EU adopts its Cybersecurity Act

The Official Journal of the European Union published on 7 June 2019 Regulation (EU) 2019/881, known as the EU Cybersecurity Act, which will enter into force on 27 June. The rule has two main parts: it gives the European Union Agency for Cybersecurity, ENISA, a permanent mandate with more functions and resources, and it creates a European framework for the cybersecurity certification of information technology products, services and processes.

Until now, each country had its own certification schemes, with different criteria and no mutual recognition, which complicated selling technology products in several markets. The regulation seeks to ensure that a certificate issued in one member state under a European scheme is valid throughout the Union, so that manufacturers and customers know what level of security they can expect from a product.

What the certification framework is

The Commission can ask ENISA to prepare certification schemes for certain categories of products or services, which are then adopted through European acts. Each scheme defines the security requirements, the evaluation methods and the assurance level, which can be basic, substantial or high, according to the risk associated with the product’s use.

Certification is, as a general rule, voluntary, unless a European or national rule says otherwise for certain products. A manufacturer can certify a product to demonstrate its security to customers, and the accompanying information must be accessible: what it covers, for how long and how security is maintained through updates.

What it means for companies

For companies that make or sell hardware, software or connected services, the regulation opens the possibility of a security label recognised throughout the Union. In time, it is foreseeable that large customers, public buyers and insurers will start to value or require such certifications, as already happens with other information security standards.

For companies that use technology, the consequence is indirect but useful: as schemes appear, it will be easier to compare products and demand guarantees from suppliers. All this adds to the obligations that already exist for operators of essential services and digital service providers, which in Spain are set out in Royal Decree-Law 12/2018 on the security of networks and information systems.

What to review

A reasonable check begins with knowing which systems and data are critical, which security measures are applied and who is responsible for them. Next, it is worth reviewing contracts with technology suppliers to see what commitments on security, incident notification and updates they take on, and whether certifications exist that can back those promises.

No approved European schemes exist yet, so there is nothing to certify by this route, but it is worth preparing the ground: documenting policies, keeping inventories and training staff. Most incidents begin with simple mistakes, and certification, when it arrives, will reward those who have already done their homework. A low-cost measure with a big effect is to practise incident response: knowing whom to call, how to isolate an affected machine and how to notify customers and authorities where required, because the first minutes often decide how much damage an attack ends up causing. For small and mid-sized companies, it may also be reasonable to rely on a trusted managed service provider, provided the contract makes clear the responsibilities, the incident response times and the company’s access to its own data.

Cybersecurity is shown through verifiable measures, and Europe is starting to build a common language for doing so.

This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.