The EU co-legislators - the European Parliament and the Council - began discussing the future certification framework at their second negotiation meeting for the Cybersecurity Act on the evening of 1 October in Strasbourg. A third meeting is scheduled for mid-November.
As a reminder, the draft regulation presented just one year ago gives a permanent mandate to the current European Network and Information Security Agency (ENISA). It also establishes a European cybersecurity certification framework for the means of communication (ICT) and common rules governing European cybersecurity certification systems (see EUROPE 11865).
Main differences
After a first negotiating meeting on 13 September dedicated to the mandate of the new agency, the co-legislators discussed the second part of the proposal, namely the certification framework. They mainly discussed the role of the Member States and the various stakeholders: overall, compared to the initial proposal, one could say that the Council wants to rely more on the Member States while Parliament wants to involve industry more.
The voluntary or mandatory nature of the framework, the main difference between Parliament and the Council, was also mentioned. Both institutions agree on the general principle that the framework should be voluntary. But the European Parliament adds an exception obliging "essential service operators", whose malfunctioning in the event of an incident could have a significant disruptive effect, to comply with it mandatorily (Article 48a) (see EUROPE 12059).
Other topics discussed
At their meeting, the co-legislators also discussed other proposals from the European Parliament that were not included in the Commission's proposal. For example, they referred to Article 47a on cybersecurity information to be provided for certified products, processes and services. And Article 20a on the creation of a "Stakeholder Group for Certification" to provide general advice and an ad hoc committee to propose, develop and adopt each candidate system.
Two technical meetings are planned at this stage, on 12 and 18 October. A third trialogue could then be organised around 14 November.
See table 4 columns: https://bit.ly/2xldyxD. (original version in French by Sophie Petitjean)