Cybersecurity Policy Report, EU Council Approves Cyber Solidarity Act, Cyber Act Amendments, (Dec 2, 2024)

By Tony Foley

The Council of the European Union has approved two new laws designed to strengthen the EU’s solidarity and capacities to detect and respond to cybersecurity threats and incidents.

The laws are part of a cybersecurity legislative package and include the Cyber Solidarity Act, as well as a targeted amendment to the Cybersecurity Act (CSA), the council said today in a news release. Earlier this year, the Council had reached a provisional agreement with negotiators from the European Parliament on the legislative proposals (CPR, March 6).

The Cyber Solidarity Act creates a “cybersecurity alert system,” a pan-European infrastructure composed of national and cross-border cyber hubs across the EU that are responsible for sharing information and tasked with detecting and acting on cyber threats.

The cyber hubs will use state-of-the-art technology, including artificial intelligence and advanced data analytics, to detect and share timely warnings on cyber threats and incidents across borders.

In addition, the act provides for the creation of a cybersecurity emergency mechanism to increase preparedness and enhance incident response capabilities, including a cybersecurity reserve consisting of incident response services from the private sector ready to intervene at the request of a member state or EU policy-makers.

Finally, the new law establishes an incident review mechanism to assess the effectiveness of action under the cyber emergency mechanism and the use of the cybersecurity reserve.

The amendments to the CSA focus primarily on enabling the future adoption of European certification schemes for so-called “managed security services,” which the council noted were increasingly important in the prevention, detection, response, and recovery from cybersecurity incidents. These services include incident handling, penetration testing, security audits, and consulting related to technical support, among other services.

The council said the certification schemes contemplated in the amendment would increase the quality and comparability of entities offering managed security services, foster the emergence of trusted cybersecurity service providers, and avoid fragmentation of the internal market, given that some member states already have started to adopt national certification schemes for managed security services.

Following their signing by the presidents of the council and the EU Parliament, both legislative acts will be published in the EU’s Official Journal and will enter into force 20 days after publication.

News: InternationalLegislation DataSecurity