May 20, 2019

The document sets out information on the new Regulation of the European Parliament and of the Council on ENISA, (EU Cybersecurity Agency), and on the Information and Communications Technology and Cyber Security Certification (Cybersecurity Act).

The legislation was published in the Official Journal of the European Union on the 17 April 2019 and entered into force 20 days after that date.

The Government explains that ENISA’s main task is to enhance capability to prevent and respond to network and information security problems within the EU by building on national and Union efforts. The new EU Regulation strengthens the role of ENISA and provides it with a permanent mandate in order to give it a stronger and more central role. The Regulation clarifies ENISA’s role as the EU agency for cyber security and makes moderate revisions to the organisation and governance to give greater consideration to the needs of wider stakeholders.

The Regulation also sets up a framework to govern voluntary European cyber security certification schemes. The Government explains that the purpose of this is to increase trust and security of ICT products and services and address existing certification fragmentation in the certification landscape to reduce costs and administrative burdens for companies and strengthen the digital single market. The Regulation does not introduce directly operational certification schemes, but creates a system that allows schemes to be established and recognised across the EU.

In terms of the UK’s exit from the EU, the Government explains that the Regulation does not introduce any directly operational cyber security certification schemes, so there will be no operational implications for industry that arise as a direct result of this legislation following the UK’s departure from the EU.

If there are EU Certification Schemes in operation when the UK leaves the EU as a result of this framework, then the UK’s future relationship with those will be considered in the context of the individual schemes. Article 54 of the Regulation requires individual certification schemes to include conditions for the mutual recognition of those schemes with third countries. To access the Government’s explanation, click here.