parliament and of the Council laying down measures for a high common level of cybersecurity across the institutions, bodies, offices and agencies of the Union; notes that no relevant successful cyber-attack against the Court was detected in 2021 and appreciates the importance of the cooperation of the Court with the Computer Emergency Response Team for the EU Institutions, bodies and agencies (CERT-EU); invites the Court to maintain a high level of attention on cyberthreats and information security, especially because the number of serious cyber-attacks increased considerably in recent years, making all Union institutions attractive targets for potential attackers; encourages the Court to carry out regular risk assessments of its IT infrastructure;
63.
Notes that, in 2021, the Court co-hosted the kick-off event for European Cybersecurity Month and that the Court’s diversity and inclusion officer coordinated one of the main sessions for the kick-off event about women in cybersecurity, at which a diverse group of women from different backgrounds exchanged views on women’s motivation to join the field of cybersecurity and technology;
64.
Notes that, in 2021, the reinforcement of budget lines was decided for investment in equipment and services mainly related to hybrid working and digitalisation, and that additional appropriations were also used to strengthen the Court’s cyber defence capabilities, invest in a new translation management system and a new stakeholder management system, and implement the Union’s electronic signature solution;
65.
Welcomes the decision to implement free open-source software as key components of the Court, such as Linux as the operating system for several IT infrastructure servers, the open-source software Belenios for a secret ballot voting system and the open-source software Nagios for the Court’s IT operations teams; observes that Courts uses the open-source software NextCloud for exchanging documentation with auditees in the framework of the ECAFiles system that operates under the highest security and personal data protection standards;
66.
Welcomes the implementation of data-processing agreements whenever data is processed by third parties and the Court, as controller, is to ensure compliance with Article 29 of Regulation (EU) 2018/1725 of the European Parliament and of the Council (3) and maintain full control over processing operations; notes the systematic consultation of the Court data protection officer on matters related to data processing and technical and organisational measures;
(3) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).