PURPOSE: to extend the mandate of the European Network and Information Security Agency (ENISA) until September 2013.

LEGISLATIVE ACT: Regulation (EU) No 580/2011 of the European Parliament and of the Council amending Regulation (EC) No 460/2004 establishing the European Network and Information Security Agency as regards its duration.

BACKGROUND: t he European Network and Information Security Agency (hereinafter ENISA) was set up in March 2004 for an initial period of five years by Regulation (EC) No 460/2004 . Regulation (EC) No 1007/2008 extended ENISA’s mandate until March 2012.

From November 2008, a public debate was held on the general direction of European efforts towards increased network and information security, including a debate on the Agency. In line with the Commission’s Better Regulation strategy, and as a contribution to this debate, the Commission launched a public consultation on the objectives for a strengthened network and information security policy at Union level, which ran from November 2008 to January 2009. In December 2009, the debate resulted in a Council Resolution of 18 December 2009 on a collaborative European approach to Network and Information Security.

Taking account of the results of the public debate, it is envisaged to replace Regulation (EC) No 460/2004. It is necessary to extend the duration of the Agency.

CONTENT: with this Regulation, the Council and the European Parliament have decided to amend Regulation (EC) No 460/2004 establishing the European Network and Information Security Agency in order to extend its mandate until 13 September 2013 , the time for the European Parliament and the Council to adopt a new regulation to reform ENISA.

ENTRY INTO FORCE: 25.06.2011.

The European Parliament adopted by 597 votes to 22, with 11 abstentions, a legislative resolution on the proposal for a regulation of the European Parliament and of the Council amending Regulation (EC) No 460/2004 establishing the European Network and Information Security Agency as regards its duration.

The European Parliament adopted its position at first reading, under the ordinary legislative procedure, taking over the Commission proposal.

The Committee on Industry, Research and Energy adopted the report drafted by Giles CHICHESTER (ECR, UK) on the proposal for a regulation of the European Parliament and of the Council amending Regulation (EC) No 460/2004 establishing the European Network and Information Security Agency as regards its duration.

It recommended that the European Parliament adopt its position at first reading, under the ordinary legislative procedure, taking over the Commission proposal.

In a public session, the Council examined progress made on two draft regulations regarding the European Network and Information Security Agency (ENISA).

The Presidency has prepared a progress report which takes stock of the progress made so far on two Commission proposals (see also COD/2010/0275 ). Both proposals were examined by the Council bodies and all delegations welcomed them.

The progress report identified the following main issues to be discussed further in order to prepare a Council's common position for the negotiations with the European Parliament:

ENISA's tasks : although the current list of tasks is in principle welcomed by Delegations, a fine tuning of several tasks should be made. In particular, the role of ENISA in relation to cybercrime should be further discussed. Some Delegations propose the addition of concrete tasks as for example, tasks related to resilience, organisation of regular network security exercises, cooperation between Member States and European institutions and bodies. These proposals would need to be examined in more detail, to determine the Council position for further negotiations; duration of the mandate : the majority of Delegations agree in principle to a mandate limited in time. Some Delegations however support an indefinite mandate or a longer mandate than the one proposed by the Commission; the role and the structure of the Bodies of ENISA : the participation of the law enforcement and privacy protection agencies as fully fledged stakeholders to the Permanent Stakeholders' Group would need further discussion. This issue is linked to the role of ENISA in relation to cybercrime. Some Delegations propose to give the Management Board a role in the establishment of the work programme of the Agency. Others propose minor changes in the management structures in view of ensuring the effectiveness of Management Board; funding : in the current financial climate, some clarification on the contributions from Member States to the revenues of ENISA, as well as to its future budget would be welcomed by the majority of Delegations. The Commission already clarified in the meetings of the Working Party on Telecommunications and Information Society that Member States contribute on a voluntary basis.

PURPOSE: the extension of the mandate of the European Network and Information Security Agency (ENISA) until September 2013.

PROPOSED ACT: Regulation of the European Parliament and of the Council.

BACKGROUND: The European Network and Information Security Agency (hereinafter ENISA) was set up in March 2004 for an initial period of five years by Regulation (EC) No 460/2004 . Regulation (EC) No 1007/2008 extended ENISA’s mandate until March 2012.

The extension of ENISA’s mandate in 2008 also launched a debate on the general direction of European efforts towards network and information security (NIS), to which the Commission contributed by launching a public consultation (which ran from November 2008 to January 2009 and gathered nearly 600 contributions).

On 30 March 2009, the Commission adopted a Communication on Critical Information Infrastructure Protection (CIIP) focusing on the protection of Europe from cyber attacks and cyber disruptions by enhancing preparedness, security and resilience, with an Action Plan calling on ENISA to play a role, mainly in support to Member States. The Action Plan was broadly endorsed in the discussion at the Ministerial Conference on CIIP held in Tallinn, Estonia, on 27 and 28 April 2009. The European Union Presidency’s Conference Conclusions stress the importance of the need to rethink and reformulate the Agency’s mandate .

After discussion at the Telecom Council of 11 June 2009, Member States expressed support for extending the ENISA’s mandate and increasing its resources in the light of the importance of NIS and the evolving challenges in the area

It is therefore now proposed to extend ENISA’s mandate until 2013 to allow sufficient time for the adoption of a new Regulation that would thoroughly revise the provisions governing the Agency (a proposal for a recast of the Regulation establishing the Agency is proposed in parallel).

IMPACT ASSESSMENT: no impact assessment was undertaken.

LEGAL BASE: Article 114 of the Treaty on the Functioning of the European Union (TFEU).

CONTENT: this proposal seeks to amend Regulation (EC) No 460/2004 establishing the European Network and Information Security Agency with a view to extending its mandate until 13 September 2013 , the time that will allow Parliament and Council to adopt a new Regulation revising the provisions governing the Agency and establishing the Agency for a 5-year duration. This proposal provides for the extension of the Agency’s current mandate by 18 months.

FINANCIAL IMPLICATION: in its financial impact statement, the European Commission estimates the necessary funding for the extension of ENISA’s current mandate at EUR 12.698 million in commitments and payments for the period running from 14 March 2012 to 13 September 2013. These sums would come from heading 1a of the financial perspectives (EUR 6.673 million in 2012 and EUR 6.025 million in 2013).