On Wednesday 2 December, the Council of the EU adopted by written procedure the conclusions that address the risks posed by connected devices to privacy, information security and cyber security.
These conclusions, adopted with the support of all delegations, take note of the increased use of internet-connected consumer products and industrial devices. They set priorities to address this issue and make the EU Internet of Things sector more globally competitive, ensuring the highest standards of resilience, security and safety.
The conclusions stress the importance of assessing the need for long-term horizontal legislation to address all relevant aspects of cybersecurity of connected devices, such as availability, integrity and confidentiality. This would include specifying the necessary conditions for placement on the market. They encourage the Commission to “assess, where necessary, additional specific regulations to define the level of cybersecurity to be achieved by a connected device” to ensure that privacy and security criteria are met for high-risk devices.
The document notes that cybersecurity certification as defined in Regulation 2019/881 on cybersecurity will be essential for raising the level of security within the digital single market. The European Union Agency for Cybersecurity (ENISA) is already working on cybersecurity certification schemes, notably for cloud computing, and the conclusions invite the Commission to consider a request for candidate cybersecurity certification schemes for connected devices and related services.
Link to the Council conclusions: https://bit.ly/2JtEMv6 (Original version in French by Sophie Petitjean)