On Friday 18 November, the Council of the EU adopted its position (‘general approach’) for the forthcoming interinstitutional negotiations on measures for a high common level of cybersecurity in the EU institutions, agencies and bodies (see EUROPE 13037/18).
In detail, the EU Council’s approach to this issue confirms the European Commission’s proposed strengthening of the mandate and funding of the Computer Emergency Response Team for EU institutions, bodies, offices and agencies (CERT-EU).
Still on the role of CERT-EU, the EU Council also confirms the desired strengthening of information sharing on incidents with the Computer Emergency Response Team.
In addition, the EU Council’s position also validates the idea of the creation of an interinstitutional cybersecurity council to steer and oversee the implementation of the future Regulation.
In addition, the EU Council deleted references to the Joint Cyber Unit (see EUROPE 12815/8), due to the lack of a clear mandate and composition. The deletion of this reference was supported by several Member States since the beginning of the discussions on this subject (see EUROPE 12974/13).
Several points in the text have been aligned with the provisions of the revised ‘NIS 2’ Directive (see EUROPE 12992/31), which is intended to ensure a high level of cyber security in the EU.
A number of definitions have also been aligned with those of the NIS 2 Directive, as requested by several Member States, as have the incident reporting obligations. A new Article on voluntary peer reviews has been included to facilitate the exchange of information and to learn from shared experiences.
Finally, several provisions are now included to strengthen the mechanisms to ensure compliance of EU institutions, agencies and bodies with the future Regulation and to ensure greater reciprocity in the exchange of information between the EU public administration and the Member States.
The European Commission presented this proposal on 22 March.
The interinstitutional negotiations can start as soon as Parliament has also adopted its position.
See the document: https://aeur.eu/f/45a (Original version in French by Thomas Mangin)