The European Court of Auditors published a special report on Tuesday 29 March in which it points out the inadequate preparations made by EU institutions, bodies and agencies (EUIBA) against cyber security threats.
The special report points out that the level of preparedness for cyber threats differs between EU institutions, bodies and agencies, but is “overall not commensurate with the threats”, while “significant incidents increased more than tenfold between 2018 and 2021”.
In addition, the “strong” interconnection between the different entities – including with public or private actors located in the Member States – can cause a ‘domino’ effect in case of an attack, according to the details of the report.
The European Court of Auditors also notes that the Computer Emergency Response Team for EU Member States (CERT-EU) and the European Union Agency for Cybersecurity (ENISA) have not been able to put in place effective cyber security assistance due to a lack of resources.
The Court of Auditors makes a number of recommendations to address this lack of “coherent approach”, which is attributed, among other things, to a lack of training and sharing of information between EU institutions, bodies and agencies, as well as a wide variation in the allocation of resources within them.
The report therefore calls for ENISA and CERT-EU to place a greater focus on those EUIBAs that are less advanced in the field of cyber security. The report also calls on the Commission to improve the preparation of EUIBAs by “legislative proposal introducing common binding rules” and to increase resources.
The European Commission took the lead on this issue by presenting, on 22 March, two legislative proposals aimed at making all EU institutions and bodies more resilient to cyber attacks (see EUROPE 12916/21).
See the report: https://aeur.eu/f/10w (Original version in French by Thomas Mangin)