Cybersecurity Policy Report, Cyber Crisis Response ‘Blueprint’ Proposed by European Commission, (Feb 24, 2025)
A blueprint for detecting cyber threats and responding to cyber “crises” coherently across the European Union was proposed today by the European Commission (EC).
Responding to a request from the Council of the EU, the EC offered a “Blueprint on cybersecurity crisis management” that, if adopted by EU lawmakers, would define a cybersecurity crisis and detail the roles of various EU entities in responding to it.
The EU last adopted such a blueprint in 2017 prior to the current era of “increasing geopolitical tensions, conflicts and strategic rivalry” that have led to increased “impact, volume and sophistication of malicious cyber activities,” the blueprint says.
“A large-scale cybersecurity incident can cause a level of disruption that exceeds a Member State’s capacity to respond to it or has a significant impact on more than one Member State,” it says.
“Such an incident, depending on its cause and impact, could escalate and turn into a fully-fledged crisis, affecting the proper functioning of the internal market or posing serious public security and safety risks for entities or citizens in several Member States or the Union as a whole,” it adds.
“While Member States have a primary responsibility in the management of national cyber crises, the potential cross-border and cross-sectoral nature of cybersecurity incidents requires Member States and the relevant Union entities to cooperate at a technical, operational and political level to coordinate effectively across the Union,” according to the blueprint.
The blueprint recommends that the EU boost its collaboration with the North Atlantic Treaty Organization to detect, deter, and respond to cyber crises caused by adversarial foreign nations.
It would require that member states, within 12 months of the blueprint’s adoption, develop a cybersecurity “taxonomy with respect to cyber crisis management and provide a guide on the secure handling and exchange of information related to cybersecurity incidents and crises.”
It would also, among other things, encourage EU-level organizations, member states, and the private sector to coordinate on cyber preparedness and engage in exercises to test their cyber incident response plans.
“This includes preparedness and shared situational awareness to anticipate cyber incidents, and the necessary detection capabilities to identify them, including the response and recovery tools needed to mitigate, deter and contain those incidents,” the EC said in a news release.
“In an increasingly interdependent Union economy, disruptions from cybersecurity incidents can have far-reaching impacts across various sectors,” said Henna Virkkunen, the EC’s executive vice president–tech sovereignty, security, and democracy.
“The proposed cybersecurity blueprint reflects our commitment to ensuring a coordinated approach, leveraging existing structures to protect the internal market and uphold vital societal functions,” Ms. Virkkunen added. “This Recommendation is a crucial step forward in reinforcing our collective cyber resilience.”
News: InternationalLegislation DataSecurity