Debate: Adoption of the Cyber package proposals
Date: TUESDAY, 18 APRIL 2023
Speaker: Margaritis Schinas
Language: EN

This package aims at strengthening the operational part of our cybersecurity framework and has two main components: the Cyber Solidarity Act and the Cybersecurity Skills Academy. Thierry will take the floor in a minute on the Cyber Solidarity Act, but let me briefly – before taking you through the Cybersecurity Skills Academy – say a few words on the overall context in which we present this package. This is the last missing piece in the EU’s cybersecurity legislative framework. In this political term, we have done a lot. Together with this House and the Member States, we have managed to enact, in record time, a regulatory framework on the NIS2 Directive, the protection of our cybersecurity shield capacities, and our Cyber Resilience Act which, for the first time, takes us into the realm of regulating cybersecurity products, not only services. And, of course, drawing on the lessons from the war in Ukraine, the cyberwar in Ukraine, we are now beefing up our operational capacities to ensure cyber resilience and response capacities across the EU. To cut a long story short, on the overall framework, what we can say in very simple terms is that we are producing a real European way for cyber: a European way which is modern, which is fit for purpose and which is also values—driven. On that specific point of values—driven, I would like to say a few words on the EU cybersecurity reserve – an initiative included in this package that would enable incident—response services from trusted private sector providers ready to intervene at the request of a Member State in case of significant and large—scale cybersecurity incidents. These are the ‘good rangers’ that will be available when we need them, and this is a major lesson drawn from our experiences in the war, the cyberwar in Ukraine. Now, let me switch to the Cybersecurity Skills Academy, which is a very specific initiative to bridge the skills gap – a gap that will only widen in the coming years due to the new set of legislation that we have been able to produce. The idea of the academy came to us a few years ago when talking to industry leaders at the Munich Security Conference and other stakeholders. They expressed their enthusiasm for moving into cybersecurity considerations but, at the same time, they expressed their concerns about the lack of people that would be necessary to implement these new rules. They even advanced the rather dramatic figure of 500 million cybersecurity experts that we are missing in the coming years. So we need a sufficient and adequately trained cybersecurity workforce in Europe, and we need the people to make it happen. In fact, the quality of our cybersecurity depends precisely on the quality and the number of the people that will be necessary. So the academy aims to accelerate our efforts. The academy will be a single point of entry for cybersecurity education and training, as well as for funding opportunities. And the focus will be on cybersecurity professionals to scale up the currently scattered, fragmented efforts that we can see around as a result of initiatives from the private sector, governments, think tanks. We now need to bring all this together. The academy will mainly do four things. First, it will foster knowledge generation and knowledge training, working on a common framework for cybersecurity role profiles. It will enhance the European education and training offer and provide visibility and clarity over training and certification, because we need some sort of certification to be able to testify, to verify, that the various initiatives that are being developed can produce an ecosystem that can be deployed across the European Union and across the different sectors. The second task of the academy would be to take specific concrete actions with concrete training pledges. Thirdly, to ensure a better channelling and visibility of the many important funding opportunities that we now have for skills—related activities. And finally, to define indicators that will allow us to monitor the evolution of the market and assess the effectiveness of their actions, shifting from measuring progress based on the number of people to the quality and the intensity of the training produced. So the academy will not be a school. It will not be a cumbersome, bureaucratic structure. It will be  Honourable Members of this House, the cybersecurity skills and the academy part of the cyber package represents, I would say, a step change in the very well—established process under this Commission to produce a level of cybersecurity that is no longer a matter for industry but a matter for society. It is no longer a matter of enhancing commercial profit, but it’s a very specific ecosystem of guaranteeing Europeans national security.