Despite experts in the European Cybersecurity Certification Group (ECCG) meeting on Tuesday 18 June, the European Cyber Certification Scheme (EUCS) has still not received the requisite approval.
While approval was on the agenda for the meeting, it was, in the end, withdrawn at the weekend. The issue continues to be disagreement over the criteria for sovereignty and security in the cloud (see EUROPE 13392/13).
According to several sources, the reason for yet another postponement is that the European Commission has yet to give guidelines on how each Member State may or may not add its own criteria at national level, particularly with regard to sovereignty.
The Cybersecurity Act, to which the EUCS is linked, states that national security schemes should normally disappear when the EUCS is adopted.
France has been leading the fight against national schemes being dropped in this way, originally advocating for the implementation of a stricter version of the EUCS in terms of security and sovereignty guarantees, equivalent to its own ‘SecNumCloud’ system (see EUROPE 13394/9).
With these guarantees having been abandoned, Paris is now fighting to obtain the possibility of safeguarding ‘SecNumCloud’ at national level.
The latest version of the text should already have been adopted on 16 April, but was thwarted by opposition from the French. The next meeting of the group of experts is scheduled for mid-July.
At the same time, 26 European interest groups published a joint letter on Monday calling on the Member States to adopt the EUCS quickly.
“The removal of both ownership controls and Protection against Unlawful Access (PUA) / Immunity to Non-EU Law (INL) requirements ensures that cloud security improvements align with industry best practices and non-discriminatory principles”, they said.
To see the letter, go to https://aeur.eu/f/cpr (Original version in French by Isalia Stieffatre)