EU cybersecurity package: what the European Commission is planning

Why the EU is acting now

Cyberattacks have long been part of everyday life. Critical infrastructure, companies and even democratic institutions are regularly affected. The threat landscape is growing on technical, geopolitical and economic fronts. Against this backdrop, the European Commission is proposing a new cybersecurity package. The overarching goal: to further strengthen the EU's cybersecurity resilience and capabilities.

Greater security for European ICT supply chains

One key element concerns the security of information and communication technology (ICT).

In future, the aim is to:

• minimise risks posed by suppliers from third countries that raise cybersecurity concerns
• introduce mandatory phase-out periods for high-risk components
• take account of technical security aspects as well as dependencies and possible foreign influence

The plan is to create a harmonised, proportionate and risk-based framework for secure ICT supply chains.

For companies, this means that supplier relationships and the components they use will come under even closer regulatory scrutiny.

A fresh start for cybersecurity certification

Another focus is the reform of the European certification framework.

The revised European Cybersecurity Certification Framework (ECCF) is intended to:

• simplify and speed up procedures
• provide greater clarity and transparent governance
• establish ENISA certification schemes as a voluntary instrument
• enable companies to have their cyber defences certified as well

The idea behind this: certificates should not only create security but also give EU companies a competitive edge.

At the same time, cybersecurity certificates are to serve as proof of compliance with requirements under other EU legal acts in future. This creates legal certainty and avoids duplicate audits.

ENISA at the heart of European cyber defence

The European Union Agency for Cybersecurity (ENISA) is to be significantly strengthened.

Specific plans include:

• early warning mechanisms for cyber threats
• support in responding to ransomware attacks
• an EU-wide approach to improved vulnerability management
• a central reporting point for security incidents

The aim is better coordination of cross-border risks and more effective cooperation between authorities.

What changes under the NIS2 Directive?

The cybersecurity package contains specific proposals for amending the NIS2 Directive.

Greater clarity on scope

The Commission intends to:

• clarify definitions and increase legal certainty
• reduce the compliance burden for tens of thousands of companies
• introduce a new category of “small mid-caps” to lower compliance costs

This is based on practical experience from implementation to date as well as new threats and political developments.

Greater harmonisation of technical requirements

One point is particularly relevant in practice:

Where the Commission adopts implementing acts on technical and methodological requirements, Member States will no longer be allowed to impose additional national requirements on the companies concerned.

The aim is a genuine harmonisation effect and less of a regulatory patchwork within the EU.

Stricter rules on ransomware

In the area of incident reporting, mandatory minimum data points are to be defined for ransomware attacks, such as:

• whether the attack was detected
• which attack vector was used
• which countermeasures were taken

In the case of significant incidents, authorities may also request information on ransom demands and payments, including the amount, the recipient and any crypto-asset service providers involved.

Companies should therefore prepare for even more structured documentation and extended reporting obligations.

New “cyber posture” certificate

In addition, a new cyber posture certification is planned.

Member States may require essential and important entities to obtain such a certificate.

Important:

• If the certificate covers defined requirements, no additional supervisory measures are to be imposed.
• However, certification does not release entities from their responsibility for full NIS2 compliance.

This adds another building block to compliance management. It offers opportunities for greater transparency but also brings additional organisational effort.

Between support and criticism

The package has been largely well received, particularly the intended simplification, clearer structures and the avoidance of duplicate audits.

The strengthening of ENISA is also broadly welcomed.

At the same time, there are critical voices:

• The goal of “one incident, one report” can only be achieved if reporting obligations under different regulatory frameworks are better aligned.
• Mandatory phase-out periods for certain foreign components could jeopardise ongoing digitalisation projects.
• Closer coordination with national rules is being called for to ensure the rules are practical and workable.

Conclusion: more security, but also new challenges

The planned cybersecurity package pursues a clear goal: more resilience, more harmonisation and more trust in European digital infrastructure.

For companies, this means:

• stricter supply chain requirements
• new opportunities, but also obligations, in the area of certification
• further developed reporting and documentation obligations

Now is the right time to review existing structures.

With NIS2, ransomware reporting and possible certification obligations in mind in particular, companies should adapt their governance, risk and compliance processes at an early stage.

ISiCO helps you assess the regulatory changes strategically and implement them in practice.