2017/0225(COD) | [ParlTrack]

Jaromír ŠTĚTINA, Axel VOSS

Proposal for a regulation
Article 44 – paragraph 1

Amendment 101 #

Proposal for a regulation
Article 44 – paragraph 1

Amendment 102 #

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult all relevant stakeholders and closely cooperate with the Group~~. The~~ and the Permanent Stakeholders’ Group. The Group and the Permanent Stakeholders’ Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary. Where relevant, ENISA may in addition set up a certification stakeholder working group, composed of members of the Permanent Stakeholders’ Group and any other relevant stakeholders, to provide expert advice on areas covered by a specific candidate scheme.

Amendment 103 #

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult all relevant stakeholders and closely cooperate with the Group as well as with the bodies established under Regulation (EC) 45/2001, Regulation (EU) 2016/679, Directive (EU) 2016/680 and, if appropriate, Regulation (EC) No 1211/2009 . The Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary.

Amendment 104 #

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult all relevant stakeholders, including industry through an official consultation process, and closely cooperate with the Group. The Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary.

Amendment 105 #

Monika HOHLMEIER

Proposal for a regulation
Article 44 – paragraph 3

3. ENISA shall transmit the candidate European cybersecurity certification scheme prepared in accordance with paragraph 2 of this Article after approval by the Group to the Commission.

Amendment 106 #

Proposal for a regulation
Article 44 – paragraph 4

4. The Commission, based on the candidate scheme proposed by ENISA, may adopt implementing acts, in accordance with Article 55(1), providing for European cybersecurity certification schemes for ICT products and services meeting the requirements of Articles 45, 46 and 47 of this Regulation. Where appropriate, the Commission shall consult the European Data Protection Board before adopting such decision in order to ensure consistency with certifications under Regulation (EU) 2016/679.

Amendment 107 #

Proposal for a regulation
Article 45 – paragraph 1 – introductory part

A European cybersecurity certification scheme shall be so designed to take into account, as applicable in proportion to risks to their common operational environment, and where users take appropriate measures, the following security objectives:

Amendment 108 #

Proposal for a regulation
Article 46 – paragraph 1

Amendment 109 #

2. The assurance levels basic, substantial and high shall ~~meet the following criteria respectively:~~refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a corresponding degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of cybersecurity incidents; the assurance level shall be defined on a case by case basis.

Amendment 110 #

Proposal for a regulation
Article 46 – paragraph 2 – point a

Amendment 111 #

Proposal for a regulation
Article 46 – paragraph 2 – point a

Amendment 112 #

Proposal for a regulation
Article 46 – paragraph 2 – point b

Amendment 113 #

Proposal for a regulation
Article 46 – paragraph 2 – point b

Amendment 114 #

Proposal for a regulation
Article 46 – paragraph 2 – point c

Amendment 115 #

Proposal for a regulation
Article 46 – paragraph 2 – point c

Amendment 116 #

Proposal for a regulation
Article 47 – paragraph 1 – point a a (new)

(aa) the conformity assessment and auditing bodies

Amendment 117 #

Proposal for a regulation
Article 47 – paragraph 1 – point l

(l) identification of national cybersecurity certification schemes, pursuant to Article 49, covering the same type or categories of ICT products and services;

Amendment 118 #

Proposal for a regulation
Article 48 – paragraph 2

2. The certification shall be voluntary~~, unless otherwise specified in Union law~~.

Amendment 119 #

Michał BONI, Carlos COELHO, Jaromír ŠTĚTINA, Frank ENGEL

Proposal for a regulation
Article 48 – paragraph 6

6. Certificates shall be issued for a maximum period of t~~hree years~~ime as defined by the certification scheme and may be renewed, under the same conditions, provided that the relevant requirements continue to be met.

Amendment 120 #

Monika HOHLMEIER

Proposal for a regulation
Article 48 – paragraph 6

6. Certificates shall be issued for ~~a maximum period of three years~~the period defined by the particular certification scheme and may be renewed, under the same conditions, provided that the relevant requirements continue to be met.

Amendment 121 #

Proposal for a regulation
Article 48 – paragraph 6

6. Certificates shall be issued for a maximum period ~~of three years and may be renewed, under the same conditions,~~determined on a case by case basis for each scheme and may be renewed provided that the relevant requirements continue to be met.

Amendment 122 #

Proposal for a regulation
Article 48 a (new)

Amendment 123 #

Proposal for a regulation
Article 48 a (new)

Article 48 a Minimum requirements for IT security 1. The Agency shall, by ... [two years after the date of entry into force of this Regulation], propose to the Commission clear and mandatory minimum requirements of security for all IT devices sold in or exported from the Union such as: (a) the vendor providing a legally binding written certification that the device does not contain any hardware, software or firmware component with any known security vulnerabilities; (b) the device relies on software or firmware components capable of accepting properly authenticated and trusted updates from the vendor; (c) the device does not include any fixed or hard-coded credential used for remote administration, the delivery of updates, or communication; (d) an obligation of the vendor of the internet-enabled device, software, or firmware component to notify the competent authority of any known security vulnerabilities; (e) an obligation of the vendor of the internet-enabled device, software, or firmware component to provide a repair or replacement in respect to any new security vulnerability discovered; (f) an obligation of the vendor of the internet-enabled device, software, or firmware component to provide information on how the device receives updates, the anticipated timeline for ending security support and a formal notification when such security support has ended. 2. The Agency shall review and, where necessary, amend the requirements referred to in paragraph 1 every two years, and submit any amendments as proposals to the Commission. 3. The Commission shall, by way of implementing acts, decide that the proposed or amended requirements referred to in paragraphs 1 and 2 have general validity within the Union. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 55(2). 4. The Commission shall ensure appropriate publicity for the requirements which have been decided as having general validity in accordance with paragraph 3. 5. The Agency shall collate all proposed requirements and their amendments in a register and shall make them publicly available by way of appropriate means.

Amendment 124 #

Proposal for a regulation
Article 48 a (new)

Article 48 a Baseline IT security requirements 1. The Agency shall, by ... [two years after the date of entry into force of this Regulation], propose to the Commission clear baseline IT security requirements for all IT devices sold in or exported from the Union, which industry should be encouraged to generally adhere to where appropriate, such as: (a) the vendor providing a written certification that the device does not contain any hardware, software or firmware component with any known security vulnerabilities; (b) the device relies on software or firmware components capable of accepting properly authenticated and trusted updates from the vendor; (c) the device does not include any unencrypted password or access code. However, the use of secure elements used for remote administration, the delivery of updates, or communication, is strongly encouraged; (d) an obligation of the vendor of the internet-connected device, software, or firmware component to notify the competent authority of any known security vulnerabilities; (e) an obligation of the vendor of the internet-connected device, software, or firmware component to provide a repair or replacement in respect to any new security vulnerability discovered; (f) an obligation of the vendor of the internet-connected device, software, or firmware component to provide information on how the device receives updates, the anticipated timeline for ending security support and a formal notification when such security support has ended. 2. The Agency shall review and, where necessary, amend the requirements referred to in paragraph 1 every two years, and submit any amendments as proposals to the Commission.

Amendment 125 #

Proposal for a regulation
Article 50 – paragraph 6 – point d

(d) cooperate with other national certification supervisory authorities or other public authorities, such as national Data Protection Supervisory Authorities, including by sharing information on possible non- compliance of ICT products and services with the requirements of this Regulation or specific European cybersecurity certification schemes;

Amendment 20 #

Proposal for a regulation
Title

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on ENISA, the “E~~U Cybers~~uropean Network and Information Security Agency”, and repealing Regulation (EU) 526/2013, and on Information and Communication Technology ~~cyber~~security certification (‘‘Cybersecurity Act’’) (Text with EEA relevance)

Amendment 21 #

Proposal for a regulation
Recital 2

(2) The use of network and information systems by citizens, businesses and governments across the Union is now pervasive. Digitisation and connectivity are becoming core features in an ever growing number of products and services and with the advent of the Internet of Things (IoT) millions, if not billions, of connected digital devices are expected to be deployed across the EU during the next decade. While an increasing number of devices are connected to the Internet, security and resilience are not sufficiently built in by design, leading to insufficient cybersecurity. In this context, the limited use of certification leads to insufficient information for organisational and individual users about the cybersecurity features of ICT products and services, undermining trust in digital solutions. This ambition is at the heart of the European Commission’s reform agenda to achieve a digital single market as ICT networks provide the backbone for digital products and services which have the potential to support all aspects of our lives and drive Europe’s economic growth. To ensure that the objectives of digital single market are fully achieved the essential technology building blocks on which important areas such as eHealth, IoT, Artificial Intelligence, Quantum technology as well as intelligent transport system and advanced manufacturing rely must be in place.

Amendment 22 #

Morten PETERSEN, Filiz HYUSMENOVA, Petr JEŽEK, Nathalie GRIESBECK, Gérard DEPREZ, Louis MICHEL

Proposal for a regulation
Recital 2

Amendment 23 #

Proposal for a regulation
Recital 2

Amendment 24 #

Proposal for a regulation
Recital 3

(3) Increased digitisation and connectivity lead to increased cybersecurity risks, thus making society at large more vulnerable to cyber threats and exacerbating dangers faced by individuals, including vulnerable persons such as children. Moreover, the increasingly frequent conduct of malicious cyber operations by third-country actors, both non-state actors and governments, threatens to disrupt democratic processes and to destabilize democratic societies across Europe. In order to mitigate thisese risks to society, all necessary actions need to be taken to improve cybersecurity in the EU to better protect network and information systems, telecommunication networks, digital products, services and devices used by citizens, governments and business – from SMEs to operators of critical infrastructures – from cyber threats.

Amendment 25 #

Proposal for a regulation
Recital 3

Amendment 26 #

Proposal for a regulation
Recital 3

(3) Increased digitisation and connectivity lead to increased cybersecurity risks, thus making society at large more vulnerable to c~~yber~~omputer oriented threats and exacerbating dangers faced by individuals, including vulnerable persons such as children. In order to mitigate this risk to society, all necessary actions need to be taken to improve cybersecurity in the EU to better protect network and information systems, telecommunication networks, digital products, services and devices used by citizens, governments and business – from SMEs to operators of critical infrastructures – from c~~yber threats.~~omputer oriented threats. (This amendment replaces the misleading term “cyber threat” by the more appropriate term “computer oriented threat”. It should apply throughout the text.)

Amendment 27 #

Proposal for a regulation
Recital 4

(4) C~~yber-~~omputer oriented attacks are on the increase and a connected economy and society that is more vulnerable to cyber threats and attacks requires stronger defences. However, while cyber-attacks are often cross-border, policy responses by cybersecurity authorities and law enforcement competences are predominantly national. Large-scale ~~cyber~~IT security incidents could disrupt the provision of essential services across the EU. This requires effective EU level response and crisis management, building upon dedicated policies and wider instruments for European solidarity and mutual assistance. Moreover, a regular assessment of the state of cybersecurity and resilience in the Union, based on reliable Union data, as well as systematic forecast of future developments, challenges and threats, both at Union and global level, is therefore important for policy makers, industry and users. (This amendment replaces the term “cyber attack” by the more appropriate term “computer oriented attack”. It should apply throughout the text.)

Amendment 28 #

Proposal for a regulation
Recital 4

(4) Cyber-attacks are on the increase and a connected economy and society that is more vulnerable to cyber threats and attacks requires stronger and more secure defences. However, while cyber-attacks are often cross-border, policy responses by cybersecurity authorities and law enforcement competences are predominantly national. Large-scale cyber incidents could disrupt the provision of essential services across the EU. This requires effective EU level response and crisis management, building upon dedicated policies and wider instruments for European solidarity and mutual assistance. Moreover, a regular assessment of the state of cybersecurity and resilience in the Union, based on reliable Union data, as well as systematic forecast of future developments, challenges and threats, both at Union and global level, is therefore important for policy makers, industry and users.

Amendment 29 #

Jaromír ŠTĚTINA, Axel VOSS

Proposal for a regulation
Recital 5

(5) In light of the increased cybersecurity challenges faced by the Union, there is a need for a comprehensive set of measures that would build on previous Union action and foster mutually reinforcing objectives. These include the need to further increase capabilities and preparedness of Member States and businesses, as well as to improve cooperation and coordination across Member States and EU institutions, agencies and bodies. Furthermore, given the borderless nature of cyber threats, there is a need to increase capabilities at Union level that could complement the action of Member States, in particular in the case of large scale cross-border cyber incidents and crises. Additional efforts are also needed to deliver a co-ordinated EU response and increase awareness of citizens and businesses on cybersecurity issues. Moreover, the trust in the digital single market should be further improved by offering transparent information on the level of security of ICT products and services. This can be facilitated by EU- wide certification providing common cybersecurity requirements and evaluation criteria across national markets and sectors. Alongside EU-wide certification, there is a range of voluntary measures widely accepted in the market place, depending on the product, service, use or standard; these measures as well as the industry bottom up approach, including the use of security-by-design, leveraging and contributing to international standards, should be encouraged.

Amendment 30 #

Proposal for a regulation
Recital 5

(5) In light of the increased cybersecurity challenges faced by the Union, there is a need for a comprehensive set of measures that would build on previous Union action and foster mutually reinforcing objectives. These include the need to further increase capabilities and preparedness of Member States and businesses, as well as to improve cooperation and coordination across Member States and EU institutions, agencies and bodies. Furthermore, given the borderless nature of cyber threats, there is a need to increase capabilities at Union level that could complement the action of Member States, in particular in the case of large scale cross-border cyber incidents and crises. Additional efforts are also needed to increase awareness of citizens and businesses on cybersecurity issues. Moreover, the trust in the digital single market should be further improved by offering transparent information on the level of privacy and security of ICT products and services. ~~This can be facilitated by~~ EU- wide certification providing common cybersecurity requirements and evaluation criteria across national markets and sectors can contribute to this objective. However, voluntary measures implemented by the private sector, inter alia by IoT operators and service providers, should also be encouraged.

Amendment 31 #

Proposal for a regulation
Recital 5 a (new)

(5a) Cybersecurity is an aspect of security as a whole, and competence and expertise in security assessment rests with the Member States. Managing the area of freedom, security and justice is a competence that is shared between the Union and the Member States, but, given the impact of cybersecurity on national security, it is in many respects a matter of national sovereignty. For this reason, as regards the single European certification framework, the role of Member States and of national certification authorities should not be reduced to an advisory one. Member States should have a significant role in the new cybersecurity certification architecture, also taking account of their expertise.

Amendment 32 #

Proposal for a regulation
Recital 7

(7) The Union has already taken important steps to ensure cybersecurity and increase trust in digital technologies. In 2013, an EU Cybersecurity Strategy was adopted to guide the Union’s policy response to cybersecurity threats and risks. In its effort to better protect Europeans online, in 2016 the Union adopted the first legislative act in the area of cybersecurity, the Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union (the “NIS Directive”). The NIS Directive fulfils the digital single market strategy and together with other instruments, such as Directive establishing the European Electronic Communications Code, Regulation (EU) 2016/679 and Directive 2002/58/EC, puts in place requirements concerning national capabilities in the area of cybersecurity, established the first mechanisms to enhance strategic and operational cooperation between Member States, and introduced obligations concerning security measures and incident notifications across sectors which are vital for economy and society such as energy, transport, water, banking, financial market infrastructures, healthcare, digital infrastructure as well as key digital service providers (search engines, cloud computing services and online marketplaces). A key role was attributed to ENISA in supporting implementation of this Directive. In addition, effective fight against cybercrime is an important priority in the European Agenda on Security, contributing to the overall aim of achieving a high level of cybersecurity.

Amendment 33 #

Proposal for a regulation
Recital 8

(8) It is recognised that, since the adoption of the 2013 EU Cybersecurity Strategy and the last revision of the Agency’s mandate, the overall policy context has changed significantly, also in relation to a more uncertain and less secure global environment. In this context and within the framework of the new Union cybersecurity policy, it is necessary to review the mandate of ENISA to define its role in the changed cybersecurity ecosystem and ensure it ~~contributes~~undertakes a leading role which will effectively toimprove the Union’s response to cybersecurity challenges emanating from this radically transformed threat landscape, for which, as recognised by the evaluation of the Agency, the current mandate is not sufficient.

Amendment 34 #

Proposal for a regulation
Recital 10

(10) Within the framework of Decision 2004/97/EC, Euratom, adopted at the meeting of the European Council on 13 December 2003, the representatives of the Member States decided that ENISA would have its seat in a town in Greece to be determined by the Greek Government. The Agency’s host Member State should ensure the best possible conditions for the smooth and efficient operation of the Agency. It is imperative for the proper and efficient performance of its tasks, for staff recruitment and retention and to enhance the efficiency of networking activities that the Agency be based in an appropriate location, among other things providing appropriate transport connections and facilities for spouses and children accompanying members of staff of the Agency. The necessary arrangements should be laid down in that the agency concludes an agreement between the Agency and the host Member State after obtaining the approval of the Management Board of the Agency. This agreement should include provisions that ensure proper and efficient performance of its tasks, upon the due process and full discussion by the Man agreement ~~between~~Board of the Aagency and othe ~~host Member State concluded after obtaining the approval of the Management Board of the Agency~~r relevant stakeholder within the agency a request for auxiliary support, duties to be upheld by the host state may be ratified into the agreement.

Amendment 35 #

Proposal for a regulation
Recital 11

(11) Given the increasing cybersecurity challenges the Union is facing, the financial and human resources allocated to the Agency should be increased to reflect its enhanced role and tasks, and its critical position in the ecosystem of organisations defending the European digital ecosystem. Due regards should be given to further enhancement of capacity of the Agency.

Amendment 36 #

Proposal for a regulation
Recital 11 a (new)

(11a) The challenges in the field of IT security are, in the digital age, often closely interlinked with challenges in the field of data protection, the protection of private life as well as the protection of electronic communications. In order for the agency to appropriately be able to address these challenges, close cooperation and frequent consultation with the bodies established under Regulation (EC) 45/2001, Regulation (EU) 2016/679, Directive (EU) 2016/680 and Regulation (EC) No 1211/2009 should form an integral part of the agency’s activities.

Amendment 37 #

Proposal for a regulation
Recital 12

(12) The Agency should develop and maintain a high level of expertise and operate as a point of reference establishing trust and confidence in the single market by virtue of its independence, the quality of the advice it delivers and the information it disseminates, the transparency of its procedures and methods of operation, and its diligence in carrying out its tasks. The Agency should proactively contribute to national and Union efforts while carrying out its tasks in full cooperation with the Union institutions, bodies, offices and agencies and the Member States. In addition, the Agency should build on input from and cooperation with the private sector as well as other relevant stakeholders. A ~~set of tasks should establish how the Agency is to accomplish its objectives while allowing flexibility in its operations~~clear agenda and a set of tasks an objectives which the Agency is to accomplish should be clearly defined while giving due consideration to the necessary flexibility of its operations. Where possible, highest degree of transparency and dissemination of information should be maintained.

Amendment 38 #

Proposal for a regulation
Recital 14

(14) The underlying task of the Agency is to promote the consistent implementation of the relevant legal framework, in particular the effective implementation of the NIS Directive, Directive establishing the European Electronic Communications Code, Regulation (EU) 2016/679 and Directive 2002/58/EC, which is essential in order to increase cyber resilience. In view of the fast evolving cybersecurity threat landscape, it is clear that Member States must be supported by more comprehensive, cross-policy approach to building cyber resilience.

Amendment 39 #

Proposal for a regulation
Recital 20

(20) To perform its operational tasks, the Agency should make use of the available expertise of CERT-EU through a structured cooperation, in close physical proximity when Large-Scale Cybersecurity Incidents and Crises occur in Europe. The structured cooperation will facilitate the necessary synergies and build- up of ENISA’s expertise. Where appropriate, dedicated arrangements between the two organisations should be established to define the practical implementation of such cooperation.

Amendment 40 #

Proposal for a regulation
Recital 21 a (new)

(21a) The Commission should propose the introduction of mandatory cooperation between Member States concerning the protection of critical information infrastructure.

Amendment 41 #

Proposal for a regulation
Recital 26

(26) To understand better the challenges in the field of cybersecurity, and with a view to providing strategic long term advice to Member States and Union institutions, the Agency needs to analyse current and emerging risks, incidents and vulnerabilities. For that purpose, the Agency should, in cooperation with Member States and, as appropriate, with statistical bodies and others, collect relevant information and perform analyses of emerging technologies and provide topic-specific assessments on expected societal, legal, economic and regulatory impacts of technological innovations on network and information security, in particular cybersecurity. The Agency should furthermore support Member States and Union institutions, agencies and bodies in identifying emerging trends and preventing problems related to cybersecurity, by performing analyses of threats ~~and~~, incidents and vulnerabilities.

Amendment 42 #

Proposal for a regulation
Recital 28

(28) The Agency should contribute towards raising the awareness of the public about risks related to cybersecurity and provide guidance on good practices for individual users aimed at citizens and organisations. To improve the overall level of preparedness and resilience, the Agency should also contribute to promote best practices and solutions at the level of individuals and organisations by collecting and analysing ~~publicly~~ available information regarding significant incidents, and by compiling reports with a view to providing guidance to businesses ~~and~~, citizens and ~~improving the overall level of preparedness and resilience~~relevant authorities at European and national level. The Agency should furthermore organise, in cooperation with the Member States and the Union institutions, bodies, offices and agencies regular outreach and public education campaigns directed to end-users~~, aiming at~~. These campaigns should promot~~ing~~e safer individual online behaviour and rais~~ing~~e awareness of potential threats in cyberspace, including cybercrimes such as phishing attacks, botnets, financial and banking fraud, ~~as well as promoting basic authentication and data protection advice~~forgery and illegal content, as well as advocate data protection and basic authentication to prevent data and identity theft. The Agency should play a central role in accelerating end-user awareness on security of devices.

Amendment 43 #

Morten PETERSEN, Pavel TELIČKA, Filiz HYUSMENOVA, Petr JEŽEK, Nathalie GRIESBECK, Gérard DEPREZ, Louis MICHEL

Proposal for a regulation
Recital 28

Amendment 44 #

Proposal for a regulation
Recital 28 a (new)

(28a) The Agency should raise the awareness of the public about risks of data fraud incidents and thefts that may seriously affect the fundamental rights of individuals, pose threat to the rule of law and endanger the stability of democratic societies including democratic processes in the Member States.

Amendment 45 #

Proposal for a regulation
Recital 30

(30) To ensure that it fully achieves its objectives, the Agency should liaise with relevant institutions, agencies and bodies, including CERT-EU, European Cybercrime Centre (EC3) at Europol, European Defence Agency (EDA), European Agency for the operational management of large-scale IT systems (eu- LISA), European Aviation Safety Agency (EASA), European Global Navigation Satellite Systems Agency (GSA) and any other EU Agency that is involved in cybersecurity. It should also liaise with authorities dealing with data protection in order to exchange know-how and best practices and provide advice on cybersecurity aspects that might have an impact on their work. Representatives of national and Union law enforcement and data protection authorities should be eligible to be represented in the Agency’s Permanent Stakeholders Group. In liaising with law enforcement bodies regarding network and information security aspects that might have an impact on their work, the Agency should respect existing channels of information and established networks.

Amendment 46 #

Morten PETERSEN, Pavel TELIČKA, Filiz HYUSMENOVA, Petr JEŽEK, Nathalie GRIESBECK, Gérard DEPREZ, Louis MICHEL

Proposal for a regulation
Recital 30

(30) To ensure that it fully achieves its objectives, the Agency should liaise with relevant institutions, agencies and bodies, including CERT-EU, European Cybercrime Centre (EC3) at Europol, European Defence Agency (EDA), European Agency for the operational management of large-scale IT systems (eu- LISA), European Aviation Safety Agency (EASA) and any other EU Agency that is involved in cybersecurity. It should also liaise with European and national authorities dealing with data protection in order to exchange know-how and best practices and provide advice on cybersecurity aspects that might have an impact on their work. Representatives of national and Union law enforcement and data protection authorities should be eligible to be represented in the Agency’s Permanent Stakeholders Group. In liaising with law enforcement bodies regarding network and information security aspects that might have an impact on their work, the Agency should respect existing channels of information and established networks.

Amendment 47 #

Proposal for a regulation
Recital 35

(35) The Agency should encourage Member States and service providers to raise their general security standards so that all internet users can take the necessary steps to ensure their own personal cybersecurity. In particular, service providers and product manufacturers should withdraw or recycle products and services that do not meet cybersecurity standards. In cooperation with competent authorities, ENISA may disseminate information regarding the level of cybersecurity of the products and services offered in the internal market, and issue warnings targeting providers and manufacturers and requiring them to improve the security, including cybersecurity, of their products and services. The agency should work together with stakeholder towards developing a EU-wide approach to responsible vulnerabilities disclosure and should promote best practice in this area.

Amendment 48 #

Proposal for a regulation
Recital 35

(35) The Agency should encourage Member States ~~and~~, hardware and software producers as well as service providers to raise their general security standards so that all internet users can take the necessary steps to ensure their own personal cybersecurity. In particular, service providers and product manufacturers should ~~withdraw or recycl~~ensure that the products and services that ~~do no~~they place on the market meet cybersecurity standards. In cooperation with competent authorities, ENISA may disseminate information regarding the level of cybersecurity of the products and services offered in the internal market, and issue warnings targeting providers and manufacturers and requiring them to improve the security, including cybersecurity, of their products and services.

Amendment 49 #

Proposal for a regulation
Recital 37

(37) Cybersecurity ~~problem~~threats are a global ~~issues. There is a need for c~~challenge. Closer international cooperation ~~to improve~~is needed to mitigate these threats, in particular as regards information sharing and the development of common security standards, including the definition of common norms of behaviour~~, and information sharing, promoting swifter international collaboration in response to, as well as a common global approach to, network and information security issues~~. Furthermore, international collaboration in response to network and information security issues should be accelerated and a global approach on these issues promoted. To that end, the Agency should support further Union involvement and cooperation with third countries and international organisations by providing, where appropriate, the necessary expertise and analysis to the relevant Union institutions, bodies, offices and agencies..

Amendment 50 #

Proposal for a regulation
Recital 44

(44) The Agency should have a Permanent Stakeholders’ Group as an advisory body, to ensure regular dialogue with the private sector, consumers’ organisations and other relevant stakeholders. The Permanent Stakeholders’ Group, set up by the Management Board on a proposal by the Executive Director, should focus on issues relevant to stakeholders and bring them to the attention of the Agency. The composition of the Permanent Stakeholders Group and the tasks assigned to this Group, to be consulted in particular regarding the draft Work Programme, should ensure sufficient representation of stakeholders in the work of the Agency. Given the importance of certification requirements to ensure trust in IoT, the Commission will specifically consider implementing measures to ensure the pan-EU security standards harmonisation for IoT devices.

Amendment 51 #

Proposal for a regulation
Recital 50

(50) Currently, the cybersecurity certification of ICT products and services is used only to a limited extent. When it exists, it mostly occurs at Member State level or in the framework of industry driven schemes. In this context, a certificate issued by one national cybersecurity authority is not in principle recognised by other Member States. Companies thus may have to certify their products and services in several Member States where they operate, for example with a view to participating in national procurement procedures. Moreover, while new schemes are emerging, there seems to be no coherent and holistic approach with regard to horizontal cybersecurity issues, for instance in the field of the Internet of Things. Existing schemes present significant shortcomings and differences in terms of product coverage, levels of assurance, substantive criteria and actual utilisation. A case by case approach is required to ensure that services and products are subject to appropriate certification schemes. Additionally, a risk- based approach is needed for effective identification and mitigation of risks whilst acknowledging that a one size fits all scheme is not possible.

Amendment 52 #

Proposal for a regulation
Recital 50

(50) Currently, the cybersecurity certification of ICT products and services is used only to a limited extent. When it exists, it mostly occurs at Member State level or in the framework of industry driven schemes. In this context, a certificate issued by one national cybersecurity authority is not in principle recognised by other Member States. Companies thus may have to certify their products and services in several Member States where they operate, for example with a view to participating in national procurement procedures, and these procedures may entail additional costs for companies. Moreover, while new schemes are emerging, there seems to be no coherent and holistic approach with regard to horizontal cybersecurity issues, for instance in the field of the Internet of Things. Existing schemes present significant shortcomings and differences in terms of product coverage, levels of assurance, substantive criteria and actual utilisation.

Amendment 53 #

Morten PETERSEN, Pavel TELIČKA, Filiz HYUSMENOVA, Petr JEŽEK, Nathalie GRIESBECK, Gérard DEPREZ, Louis MICHEL

Proposal for a regulation
Recital 52

(52) In view of the above, it is necessary to establish a harmonised European cybersecurity certification framework laying down the main horizontal requirements for European cybersecurity certification schemes to be developed and allowing certificates for ICT products and services to be recognised and used in all Member States. The European framework should have a twofold purpose: on the one hand, it should help increase trust in ICT products and services that have been certified according to such schemes. On the other hand, it should avoid the multiplication of conflicting or overlapping national cybersecurity certifications and thus reduce costs for undertakings operating in the digital single market. The schemes should be non-discriminatory and based on international and / or Union standards, unless those standards are ineffective or inappropriate to fulfil the EU’s legitimate objectives in that regard.

Amendment 54 #

Proposal for a regulation
Recital 55

(55) The purpose of European cybersecurity certification schemes should be to ensure that ICT products and services certified under such a scheme comply with specified requirements. Such requirements concern the ability to resist, at a given level of assurance, actions that aim to compromise the availability, authenticity, integrity and confidentiality of stored or transmitted or processed data or the related functions of or services offered by, or accessible via those products, processes, services and systems within the meaning of this Regulation. It is not possible to set out in detail in this Regulation the cybersecurity requirements relating to all ICT products and services. ICT products and services and related cybersecurity needs are so diverse, as is their lifecycle, that it is very difficult to come up with general cybersecurity requirements valid across the board. It is, therefore necessary to adopt a broad and general notion of cybersecurity for the purpose of certification, complemented by a set of specific cybersecurity objectives that need to be taken into account when designing European cybersecurity certification schemes. The modalities with which such objectives will be achieved in specific ICT products and services should then be further specified in detail at the level of the individual certification scheme adopted by the Commission~~, for example by reference to standards or technical specifications~~ in close consultation with the Member States and industrial stakeholders, for example by reference to standards or technical specifications. The individual certification schemes should be designed in such a way that all actors involved in the development of relevant IT products and services are encouraged to develop and adopt standards, norms and principles which ensure the highest possible level of security throughout the lifecycle.

Amendment 55 #

Morten PETERSEN, Filiz HYUSMENOVA, Petr JEŽEK, Nathalie GRIESBECK, Gérard DEPREZ, Louis MICHEL

Proposal for a regulation
Recital 55 a (new)

(55a) ENISA should develop a certification scheme with a global perspective in order to prevent future trade barriers. In the process of developing the criteria for the certification scheme ENISA should engage in dialogue with relevant partners in the sector to ensure market feasibility.

Amendment 56 #

Proposal for a regulation
Recital 56 a (new)

(56a) This European certification process needs to be analysed to avoid increased costs for producers.

Amendment 57 #

Proposal for a regulation
Recital 57

(57) Recourse to European cybersecurity certification should remain voluntary, unless otherwise provided in Union or national legislation. After this initial stage, and depending on the maturity of implementation in the EU Member States and the criticality of a product or service, it is recognised that, in the future, potentially mandatory schemes for certain ICT products and services may begin to evolve in a phased approach for the future generations of technology and in response to the policy objectives of tomorrow. However, with a view to achieving the objectives of this Regulation and avoiding the fragmentation of the internal market, national cybersecurity certification schemes or procedures for the ICT products and services covered by a European cybersecurity certification scheme should cease to produce effects from the date established by the Commission by means of the implementing act. Moreover, Member States should not introduce new national certification schemes providing cybersecurity certification schemes for ICT products and services already covered by an existing European cybersecurity certification scheme.

Amendment 58 #

Proposal for a regulation
Recital 57

(57) Recourse to European cybersecurity certification should remain voluntary, unless otherwise provided in ~~Union or~~ national legislation. However, with a view to achieving the objectives of this Regulation and avoiding the fragmentation of the internal market, national cybersecurity certification schemes or procedures for the ICT products and services covered by a European cybersecurity certification scheme should cease to produce effects from the date established by the Commission by means of the implementing act. Moreover, Member States should not introduce new national certification schemes providing cybersecurity certification schemes for ICT products and services already covered by an existing European cybersecurity certification scheme.

Amendment 59 #

Proposal for a regulation
Recital 62

(62) The Agency’s support to cybersecurity certification should also include liaising with the Council Security Committee and the relevant national body, regarding the cryptographic approval of products to be used in classified networks.deleted

Amendment 60 #

Monika HOHLMEIER

Proposal for a regulation
Recital 62

Amendment 61 #

Proposal for a regulation
Article 1 – paragraph 1 – point a

(a) lays down the objectives, tasks and organisational aspects of ENISA, the “E~~U Cybers~~uropean Network and Information Security Agency”, hereinafter ‘the Agency’; and

Amendment 62 #

Proposal for a regulation
Article 1 – paragraph 1 – point b

(b) lays down a framework for the establishment of European cybersecurity certification schemes for the purpose of ensuring an adequate level of ~~cyber~~security of ICT products and services in the Union. Such framework shall apply without prejudice to specific provisions regarding voluntary or mandatory certification in other Union acts.

Amendment 63 #

Proposal for a regulation
Article 2 – paragraph 1 – point 8

(8) ‘cyber threat’ means any potential circumstance, capability or event that may adversely impact network and information systems, their users and affected persons.

Amendment 64 #

Proposal for a regulation
Title II

ENISA – the “E~~U Cybers~~uropean Network and Information Security Agency”

Amendment 65 #

Proposal for a regulation
Article 3 – paragraph 1

1. The Agency shall undertake the tasks assigned to it by this Regulation for the purpose of contributing to a high level of ~~cybersecurity~~information security, in order to prevent cyberattacks within the Union.

Amendment 66 #

Proposal for a regulation
Article 3 – paragraph 2

2. The Agency shall carry out tasks conferred upon it by Union acts setting out measures for approximating the laws, regulations and administrative provisions of the Member States which are related to ~~cyber~~the security of cyberinformation.

Amendment 67 #

Proposal for a regulation
Article 4 – paragraph 2

2. The Agency shall assist the Union institutions, agencies and bodies, as well as Member States, in developing and implementing policies related to ~~cybersecurity~~the security of cyberinformation, for the purpose of preventing cyberattacks.

Amendment 68 #

Proposal for a regulation
Article 4 – paragraph 3 – subparagraph 1 a (new)

The agency shall seek to identify critical vulnerabilities of the Unions cyber security network as a whole as well as those of individual Member States. In case the agency deems it necessary such vulnerabilities should be reported to the European Parliament.

Amendment 69 #

Morten PETERSEN, Pavel TELIČKA, Filiz HYUSMENOVA, Petr JEŽEK, Nathalie GRIESBECK, Gérard DEPREZ, Louis MICHEL

Proposal for a regulation
Article 4 – paragraph 5

5. The Agency shall increase cybersecurity capabilities at Union level in order to complement and support the action of Member States in preventing and responding to cyber threats, notably in the event of cross- border incidents.

Amendment 70 #

Proposal for a regulation
Article 4 – paragraph 6

6. The Agency shall promote the use of certification~~, including~~ and standardisation, including the development of European and international standards on cybersecurity, and by contributing to the establishment and maintenance of a cybersecurity certification framework at Union level in accordance with Title III of this Regulation, with a view to increasing transparency of cybersecurity assurance of ICT products and services and thus strengthen trust in the digital internal market.

Amendment 71 #

Proposal for a regulation
Article 4 – paragraph 6

6. The Agency shall promote the use of certification, including by contributing to the development of European and international standards on cybersecurity, the establishment and maintenance of a cybersecurity certification framework at Union level in accordance with Title III of this Regulation, with a view to increasing transparency of cybersecurity assurance of ICT products and services and thus strengthen trust in the digital internal market.

Amendment 72 #

Proposal for a regulation
Article 4 – paragraph 7

7. The Agency shall promote a high level of awareness ~~of citizens and businesses~~ on issues related to the cybersecurity.

Amendment 73 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2

2. assisting Member States to implement consistently the Union policy and law regarding cybersecurity notably in relation to Directive (EU) 2016/1148, Directive establishing the European Electronic Communications Code, Regulation (EU) 2016/679 and Directive2002/58/EC, including by means of opinions, guidelines, advice and best practices on topics such as risk management, incident reporting and information sharing, as well as facilitating the exchange of best practices between competent authorities in this regard;

Amendment 74 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2 a (new)

2 a. assisting the bodies established under Regulation (EU) 2016/679 in developing guidelines setting out conditions and safeguards for further processing of personal data for security purposes with the objective of protecting against attacks against network and information systems within the scope of Regulation (EU) 2016/679, Directive (EU) 2016/1148 and Directive 2002/58/EC;

Amendment 75 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2 b (new)

2 b. proposing policies setting out conditions and deadlines for the fixing of IT security vulnerabilities by ICT vendors with the objective of avoiding any exposure of users to computer oriented threats;

Amendment 76 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2 c (new)

2 c. proposing policies for public authorities for handling of vulnerabilities that are not known to the public, with the objective of safeguarding the integrity of the ecosystem of information systems;

Amendment 77 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2 d (new)

2 d. proposing policies and advising public authorities to avoid and limit the deployment of closed-source IT solutions in order to ensure that the ICT ecosystem is free from vulnerabilities, in particular backdoors;

Amendment 78 #

Proposal for a regulation
Article 6 – paragraph 1 – point a

(a) Member States in their efforts to improve the prevention, detection and analysis, and the capacity to respond to, cyber~~security problem~~ threats and incidents by providing them with the necessary knowledge and expertise;

Amendment 79 #

Proposal for a regulation
Article 6 – paragraph 1 – point b

(b) Union institutions, bodies, offices and agencies, in their efforts to improve the prevention, detection and analysis of and the capability to respond to cyber~~security problem~~ threats and incidents through appropriate support for the CERT for the Union institutions, agencies and bodies (CERT-EU);

Amendment 80 #

Morten PETERSEN, Filiz HYUSMENOVA, Petr JEŽEK, Nathalie GRIESBECK, Gérard DEPREZ, Louis MICHEL

Proposal for a regulation
Article 6 – paragraph 1 – point f a (new)

(fa) and cooperate with national data protection supervisory authorities, where necessary

Amendment 81 #

Proposal for a regulation
Article 7 – paragraph 5 – subparagraph 1

Upon a request by ~~two~~one or more Member States concerned, and with the sole purpose of providing advice for the prevention of future incidents, the Agency shall provide support to or carry out an ex-post technical enquiry following notifications by affected undertakings of incidents having a significant or substantial impact pursuant to Directive (EU) 2016/1148. The Agency shall also carry out such an enquiry upon a duly justified request from the Commission in agreement with the concerned Member States in case of such incidents affecting more than two Member States.

Amendment 82 #

Proposal for a regulation
Article 7 – paragraph 5 – subparagraph 2

The scope of the enquiry and the procedure to be followed in conducting such enquiry shall be agreed by the concerned Member States and the Agency and is without prejudice to any on-going criminal investigation concerning the same incident. Such enquiry shall not interfere with the essential interests of the Member States to safeguard their national security. The enquiry shall be concluded by a final technical report compiled by the Agency in particular on the basis of information and comments provided by the concerned Member States and undertaking(s) and agreed with the concerned Member States. A summary of the report focussing on the recommendations for the prevention of future incidents will be shared with the CSIRTs network.

Amendment 83 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 1

(1) preparing candidate European cybersecurity certification schemes for ICT products and services in cooperation with industry and in accordance with Article 44 of this Regulation;

Amendment 84 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 1

(1) preparing candidate European cybersecurity certification schemes for ICT products and services in cooperation with industry in accordance with Article 44 of this Regulation;

Amendment 85 #

Proposal for a regulation
Article 8 – paragraph 1 – point b a (new)

(ba) facilitate the establishment and take-up of European and international standards for the security of ICT products and services, with the objective of preventing the use and distribution, both intentionally and non-intentionally, of technology, or parts thereof, intentionally weakening the security of ICT products and services (‘backdoors’);

Amendment 86 #

Proposal for a regulation
Article 9 – paragraph 1 – point d

(d) pool, organise and make available to the public, through a dedicated portal, information on cybersecurity, provided by the Union institutions, agencies and bodies and made available by Member States and public and private stakeholders;

Amendment 87 #

Morten PETERSEN, Filiz HYUSMENOVA, Petr JEŽEK, Nathalie GRIESBECK, Gérard DEPREZ, Louis MICHEL

Proposal for a regulation
Article 9 – paragraph 1 – point e

(e) raise awareness of the public about cybersecurity risks, disseminate adequate measures for prevention of incidents, and provide guidance on good practices for individual users aimed at citizens and organisations;

Amendment 88 #

Proposal for a regulation
Article 9 – paragraph 1 – point e a (new)

(ea) Create a network of national education points of contact to support better coordination and exchange of best practices among Member States on cybersecurity education and awareness.

Amendment 89 #

Proposal for a regulation
Article 9 – paragraph 1 – point g

(g) organise, in cooperation with the Member States and Union institutions, bodies, offices ~~and agencie~~, agencies and other relevant stakeholders regular outreach campaigns to increase cybersecurity and its visibility in the Union.

Amendment 90 #

Proposal for a regulation
Article 9 – paragraph 1 – point g

(g) organise, in cooperation with the Member States ~~and~~, Union institutions, bodies, offices ~~and~~, agencies regular and industry outreach campaigns to increase cybersecurity and its visibility in the Union.

Amendment 91 #

Proposal for a regulation
Article 9 – paragraph 1 – point g a (new)

(ga) Support closer coordination and exchange of best practices among Member States on cybersecurity education and awareness by facilitating creation and maintenance of a network of national education points of contact;

Amendment 92 #

Proposal for a regulation
Article 10 – paragraph 1 – point a

(a) advise the Union and the Member States on research needs and priorities in the areas of cybersecurity and data protection and privacy, with a view to enabling effective responses to current and emerging risks and threats, including with respect to new and emerging information and communications technologies, and to using risk-prevention technologies effectively;

Amendment 93 #

Proposal for a regulation
Article 10 – paragraph 1 – point a

(a) advise the Union and the Member States on research needs and priorities in the area of cybersecurity only, with a view to enabling effective responses to current and emerging risks and threats, including with respect to new and emerging information and communications technologies, and to using risk-prevention technologies effectively;

Amendment 94 #

Proposal for a regulation
Article 14 – paragraph 1 – point m

(m) appoint the Executive Director through selection based on professional criteria and where relevant extend his term of office or remove him from office in accordance with Article 33 of this Regulation;

Amendment 95 #

Proposal for a regulation
Article 19 – paragraph 5

5. The Executive Director shall decide whether it is necessary to locate members of staff in one or more Member States for the purpose of carrying out the Agency’s tasks in an efficient and effective manner. Before deciding to establish a local office the Executive Director shall obtain the prior consent of the Commission, the Management Board and the Member State(s) concerned. The decision shall specify the scope of the activities to be carried out at the local office in a manner that avoids unnecessary costs and duplication of administrative functions of the Agency. An agreement with the Member State(s) concerned shall be reached, where appropriate or required.deleted

Amendment 96 #

Proposal for a regulation
Article 20 – paragraph 1

1. The Management Board, acting on a proposal by the Executive Director, shall set up a Permanent Stakeholders’ Group composed of recognised experts representing the relevant stakeholders, such as the ICT industry, providers of electronic communications networks or services available to the public, consumer groups, the European standardisation organisations, academic experts in the cybersecurity, and representatives of competent authorities notified under [Directive establishing the European Electronic Communications Code] as well as of law enforcement and data protection supervisory authorities.

Amendment 97 #

Proposal for a regulation
Article 20 – paragraph 5 a (new)

5a. The Permanent Stakeholders’ Group shall be consulted on the preparation of candidate schemes referred to in Article 44(1) as part of an official consultation process, alongside wider industry stakeholders.

Amendment 98 #

Jaromír ŠTĚTINA

Proposal for a regulation
Article 30 – paragraph 1

1. In order to facilitate the combating of fraud, corruption and other unlawful activities under Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council39 , the Agency shall~~, within six months from the day it becomes operational,~~ accede to the Interinstitutional Agreement of 25 May, 1999 concerning internal investigations by the European Anti-fraud Office (OLAF) and shall adopt without delay the appropriate provisions applicable to all the employees of the Agency, using the template set out in the Annex to that Agreement. _________________ 39 Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ L 248, 18.9.2013, p. 1).

Amendment 99 #

Proposal for a regulation
Article 30 – paragraph 2

2. The Court of Auditors shall have the power of audit, on the basis of documents and on the spot inspections, over all grant beneficiaries, contractors and subcontractors who have received Union funds from the Agency.

source: 618.105

2018/03/02 IMCO 394 amendments...

Amendment 100 #

Proposal for a regulation
Recital 55

(55) The purpose of European cybersecurity certification schemes should be to ensure that ICT products and services certified under such a scheme comply with specified requirements. Such requirements concern the ability to resist, at a given level of assurance, actions that aim to compromise the availability, authenticity, integrity and confidentiality of stored or transmitted or processed data or the related functions of or services offered by, or accessible via those products, processes, services and systems within the meaning of this Regulation. It is not possible to set out in detail in this Regulation the cybersecurity requirements relating to all ICT products and services. ICT products and services and related cybersecurity needs are so diverse that it is very difficult to come up with general cybersecurity requirements valid across the board. It is, therefore necessary to adopt a broad and general notion of cybersecurity for the purpose of certification, complemented by a set of specific cybersecurity objectives that need to be taken into account when designing European cybersecurity certification schemes. The modalities with which such objectives will be achieved in specific ICT products and services should then be further specified in detail at the level of the individual certification scheme adopted by the Commission, for example by reference to standards or technical specifications. Depending on the certification scheme, the specified requirements of the scheme could, in principle, make use of existing best practices where applicable.

Amendment 101 #

Nicola DANTI, Evelyne GEBHARDT, Maria GRAPINI, Sergio GUTIÉRREZ PRIETO, Lucy ANDERSON, Arndt KOHN, Catherine STIHLER, Kerstin WESTPHAL, Pina PICIERNO, Marc TARABELLA, Christel SCHALDEMOSE

Proposal for a regulation
Recital 55 a (new)

(55a) In light of innovation trends, and the growing accessibility and constantly increasing number of IoT devices in all sectors of society, particular attention must be paid to the security of all and even the simplest of IoT products. Therefore, as certification is a key method for increasing trust in the market and increasing security and resilience, emphasis should be given to IoT products and services in the new EU cybersecurity certification framework, in order to make them less vulnerable and safer for consumers and businesses.

Amendment 102 #

Nicola DANTI, Maria GRAPINI, Sergio GUTIÉRREZ PRIETO, Lucy ANDERSON, Arndt KOHN

Proposal for a regulation
Recital 56

(56) The Commission should be empowered to request ENISA to prepare candidate schemes for specific ICT products or services. The Commission, based on the candidate scheme proposed by ENISA, should then be empowered to adopt the European cybersecurity certification scheme by means of implementing acts. In order to underpin trust and predictability in, and raise public awareness of, the cybersecurity certification framework, ENISA should maintain a dedicated website with an easy-to-use online tool listing information on adopted schemes, candidate schemes, and schemes requested by the Commission. Taking account of the general purpose and security objectives identified in this Regulation, European cybersecurity certification schemes adopted by the Commission should specify a minimum set of elements concerning the subject-matter, the scope and functioning of the individual scheme. These should include among others the scope and object of the cybersecurity certification, including the categories of ICT products ~~and servic~~, services and processes covered, the detailed specification of the cybersecurity requirements, for example by reference to standards or technical specifications, the specific evaluation criteria and evaluation methods associated with the operation and use of an ICT product, process or service, as well as the intended level of assurance: ~~basic~~secure, substantial ~~and/or high~~ly secure, highly secure, or any combination thereof.

Amendment 103 #

Proposal for a regulation
Recital 56

(56) The Commission should be empowered to request ENISA to prepare candidate schemes for specific ICT products or services. The ~~Commission, based~~power to adopt acts in accordance with Article 290 onf the candidate scheme proposed by ENISA, should then be empowered to adopt the European cybersecurity certification scheme by means of implementing acts. Taking account of the general purpose and security objectives identified in this Regulation, European cybersecurity certification schemes adopted by the Commission should specify a minimum set of elements concerning the subject-matter,Treaty on the Functioning of the European Union should be delegated to the Commission in respect of establishing European cybersecurity certification schemes for ICT products and services. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those scope and functioning of the individual scheme. These should include among others the scope and object of the cybersecurity certification, including the categories of ICT products and services covered, the detailed specification of the cybersecurity requirements, for example by reference to standards or technical specifications, the specific evaluation criteria and evaluation methods, as well nsultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making. In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts. When adopting those delegated acts, the Commission should base the ~~intended level of assurance: basic, substantial and/or high~~cybersecurity certification schemes for ICT products and services on any relevant candidate schemes proposed by ENISA.

Amendment 104 #

Liisa JAAKONSAARI, Christel SCHALDEMOSE, Lucy ANDERSON

Proposal for a regulation
Recital 56

(56) The Commission should be empowered to request ENISA to prepare candidate schemes for specific ICT products or services. The Commission, based on the candidate scheme proposed by ENISA, should then be empowered to adopt the European cybersecurity certification scheme by means of implementing acts. Taking account of the general purpose and security objectives identified in this Regulation, European cybersecurity certification schemes adopted by the Commission should specify a minimum set of elements concerning the subject-matter, the scope and functioning of the individual scheme. These should include among others the scope and object of the cybersecurity certification, including the categories of ICT products and services covered, the detailed specification of the cybersecurity requirements, for example by reference to standards or technical specifications, the specific evaluation criteria and evaluation methods, as well as the intended level of assurance~~: basic, substantial and/or high~~. Consideration should be given in the scheme to the full lifecycle of the product, including any rules applicable to the de- commissioning of products or services.

Amendment 105 #

Proposal for a regulation
Recital 56

(56) The Commission should be empowered to request ENISA to prepare candidate schemes for specific ICT products or services. The Commission, based on the candidate scheme proposed by ENISA, should then be empowered to adopt the European cybersecurity certification scheme by means of implementing acts. Taking account of the general purpose and security objectives identified in this Regulation, European cybersecurity certification schemes adopted by the Commission should specify a minimum set of elements concerning the subject-matter, the scope and functioning of the individual scheme. These should include among others the scope and object of the cybersecurity certification, including the categories of ICT products and services covered, the detailed specification of the cybersecurity requirements, for example by reference to standards or technical specifications, the specific evaluation criteria and evaluation methods, as well as the intended level of assurance: basic, substantial and/or high. Schemes providing for marks or labels could be an incentive for businesses to achieve best-practice in security.

Amendment 106 #

Proposal for a regulation
Recital 56

(56) The Commission should be empowered to request ENISA to prepare candidate schemes for specific ICT products or services. The Commission, based on the candidate scheme proposed by ENISA, should then be empowered to adopt the European cybersecurity certification scheme by means of implementing acts. Taking account of the general purpose and security objectives identified in this Regulation, European cybersecurity certification schemes adopted by the Commission should specify a minimum set of elements concerning the subject-matter, the scope and functioning of the individual scheme. These should include among others the scope and object of the cybersecurity certification, including the categories of ICT products and services covered, the detailed specification of the cybersecurity requirements, for example by reference to standards or technical specifications, the specific evaluation criteria and evaluation methods, as well as the intended level of assurance: basic, substantial and/or high. The security requirements should depend on the risk resulting from the ICT product or service.

Amendment 107 #

Proposal for a regulation
Recital 56

(56) The Commission should be empowered to request ENISA to prepare candidate schemes for specific ICT products or services. The Commission, based on the candidate scheme proposed by ENISA, shwould then be empowered to adopt the European cybersecurity certification scheme by means of implementing acts only after obtaining Member States’ consent. Taking account of the general purpose and security objectives identified in this Regulation, European cybersecurity certification schemes adopted by the Commission should specify a minimum set of elements concerning the subject-matter, the scope and functioning of the individual scheme. These should include among others the scope and object of the cybersecurity certification, including the categories of ICT products and services covered, the detailed specification of the cybersecurity requirements, for example by reference to standards or technical specifications, the specific evaluation criteria and evaluation methods, as well as the intended level of assurance: basic, substantial and/or high.

Amendment 108 #

Proposal for a regulation
Recital 56

(56) The Commission should be empowered to request ENISA to prepare candidate schemes for specific ICT products or services. The Commission, based on the candidate scheme proposed by ENISA, should then be empowered to adopt the European cybersecurity certification scheme by means of implementing acts. Taking account of the general purpose and security objectives identified in this Regulation, European cybersecurity certification schemes adopted by the Commission should specify a minimum set of elements concerning the subject-matter, the scope and functioning of the individual scheme. These should include among others the scope and object of the cybersecurity certification, including the categories of ICT hardware and software products and services covered, the detailed specification of the cybersecurity requirements, for example by reference to standards or technical specifications, the specific evaluation criteria and evaluation methods, as well as the intended level of risk-based assurance: ~~basic~~elemental, substantial and/or high.

Amendment 109 #

Nicola DANTI, Evelyne GEBHARDT, Maria GRAPINI, Sergio GUTIÉRREZ PRIETO, Lucy ANDERSON, Arndt KOHN, Catherine STIHLER, Kerstin WESTPHAL, Pina PICIERNO, Marc TARABELLA

Proposal for a regulation
Recital 56 a (new)

(56a) Among the evaluation methods and assessment procedures related to each European cybersecurity certification scheme, ethical hacking, the aim of which is to locate weaknesses and vulnerabilities of devices and information systems by anticipating the intended actions and skills of malicious hackers, should be promoted at Union level.

Amendment 110 #

Proposal for a regulation
Recital 56 a (new)

(56a) This European certification process needs to be analysed to avoid increased costs for producers.

Amendment 111 #

Proposal for a regulation
Recital 57

(57) Recourse to European cybersecurity certification should remain voluntary, unless otherwise provided in Union or national legislation. However, with a view to achieving the objectives of this Regulation and avoiding the fragmentation of the internal market, national cybersecurity certification schemes or procedures for the ICT products and services covered by a European cybersecurity certification scheme should cease to produce effects from the date established by the Commission by means of the implementing act. Moreover, Member States should not introduce new national certification schemes providing cybersecurity certification schemes for ICT products and services already covered by an existing European cybersecurity certification scheme, with the exception of cases pertaining to the processing of classified information, national security and related public procurement procedures. This should apply as from a date set by the Commission by means of an implementing act, which should give Member States sufficient time for a smooth and seamless transition to the new certification scheme. Moreover, Member States should not introduce new national certification schemes providing cybersecurity certification schemes for ICT products and services already covered by an existing European cybersecurity certification scheme. The proposed certification scheme should therefore be sufficiently flexible and adaptable to keep up with rapidly evolving technology, should be compatible with international standards and should not create barriers to innovation, so that it can bring real benefits to Member States and not cause them difficulties.

Amendment 112 #

(57) Recourse to European cybersecurity certification should remain voluntary, unless otherwise provided in Union or national legislation. After this initial stage, and depending on the maturity of implementation in the EU Members States and the criticality of a product or service, it is recognised that, in the future, the mandatory schemes for certain ICT products, processes and services may begin to evolve in s phased approach. However, with a view to achieving the objectives of this Regulation and avoiding the fragmentation of the internal market, national cybersecurity certification schemes or procedures for the ICT products and services covered by a European cybersecurity certification scheme should cease to produce effects from the date established by the Commission by means of the implementing act. Moreover, Member States should not introduce new national certification schemes providing cybersecurity certification schemes for ICT products and services already covered by an existing European cybersecurity certification scheme. This is, however, without prejudice to national schemes covering ICT products, processes and services used for Member States’ sovereign domain needs, for which they have sole responsibility.

Amendment 113 #

Proposal for a regulation
Recital 57

(57) Recourse to European cybersecurity certification should remain voluntary, unless otherwise provided in Union or national legislation. However, wbaseline IT security requirements need to be mandatory and implemented on all consumer devices and services in order to tackle the challenges of an increasingly connected world. Such minimal requirements could include authentication, security of connections and patches for the discovered vulnerabilities. With a view to achieving the objectives of this Regulation and avoiding the fragmentation of the internal market, national cybersecurity certification schemes or procedures for the ICT products and services covered by a European cybersecurity certification scheme should cease to produce effects from the date established by the Commission by means of the implementing act. Moreover, Member States should not introduce new national certification schemes providing cybersecurity certification schemes for ICT products and services already covered by an existing European cybersecurity certification scheme.

Amendment 114 #

Proposal for a regulation
Recital 57

(57) Recourse to European cybersecurity certification should remain voluntary~~, unless otherwise provided in Union or national legislation. However, w~~. When specific need for certain products or services to demonstrate compliance with a set of harmonised cybersecurity requirements arises in Union law, the requirements and process of assessment and compliance verification should be set down in Union legislation in line with the New Approach. With a view to achieving the objectives of this Regulation and avoiding the fragmentation of the internal market, national cybersecurity certification schemes or procedures for the ICT products and services covered by a European cybersecurity certification scheme should cease to produce effects from the date established by the Commission by means of the implementing act. Moreover, Member States should not introduce new national certification schemes providing cybersecurity certification schemes for ICT products and services already covered by an existing European cybersecurity certification scheme.

Amendment 115 #

Proposal for a regulation
Recital 57

(57) Recourse to European cybersecurity certification should remain voluntary~~, unless otherwise provided in Union or national leg~~. This should not, however, prevent the Union or the Member States’ administrations from requiring a European cybersecurity certification inter alia as part of the authorislation~~. However, w~~ for infrastructure projects or public procurements. With a view to achieving the objectives of this Regulation and avoiding the fragmentation of the internal market, national cybersecurity certification schemes or procedures for the ICT products and services covered by a European cybersecurity certification scheme should cease to produce effects from the date established by the Commission by means of the implementing act. Moreover, Member States should not introduce new national certification schemes providing cybersecurity certification schemes for ICT products and services already covered by an existing European cybersecurity certification scheme.

Amendment 116 #

Proposal for a regulation
Recital 57

(57) Recourse to European cybersecurity certification should remain voluntary, except for ICT products and services with high security requirements and unless otherwise provided in Union or national legislation. However, with a view to achieving the objectives of this Regulation and avoiding the fragmentation of the internal market, national cybersecurity certification schemes or procedures for the ICT products and services covered by a European cybersecurity certification scheme should cease to produce effects from the date established by the Commission by means of the implementing act. Moreover, Member States should not introduce new national certification schemes providing cybersecurity certification schemes for ICT products and services already covered by an existing European cybersecurity certification scheme.

Amendment 117 #

Proposal for a regulation
Recital 57

(57) RThe baseline ICT secourseity should be regulated in a to European cybersecurity certification ~~should remain volunta~~framework that should be mandatory, unless otherwise provided in Union ~~or national~~ legislation. However, with a view to achieving the objectives of this Regulation and avoiding the fragmentation of the internal market, national cybersecurity certification schemes or procedures for the ICT products and services covered by a European cybersecurity certification scheme should cease to produce effects from the date established by the Commission by means of the implementing act. Moreover, Member States should not introduce new national certification schemes providing cybersecurity certification schemes for ICT products and services already covered by an existing European cybersecurity certification scheme.

Amendment 118 #

Proposal for a regulation
Recital 57

Amendment 119 #

Proposal for a regulation
Recital 57

Amendment 120 #

Proposal for a regulation
Recital 58

(58) Once a European cybersecurity certification scheme is adopted, manufacturers of ICT hardware and software products or providers of ICT services should be able to submit an application for certification of their products or services to a conformity assessment body of their choice. These manufacturers may also decide to self- declare conformity with the relevant European cybersecurity certification scheme and shall be subject to scrutiny by the national certification supervisory authority, which, in turn will report the results of these assessments to the European Cybersecurity Certification Group and to ENISA. Conformity assessment bodies should be accredited by an accreditation body if they comply with certain specified requirements set out in this Regulation. Accreditation should be issued for a ~~maximum of five years~~period determined in the relevant European cybersecurity certification scheme and may be renewed on the same conditions provided that the conformity assessment body meets the requirements. Accreditation bodies should revoke an accreditation of a conformity assessment body where the conditions for the accreditation are not, or are no longer, met or where actions taken by a conformity assessment body infringe this Regulation.

Amendment 121 #

Proposal for a regulation
Recital 58

(58) Once a European cybersecurity certification scheme is adopted, manufacturers of ICT products or providers of ICT services should be able to submit an application for certification of their products or services to a conformity assessment body of their choice. Products and services with high security requirements shall be subject to mandatory third-party certification. For all other ICT products and services, third- party certification shall be voluntary, unless otherwise specified in Union law. Conformity assessment bodies should be accredited by an accreditation body if they comply with certain specified requirements set out in this Regulation. Accreditation should be issued for a maximum of five years and may be renewed on the same conditions provided that the conformity assessment body meets the requirements. Accreditation bodies should revoke an accreditation of a conformity assessment body where the conditions for the accreditation are not, or are no longer, met or where actions taken by a conformity assessment body infringe this Regulation.

Amendment 122 #

Proposal for a regulation
Recital 58

(58) Once a European cybersecurity certification scheme is adopted, manufacturers of ICT products or providers of ICT services should be able to submit an application for certification of their products or, services or processes to a conformity assessment body of their choice. Conformity assessment bodies should be accredited by an accreditation body if they comply with certain specified requirements set out in this Regulation. Accreditation should be issued for a maximum of five years and may be renewed on the same conditions provided that the conformity assessment body meets the requirements. Accreditation bodies should revoke an accreditation of a conformity assessment body where the conditions for the accreditation are not, or are no longer, met or where actions taken by a conformity assessment body infringe this Regulation.

Amendment 123 #

Proposal for a regulation
Recital 58 a (new)

(58a) Clear and mandatory baseline IT security requirements should be devised by the Agency, and should be proposed to the Commission as implementing acts if appropriate, for all IT devices sold in or exported from the Union. Those requirements should be developed within two years after the date of entry into force of this Regulation and revised every two years thereafter, in order to ensure constant and dynamic improvements. Those baseline IT security requirements should require, inter alia, that the device does not contain any known security vulnerability that it is capable of accepting trusted security updates, that the vendor notifies competent authorities of known vulnerabilities and repairs or replaces the affected device, or that the vendor informs when security support for such device will end.

Amendment 124 #

Proposal for a regulation
Recital 58 a (new)

(58a) With a view to ensure that accreditation is carried out uniformly across the European Union, national accreditation bodies shall subject themselves to a peer review assessment coordinated by ENISA.

Amendment 125 #

Proposal for a regulation
Recital 59

(59) It is necessary to require all Member States to designate one cybersecurity certification supervisory authority to supervise compliance of conformity assessment bodies and of certificates issued by conformity assessment bodies established in their territory with the requirements of this Regulation and of the relevant cybersecurity certification schemes. National certification supervisory authorities should handle complaints lodged by natural or legal persons in relation to certificates issued by conformity assessment bodies established in their territories, investigate to the extent appropriate the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable time period. Moreover, they should cooperate with other national certification supervisory authorities or other public authority, including by sharing information on possible non-compliance of ICT hardware and software products and services with the requirements of this Regulation or specific cybersecurity schemes. Furthermore, they should supervise and verify the compliance of the self-declarations of conformity and that European cybersecurity certificates have been issued by conformity assessment bodies with the requirements set out in this Regulation including the rules adopted by the European Cybersecurity Certification Group and the requirements set out in the corresponding European cybersecurity certification scheme.

Amendment 126 #

Proposal for a regulation
Recital 65

(65) The examination procedure should be used for the adoption of implementing acts on European cybersecurity certification schemes for ICT products ~~and servic~~, services and processes; on modalities of carrying enquiries by the Agency; as well as on the circumstances, formats and procedures of notifications of accredited conformity assessment bodies by the national certification supervisory authorities to the Commission.

Amendment 127 #

Proposal for a regulation
Recital 66

(66) The Agency’s operations should be evaluated independently. The evaluation should ~~hav~~include the rleg~~ard to~~itimacy and effectiveness of the Aagency ’s expenditure, its efficiency in reachi~~evi~~ng its ~~objectives,~~targets and a description of its working practices and the relevance of its tasks. The evaluation should also assess the impact, effectiveness and efficiency of the European cybersecurity certification framework.

Amendment 128 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Dita CHARANZOVÁ

Proposal for a regulation
Article 1 – paragraph 1 – point a

(a) lays down the objectives, tasks and organisational aspects of ENISA, the “EU ~~Cybersecurity Agency”, hereinafter ‘~~Network and Information Security Agency (the “Agency’”); and

Amendment 129 #

Proposal for a regulation
Article 1 – paragraph 1 – point b

(b) lays down a framework for the establishment of European cybersecurity certification schemes for the purpose of ensuring an adequate level of cybersecurity of ICT products, processes and services in the Union. Such framework shall apply without prejudice to specific provisions regarding voluntary or mandatory certification in other Union acts. (This amendment applies throughout the text. Adopting it will necessitate corresponding changes throughout.)

Amendment 130 #

Proposal for a regulation
Article 1 – paragraph 1 – point b

Amendment 131 #

Proposal for a regulation
Article 1 – paragraph 1 – point b

(b) lays down a framework for the establishment of European cybersecurity certification schemes for the purpose of ensuring an adequate level of cybersecurity of ICT products ~~and~~, services and processes in the Union. Such framework shall apply without prejudice to specific provisions regarding ~~voluntary or mandatory~~ certification in other Union acts.

Amendment 132 #

Proposal for a regulation
Article 2 – paragraph 1 – point 1 a (new)

(1a) ‘cyber-hygiene’ means simple, established routine measures, such as multi-factor authentication, patching, encryption, and access management, that end-users can take to minimise the risks from cyber threats;

Amendment 133 #

Proposal for a regulation
Article 2 – paragraph 1 – point 8 a (new)

(8a) “Cyber hygiene” means the establishing of routine measures that users and businesses can take to minimise the risks from cyber threats and protect themselves online.

Amendment 134 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Pascal ARIMONT, Antonio LÓPEZ-ISTÚRIZ WHITE, Carlos COELHO

Proposal for a regulation
Article 2 – paragraph 1 – point 9

(9) ‘European cybersecurity certification scheme’ means the comprehensive set of rules, technical requirements, standards in accordance with Regulation (EU) 2012/1025, and procedures defined at Union level applying to the certification of Information and Communication Technology (ICT) products ~~and servic~~, services and processes falling under the scope of that specific scheme;

Amendment 135 #

Proposal for a regulation
Article 2 – paragraph 1 – point 9

(9) ‘European cybersecurity certification scheme’ means the comprehensive set of rules, technical requirements, standards and procedures defined at Union level applying to the certification of Information and Communication Technology (ICT) hardware and software products and services falling under the scope of that specific scheme;

Amendment 136 #

Proposal for a regulation
Article 2 – paragraph 1 – point 9

(9) ‘European cybersecurity certification scheme’ means the comprehensive set of rules, ~~technical requirements,~~ standards and procedures defined at Union level applying to the certification of Information and Communication Technology (ICT) products and services falling under the scope of that specific scheme;

Amendment 137 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Dita CHARANZOVÁ

Proposal for a regulation
Article 2 – paragraph 1 – point 10

(10) ‘European cybersecurity certificate’ means a document issued by a conformity assessment body attesting that a given ICT product, process, systems or service fulfils the specific requirements laid down in a European cybersecurity certification scheme;

Amendment 138 #

Proposal for a regulation
Article 2 – paragraph 1 – point 10

(10) ‘European cybersecurity certificate’ means a document issued by a conformity assessment body attesting that a given ICT product, process or service fulfils the specific requirements laid down in a European cybersecurity certification scheme;

Amendment 139 #

Proposal for a regulation
Article 2 – paragraph 1 – point 10

(10) ‘European cybersecurity certificate’ means a document issued by a conformity assessment body attesting that a given ICT product or, service or process fulfils the specific requirements laid down in a European cybersecurity certification scheme;

Amendment 140 #

Proposal for a regulation
Article 2 – paragraph 1 – point 11 a (new)

(11a) “national certification supervisory authority” means an authority of a Member State responsible for carrying out monitoring, enforcement and supervisory tasks in relation to IT security certification on its territory;

Amendment 141 #

Proposal for a regulation
Article 2 – paragraph 1 – point 11 a (new)

(11a) “ICT process and system” means a set of procedures integrated in the development, deployment and maintenance of ICT products and services.

Amendment 142 #

Roberta METSOLA, Lara COMI, Antonio LÓPEZ-ISTÚRIZ WHITE, Jiří POSPÍŠIL

Proposal for a regulation
Article 2 – paragraph 1 – point 15

(15) ‘conformity assessment body’ means conformity assessment body of a Member State that performs conformity assessment activities including calibration, testing, certification and inspection as defined in point (13), Article 2 of Regulation (EC) No 765/2008;

Amendment 143 #

Proposal for a regulation
Article 2 – paragraph 1 – point 16 a (new)

(16a) ‘self-declaration of conformity’ means the statement by the manufacturer that attests their ICT product or service conforms with the specified European cybersecurity certification schemes.

Amendment 144 #

Proposal for a regulation
Article 2 – paragraph 1 – point 16 a (new)

(16a) ‘self-declaration of conformity’ means the statement by which the manufacturer demonstrates that specified requirements relating to a product or service, have been fulfilled;

Amendment 145 #

Proposal for a regulation
Title II

ENISA – the “EU ~~Cybers~~Network and Information Security Agency”

Amendment 146 #

Proposal for a regulation
Article 3 – paragraph 1

Amendment 147 #

Proposal for a regulation
Article 3 – paragraph 1

1. The Agency shall undertake the tasks assigned to it by this Regulation for the purpose of ~~contributing to~~achieving a high level of cybersecurity within the Union.

Amendment 148 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Dita CHARANZOVÁ

Proposal for a regulation
Article 3 – paragraph 2

Amendment 149 #

Proposal for a regulation
Article 3 – paragraph 2 a (new)

2a. The Agency shall assist Member States and Union institutions in establishing policies and practices for the responsible management and coordinated disclosure of vulnerabilities in ICT products and services that are not publicly known.

Amendment 150 #

Proposal for a regulation
Article 3 – paragraph 3

3. The objectives and the tasks of the Agency shall be without prejudice to the exclusive competences of the Member States regarding ~~cybersecurity, and in any case, without prejudice to activities concerning public security, defence, national security and the activities of the state in areas of criminal law~~IT security.

Amendment 151 #

Proposal for a regulation
Article 4 – paragraph 2

2. The Agency shall assist the Union institutions, agencies and bodies, as well as Member States, in developing and implementing policies related to ~~cybersecurity~~data security for the purpose of preventing cyber-attacks.

Amendment 152 #

Proposal for a regulation
Article 4 – paragraph 4

4. The Agency shall promote cooperation and coordination at Union level among Member States, Union institutions, agencies and bodies, and relevant stakeholders, including the private sector, consumer organisations and other civil society organisations, on matters related to ~~cyber~~IT security.

Amendment 153 #

Proposal for a regulation
Article 4 – paragraph 6

6. The Agency shall promote the use of certification~~, including by contributing~~ while avoiding the fragmentation caused by lack of coordination between existing certification schemes in the Union. The Agency shall contribute to the establishment and maintenance of a cybersecurity certification framework at Union level in accordance with ~~Title III of this Regulation~~Articles 43 to 54 [Title III], with a view to increasing the transparency of cybersecurity assurance of ICT products and services and thus strengthening trust in the digital sin~~ternal~~gle market.

Amendment 154 #

Proposal for a regulation
Article 4 – paragraph 7

7. The Agency shall promote a high level of cyber-hygiene and awareness of citizens and businesses on issues related to the cybersecurity.

Amendment 155 #

Proposal for a regulation
Article 4 – paragraph 7

7. The Agency shall promote a high level of information for, and awareness of, citizens and businesses on issues related to ~~the~~ cybersecurity.

Amendment 156 #

Evelyne GEBHARDT, Sergio GUTIÉRREZ PRIETO, Kerstin WESTPHAL, Lucy ANDERSON, Arndt KOHN, Catherine STIHLER, Marc TARABELLA, Pina PICIERNO, Christel SCHALDEMOSE

Proposal for a regulation
Article 4 – paragraph 7

7. The Agency shall promote a high level of awareness of citizens, authorities and businesses on issues related to the cybersecurity.

Amendment 157 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Dita CHARANZOVÁ

Proposal for a regulation
Article 4 – paragraph 7 a (new)

7a. The Agency shall assist and advise the Member States and the Union institutions with regard to the establishment of policies and practices promoting the responsible management and coordinated disclosure of vulnerabilities in ICT products and services that are not publicly known, such as the establishment of government vulnerability disclosure review processes and coordinated vulnerability disclosure policies.

Amendment 158 #

Proposal for a regulation
Article 4 – paragraph 7 a (new)

7a. The Agency shall assist and advise Member States and Union institutions in establishing policies and practices for the responsible management and coordinated disclosure of vulnerabilities in ICT products and services that are not publicly known, inter alia by establishing government vulnerability disclosure review processes and coordinated vulnerability disclosure policies.

Amendment 159 #

Evelyne GEBHARDT, Sergio GUTIÉRREZ PRIETO, Kerstin WESTPHAL, Lucy ANDERSON, Arndt KOHN, Pina PICIERNO

Proposal for a regulation
Article 5 – paragraph 1 – point 1

1. assisting and advising~~, in particular by providing its independent opinion and supplying preparatory work,~~ on the development and review of Union policy and law in the area of cybersecurity, as well as sector-specific policy and law initiatives where matters related to cybersecurity are involved;

Amendment 160 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Dita CHARANZOVÁ

Proposal for a regulation
Article 5 – paragraph 1 – point 2

2. assisting Member States to implement consistently the Union policy and law regarding cybersecurity notably in relation to Directive (EU) 2016/1148, including by means of opinions, guidelines, advice and best practices on topics such as risk management, incident reporting and information sharing, technical and organisational measures, in particular the establishment of coordinated vulnerability disclosure programmes, as well as facilitating the exchange of best practices between competent authorities in this regard;

Amendment 161 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Dita CHARANZOVÁ

Proposal for a regulation
Article 5 – paragraph 1 – point 2 a (new)

2a. assisting the European Data Protection Board established by Regulation (EU) 2016/679 in developing guidelines to specify at the technical level the conditions allowing the licit use of personal data by data controllers for IT security purposes with the objective of protecting their infrastructure by detecting and blocking attacks against their information systems in the context of: (i) Regulation (EU) 2016/6791a; (ii) Directive (EU) 2016/11481b; and (iii) Directive 2002/58/EC1c; _________________ 1a Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). 1b (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). 1c Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).

Amendment 162 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2 a (new)

2a. proposing a blueprint which establishes the roles, responsibilities and legal rights and obligations of information security researchers, vendors, manufacturers, CERTs and CSIRTs in a coordinated vulnerability disclosure programme, in particular in cases of multi-party vulnerability disclosures that affect multiple vulnerability finders and vendors in different Member States;

Amendment 163 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2 b (new)

2b. proposing policies with the objective of ensuring that ICT manufacturers act with due diligence regarding the timely fixing of IT security vulnerabilities in their products and services in order to avoid unduly exposing their users to cybercrime;

Amendment 164 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2 c (new)

2c. proposing policies establishing a strong responsibility and liability framework for all stakeholders taking part in ICT eco- systems;

Amendment 165 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2 d (new)

2d. proposing policies strengthening regulation regarding the responsibilities of operators of critical network infrastructures in the case of an attack against their information systems affecting their users due to a lack of due diligence by some of the users of by the operator itself, where the operator has failed to take reasonable action to prevent the incident or to mitigate its effects on all users;

Amendment 166 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2 e (new)

2e. proposing policies to limit the purchase and use of “Zero days” by public authorities with the purpose of attacking information systems; promoting software audits and financing expert staff;

Amendment 167 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2 f (new)

2f. proposing policies for public authorities, private companies, researchers, universities and other stakeholders to publish all critical security vulnerabilities that are not yet publicly known within the framework of a responsible disclosure;

Amendment 168 #

Evelyne GEBHARDT, Sergio GUTIÉRREZ PRIETO, Kerstin WESTPHAL, Lucy ANDERSON, Arndt KOHN, Marc TARABELLA, Pina PICIERNO, Christel SCHALDEMOSE

Proposal for a regulation
Article 5 – paragraph 1 – point 2 g (new)

2g. proposing policies for the extension of the use of “verifiable open- source code” for IT solutions in the public sector as well as for the related use of automated tools to ease review of source code and to easily verify absence of backdoors and other possible security vulnerabilities;

Amendment 169 #

Proposal for a regulation
Article 5 – paragraph 1 – point 4 – point 2

(2) the promotion of an enhanced level of security of electronic communications, data storage and data processing, including by providing expertise and advice, as well as facilitating the exchange of best practices between competent authorities;

Amendment 170 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Dita CHARANZOVÁ

Proposal for a regulation
Article 5 – paragraph 1 – point 4 – point 2 a (new)

(2a) the development and promotion of policies that would sustain the general availability or integrity of the public core of the open internet, which provide the essential functionality to the Internet as a whole and which underpin its normal operation, including, but not limited to, the security and stability of key protocols (in particular DNS, BGP, and IPv6), the operation of the Domain Name System (including those of all Top Level Domains), and the operation of the Root Zone

Amendment 171 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Dita CHARANZOVÁ

Proposal for a regulation
Article 6 – paragraph 1 – point a

(a) Member States in their efforts to improve the prevention, detection and analysis, and the capacity to respond to, cybersecurity problems and incidents by providing them with the necessary knowledge and expertise;, including with a set of cyber hygiene routines to be followed by staff and citizens.

Amendment 172 #

Proposal for a regulation
Article 6 – paragraph 1 – point a a (new)

(aa) Members States and Union institutions in establishing and implementing coordinated vulnerability disclosure policies and government vulnerability disclosure review processes, whose practices and determinations should be transparent and subject to independent oversight.

Amendment 173 #

Proposal for a regulation
Article 6 – paragraph 1 – point a a (new)

(aa) Members States and the Union institutions in establishing and implementing coordinated vulnerability disclosure policies and government vulnerability equities processes, the practices and determinations of which are subject to independent oversight and transparency;

Amendment 174 #

Proposal for a regulation
Article 6 – paragraph 2

2. The Agency shall facilitate the establishment of and continuously support sectoral Information Sharing and Analysis Centres (ISACs), in particular in the sectors listed in Annex II of Directive (EU) 2016/1148, by providing best practices and guidance on available tools, procedure, cyber-hygiene principles, as well as on how to address regulatory issues related to information sharing.

Amendment 175 #

Proposal for a regulation
Article 6 – paragraph 2 a (new)

2a. The Agency shall facilitate the establishment and launch of a long-term European IT security project to support the growth of an independent EU IT security industry, and to mainstream IT security into all EU IT developments.

Amendment 176 #

Proposal for a regulation
Article 7 – paragraph 5 – subparagraph 1

Amendment 177 #

Evelyne GEBHARDT, Sergio GUTIÉRREZ PRIETO, Kerstin WESTPHAL, Lucy ANDERSON, Arndt KOHN, Catherine STIHLER, Marc TARABELLA, Pina PICIERNO, Christel SCHALDEMOSE

Proposal for a regulation
Article 7 – paragraph 8 – point a

(a) aggregating reports from national and international sources with a view to contribute to establishing common situational awareness;

Amendment 178 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Dita CHARANZOVÁ

Proposal for a regulation
Article 7 – paragraph 8 – point c a (new)

(ca) put in place certification schemes deterring the implementation by ICT manufacturers and service providers of secret backdoors intentionally weakening the IT security of commercial products and services and having a detrimental impact on the global security of the internet.

Amendment 179 #

Proposal for a regulation
Article 7 – paragraph 8 – point e a (new)

(ea) assisting and advising Member States on establishing and implementing coordinated vulnerability disclosure policies and government vulnerability disclosure review processes.

Amendment 180 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 1

(1) in cooperation with industry stakeholders in a formal, standardised, and transparent process, identifying and preparing candidate European cybersecurity certification schemes for ICT products and services in accordance with Article 44 of this Regulation;

Amendment 181 #

Nicola DANTI, Evelyne GEBHARDT, Maria GRAPINI, Sergio GUTIÉRREZ PRIETO, Lucy ANDERSON, Arndt KOHN, Catherine STIHLER, Pina PICIERNO, Marc TARABELLA, Christel SCHALDEMOSE

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 1 a (new)

(1a) carrying out independent periodic ex-post checks on the compliance of certified ICT products and services with this Regulation;

Amendment 182 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 3

(3) compiling and publishing guidelines and developing good practices, including on cyber-hygiene principles, concerning the cybersecurity requirements of ICT products and services, in cooperation with national certification supervisory authorities and the industry in a formal, standardised and transparent process;

Amendment 183 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 3

(3) compiling and publishing guidelines and developing good practices concerning the cybersecurity requirements of ICT products and services, in cooperation with national certification supervisory authorities and the industry; in a formal, standardised, and transparent process;

Amendment 184 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 3 a (new)

(3a) in consultation with all relevant stakeholders, identifying whether standards or certification processes do not yet exist globally for identified needs, and if such gaps are determined to exist, requesting that standards development organisations to develop standards or processes;

Amendment 185 #

Proposal for a regulation
Article 8 – paragraph 1 – point b

(b) ~~facilitate the establishment and take-up of~~consult international and European stand ~~international~~ardisation organisations on the development of standards for risk management and for the security of ICT products and services, as well as draw up, in collaboration with Member States, advice and guidelines regarding the technical areas related to the security requirements for operators of essential services and digital service providers, as well as regarding already existing standards, including Member States’ national standards, pursuant to Article 19(2) of Directive (EU) 2016/1148nd facilitate the establishment and take-up of relevant international and European standards;

Amendment 186 #

Proposal for a regulation
Article 8 – paragraph 1 – point b

(b) facilitate the establishment and take-up of European ~~and~~or international standards for risk management and for the security of ICT products and services, as well as draw up, in collaboration with Member States, advice and guidelines regarding the technical areas related to the security requirements for operators of essential services and digital service providers, as well as regarding already existing standards, including Member States’ national standards, pursuant to Article 19(2) of Directive (EU) 2016/1148;

Amendment 187 #

Proposal for a regulation
Article 8 – paragraph 1 – point b a (new)

(ba) draw up, in collaboration with Member States, advice and guidelines regarding the technical areas referred to in point (b), as well as regarding already existing standards, including Member States’ national standards, which would allow for those areas to be covered;

Amendment 188 #

Proposal for a regulation
Article 8 – paragraph 1 – point b a (new)

(ba) prioritise its work on inventorying existing national level schemes as well as developing guidelines for a possible harmonisation of these schemes in order to create mutual recognition within the Union;

Amendment 189 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Dita CHARANZOVÁ

Proposal for a regulation
Article 8 – paragraph 1 – point c a (new)

Amendment 190 #

Proposal for a regulation
Article 8 – paragraph 1 – point c a (new)

(ca) support and promote the development and implementation of coordinated vulnerability disclosure policies and government vulnerability disclosure review processes;

Amendment 191 #

Liisa JAAKONSAARI, Christel SCHALDEMOSE, Lucy ANDERSON

Proposal for a regulation
Article 9 – paragraph 1 – point d

(d) pool, organise and make available to the public, through a dedicated portal, information on cybersecurity, provided by the Union institutions, agencies and bodies, including information about significant cybersecurity incidents, major data breaches, and information on any providers or manufacturers who have received a warning from ENISA regarding the level of cybersecurity of their products;

Amendment 192 #

Proposal for a regulation
Article 9 – paragraph 1 – point d

~~the Union institutions, agencies and bodies;~~

Amendment 193 #

Proposal for a regulation
Article 9 – paragraph 1 – point e

(e) raise awareness of the public about cybersecurity risks, and provide guidance on good cyber-hygiene practices for individual users aimed at citizens and organisations;

Amendment 194 #

Proposal for a regulation
Article 9 – paragraph 1 – point e

(e) raise awareness of the public about cybersecurity risks, and provide guidance on good practices for ~~individual~~ users aimed at citizens and organisations;

Amendment 195 #

Proposal for a regulation
Article 9 – paragraph 1 – point e a (new)

(ea) support closer cooperation with Member States on cybersecurity education, awareness and cyber hygiene;

Amendment 196 #

Proposal for a regulation
Article 9 – paragraph 1 – point g a (new)

(ga) promote the widespread adoption by all actors on the EU Digital Single Market of preventive strong IT security measures and reliable data protection and privacy enhancing technologies as the first line of defence against attacks against information systems.

Amendment 197 #

Proposal for a regulation
Article 9 – paragraph 1 – point g a (new)

(ga) support closer coordination and the exchange of best practices among Member States on cybersecurity education, cyber-hygiene and awareness by facilitating the creation and maintenance of a network of national education points of contact;

Amendment 198 #

Inese VAIDERE

Proposal for a regulation
Article 10 – paragraph 1 – point a

(a) ensure prior consultation with relevant user groups and advise the Union and the Member States on research needs and priorities in the area of cybersecurity, with a view to enabling effective responses to current and emerging risks and threats, including with respect to new and emerging information and communications technologies, and to using risk-prevention technologies effectively;

Amendment 199 #

Proposal for a regulation
Article 10 – paragraph 1 – point a

Amendment 200 #

Proposal for a regulation
Article 11 – paragraph 1 – point c a (new)

(ca) promoting multilateral collaboration in regulation and standardisation to set a level playing field matching the global reach of the WTO;

Amendment 201 #

Proposal for a regulation
Article 11 – paragraph 1 – point c b (new)

(cb) supporting efforts for the inclusion of rules for cybersecurity into free trade agreements;

Amendment 202 #

Evelyne GEBHARDT, Sergio GUTIÉRREZ PRIETO, Kerstin WESTPHAL, Lucy ANDERSON, Arndt KOHN, Marc TARABELLA, Pina PICIERNO, Christel SCHALDEMOSE

Proposal for a regulation
Article 13 – paragraph 1

1. The Management Board shall be composed of one representative of each Member State, three representatives of the Permanent Stakeholder Group, one of which must represent the consumer interest, and two representatives appointed by the Commission. All representatives shall have voting rights.

Amendment 203 #

Proposal for a regulation
Article 13 – paragraph 1

1. The Management Board shall be composed of one representative of each Member State, and two representatives appointed by the Commission and the European Parliament. All representatives shall have voting rights.

Amendment 204 #

Proposal for a regulation
Article 14 – paragraph 1 – point e

e) assess and adopt the consolidated annual report on the Agency’s activities and send both the report and its assessment by 1 July of the following year, to the European Parliament, the Council, the Commission and the Court of Auditors. The annual report shall include the accounts ~~and~~, describe ~~how the Agency~~the effectiveness of the expenditure and assess how efficient the Agency has been and to what extend it has met its performance indicators. The annual report shall be made public;

Amendment 205 #

Proposal for a regulation
Article 14 – paragraph 1 – point m

Amendment 206 #

Proposal for a regulation
Article 14 – paragraph 1 – point o

o) take all decisions on the establishment of the Agency's internal structures and, where necessary, their modification, taking into consideration the Agency's activity needs, as listed in this regulation, and having regard to sound budgetary management;

Amendment 207 #

Evelyne GEBHARDT, Kerstin WESTPHAL, Lucy ANDERSON, Catherine STIHLER, Marc TARABELLA, Pina PICIERNO, Christel SCHALDEMOSE

Proposal for a regulation
Article 18 – paragraph 3

3. The Executive Board shall be composed of five members appointed, in a gender balanced manner, from among the members of the Management Board amongst whom the Chairperson of the Management Board, who may also chair the Executive Board, and one of the representatives of the Commission. The Executive Director shall take part in the meetings of the Executive Board, but shall not have the right to vote.

Amendment 208 #

Proposal for a regulation
Article 19 – paragraph 2

2. The Executive Director shall report annually to the European Parliament on the performance of his or her duties or when invited to do so. The Council may invite the Executive Director to report on the performance of his or her duties.

Amendment 209 #

Arndt KOHN, Sergio GUTIÉRREZ PRIETO, Lucy ANDERSON, Pina PICIERNO, Christel SCHALDEMOSE

Proposal for a regulation
Article 20 – paragraph 1

1. The Management Board, acting on a proposal by the Executive Director, shall set up a Permanent Stakeholders’ Group composed of recognised experts representing the relevant stakeholders, such as the ICT industry, providers of electronic communications networks or services available to the public, consumer groups, academic experts in the cybersecurity, the European Forum for Accreditation, conformity assessment bodies, and representatives of competent authorities notified under [Directive establishing the European Electronic Communications Code] as well as of law enforcement and data protection supervisory authorities.

Amendment 210 #

Proposal for a regulation
Article 20 – paragraph 1

1. The Management Board, acting on a proposal by the Executive Director, shall set up a Permanent Stakeholders’ Group composed of recognised security experts representing the relevant stakeholders, such as the European ICT industry, European providers of electronic communications networks or services available to the public, consumer groups, academic experts in the cybersecurity, and representatives of competent authorities notified under [Directive establishing the European Electronic Communications Code] as well as of law enforcement and data protection supervisory authorities.

Amendment 211 #

Proposal for a regulation
Article 20 – paragraph 1

1. The Management Board, acting on a proposal by the Executive Director, shall set up a Permanent Stakeholders’ Group composed of recognised experts representing the relevant stakeholders, such as the Union’s ICT industry, Union providers of electronic communications networks or services available to the public, consumer groups, academic experts in the cybersecurity, and representatives of competent authorities notified under [Directive establishing the European Electronic Communications Code] as well as of law enforcement and data protection supervisory authorities.

Amendment 212 #

Proposal for a regulation
Article 20 – paragraph 2

2. Procedures for the Permanent Stakeholders’ Group, in particular regarding the number, composition, and the appointment of its members by the Management Board, the proposal by the Executive Director and the operation of the Group, shall be specified in the Agency’s internal rules of operation and shall be made public. The procedures shall follow best practice in ensuring a fair representation and equal rights for all stakeholders and shall enforce a gender balanced approach.

Amendment 213 #

Evelyne GEBHARDT, Kerstin WESTPHAL, Lucy ANDERSON, Marc TARABELLA

Proposal for a regulation
Article 20 – paragraph 2 a (new)

2a. The composition of the Permanent Stakeholders’ Group shall include a minimum of five consumer organisations and civil society organisations.

Amendment 214 #

Proposal for a regulation
Article 20 – paragraph 4

4. The term of office of the Permanent Stakeholders’ Group’s members shall be two-and-a-half years. Members of the Management Board and of the Executive Board, except the Executive Director referred to in paragraph 3, may not be members of the Permanent Stakeholders’ Group. Experts from the Commission and the Member States shall be entitled to be present at the meetings of the Permanent Stakeholders’ Group and to participate in its work. Representatives of other bodies deemed relevant by the Executive Director, who are not members of the Permanent Stakeholders’ Group, may be invited to attend the meetings of the Permanent Stakeholders’ Group and to participate in its work.

Amendment 215 #

Proposal for a regulation
Article 20 – paragraph 5

5. The Permanent Stakeholders’ Group shall advise the Agency in respect of the performance of its activities. It shall in particular advise the Executive Director on drawing up a proposal for the Agency’s work programme, and on ensuring communication with the relevant stakeholders on all issues related to the work programme. It may also propose that the Commission request the Agency to prepare candidate European cybersecurity certification schemes in accordance with Article 44, either on its own initiative or following submission of proposals from relevant stakeholders.

Amendment 216 #

Proposal for a regulation
Article 20 – paragraph 5

5. The Permanent Stakeholders’ Group shall advise the Agency in respect of the performance of its activities. It shall in particular advise the Executive Director on drawing up a proposal for the Agency’s work programme, and on ensuring communication with the relevant stakeholders on all issues related to the work programme. It shall give its formal approval for any candidate certification scheme prepared by the Agency before being transmitted to the European Commission for endorsement.

Amendment 217 #

Proposal for a regulation
Article 20 – paragraph 5 a (new)

5a. The Permanent Stakeholders’ Group shall meet at least four times per year. The agenda for at least one of those meetings shall be dedicated to matters referred to in Articles 43 to 54 [Title III].

Amendment 218 #

Nicola DANTI, Maria GRAPINI, Sergio GUTIÉRREZ PRIETO, Lucy ANDERSON, Arndt KOHN, Pina PICIERNO, Marc TARABELLA

Proposal for a regulation
Article 20 – paragraph 5 a (new)

5a. It advises the Agency when the latter prepares candidate schemes.

Amendment 219 #

Proposal for a regulation
Article 23 – paragraph 2

2. The Agency shall ensure that the public and any interested parties are given appropriate, objective, reliable and easily accessible information, in particular with regard to the debates and the results of its work. It shall also make public the declarations of interest made in accordance with Article 22.

Amendment 220 #

Proposal for a regulation
Article 34 – paragraph 2

2. The Management Board shall adopt a decision laying down rules on the secondment to the agency of national experts, amongst others disallowing no- cost practices and promoting fair remuneration.

Amendment 221 #

Philippe JUVIN, Andreas SCHWAB

Proposal for a regulation
Article 41 – paragraph 2

2. The Agency’s host Member State shall provide the best possible conditions to ensure the proper functioning of the Agency, including the accessibility of the ~~location~~headquarters and other offices location by international airport, the existence of adequate education facilities for the children of staff members, appropriate access to the labour market, social security and medical care for both children and spouses.

Amendment 222 #

Proposal for a regulation
Article 43 – paragraph 1

A European cybersecurity certification scheme shall be established in order to boost the level of security within the digital single market and adopt a harmonised approach, at EU level, to European certification, with a view to ensuring that ICT products, services and systems are resistant to cyber-attacks. It shall attest that the ICT products and services that have been certified in accordance with such scheme comply with specified common requirements as regards their ability to resist at a given level of assurance, actions that aim to compromise the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the functions or services offered by, or accessible via, those products, processes, services and systems.

Amendment 223 #

Proposal for a regulation
Article 43 – paragraph 1

A European cybersecurity certification scheme shall attest that the ICT products, processes and services that have been certified in accordance with such scheme comply with specified requirements as regards their ability to resist at a given level of assurance, actions that aim to compromise the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the functions or services offered by, or accessible via, those products, processes, services and systemccording to standards, as regards their ability to meet specified security objectives.

Amendment 224 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Carlos COELHO

Proposal for a regulation
Article 43 – paragraph 1

A European cybersecurity certification scheme shall attest that the ICT hardware and software products and services that have been certified in accordance with such scheme comply with specified requirements as regards their ability to resist at a given level of risk-based assurance, actions that aim to compromise the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the functions or services offered by, or accessible via, those ~~products,~~hardware and software products, development and maintenance processes, services and systems.

Amendment 225 #

Proposal for a regulation
Article 43 – paragraph 1

A European cybersecurity certification scheme shall attest that the ICT products ~~and servic~~, services and processes that have been certified in accordance with such scheme comply with specified requirements and properties as regards their ability to resist at a given level of assurance, actions that aim to compromise the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the functions or services offered by, or accessible via, those products, processes, services and systems.

Amendment 226 #

Proposal for a regulation
Article 43 a (new)

Article 43a Security by design and by default 1. Taking into account the state of the art, producers and service providers shall ensure the security by design and by default of their ICT products and services. Manufacturers and service providers must ensure that the software running on their ICT product or service is secure and does not have any known security vulnerability considering the state of the art technology at the time. ICT products and services must implement the following technical measures: (a) ICT products and services must be provided with up to date software and must include mechanisms to receive secure, properly authenticated and trusted software updates on a regular basis; (b) remote access capabilities of the ICT product or service must be documented and secured against unauthorised access during the installation at the latest; (c) ICT products shall not have the same default hardcoded standard passwords for all devices; (d) Data stored by ICT products and services must be securely protected by state of the art methods such as encryption; (e) ICT products and services shall only accept high-security methods for authentication. 2. Manufacturers and service providers must notify the competent authority of any known security vulnerabilities as soon as they are discovered. In addition, they must provide a timely repair and/or replacement to overcome any new security vulnerability discovered. 3. ICT products and services placed on the market shall comply with the obligations in paragraph 1 during their foreseeable and normal period of use. 4. The Commission shall by means of implementing act, and in cooperation with ENISA, adopt detailed rules on the specificities of the security requirements provided in paragraph 1. 5. Where the market surveillance authorities have reasons to believe that the ICT product or service does not comply with the requirements laid down in this Regulation, they shall without delay require the relevant manufacturer or service provider to take appropriate corrective action to bring the product into compliance with those requirements, to withdraw the product from the market, or to recall it within a reasonable period, commensurate with the nature of the risk, as they may prescribe. 6. Where the manufacturer or service provider does not take adequate corrective action within the period referred to in paragraph 5, the market surveillance authorities shall take appropriate provisional measures to prohibit or restrict the product being made available on their national markets, to withdraw the product from that market or to recall it. 7. Market surveillance authorities shall organise appropriate checks on product compliance and oblige the manufacturers or service providers to recall non-compliant products from the market. When identifying the products that will be subject to compliance check, national certification authorities shall prioritise high risk products for consumers, products embedded with new technologies and/or products with high selling rates.

Amendment 227 #

Proposal for a regulation
Article 43 a (new)

Article 43a Working Plan In consultation with the Consultation Committee referred to in Article 44, the Commission shall, not later than six months after the Regulation enters into force and then every two years, establish a working plan which shall be made publicly available.

Amendment 228 #

Proposal for a regulation
Article 44 – paragraph 1

1. ~~Following a request from the Commission, ENISA~~Member States or the European Cybersecurity Certification Group (the 'Group') shall prepare a ~~candidate~~ European cybersecurity certification scheme which meets the requirements laid down by Member States that are set out in Articles 45, 46 and 47 of this Regulation. Member States or the European Cybersecurity Certification Group (the 'Group') established under Article 53 may propose the preparation of a candidate European cybersecurity certification scheme to the Commission.

Amendment 229 #

Proposal for a regulation
Article 44 – paragraph 1

1. Following a request from the Commission, ENISA shall prepare a candidate European cybersecurity certification scheme which meets the requirements set out in Articles 45, 46 and 47 of this Regulation. Member States or, Permanent Stakeholders’ Group, either on its own initiative or following submission of proposals from relevant stakeholders, and the European Cybersecurity Certification Group (the ‘Group’) established under Article 53 may propose the preparation of a candidate European cybersecurity certification scheme to the Commission.

Amendment 230 #

Proposal for a regulation
Article 44 – paragraph 1

Amendment 231 #

Proposal for a regulation
Article 44 – paragraph 1

1. Following a request from the Commission, ENISA shall prepare a candidate European ~~cyber~~IT security certification scheme which meets the requirements set out in Articles 45, 46 and 47 of this Regulation. Member States or, the European Cybersecurity Certification Group (the ‘Group’) established under Article 53 or the Permanent Stakeholders Group established under Article 20 may propose the preparation of a candidate European cybersecurity certification scheme to the Commission.

Amendment 232 #

Catherine STIHLER, Liisa JAAKONSAARI, Christel SCHALDEMOSE

Proposal for a regulation
Article 44 – paragraph 1 a (new)

1a. With the support of the European Commission and Members States, ENISA shall set up a Consultation Committee with balanced participation of the European Cybersecurity Certification group and all interested parties, such as industry, including SMEs, trade unions, standard development organisations, traders, retailers, importers or end- consumers, concerned with the ICT product, process or service in question. This Committee shall be involved in each stage of the preparation of a candidate European cybersecurity certification scheme, including the definition of its elements and assurance requirements. The Consultation committee shall be consulted at least before the elaboration of a candidate scheme, at least once when the first draft of a candidate scheme is available, and before the adoption of the implementing measures. The Consultation Committee can submit a request to ENISA for the preparation of a candidate European cyber security certification scheme, including to cover industry-led initiatives.

Amendment 233 #

Proposal for a regulation
Article 44 – paragraph 2

Amendment 234 #

Roberta METSOLA, Lara COMI, Carlos COELHO

Proposal for a regulation
Article 44 – paragraph 2

~~2. W~~Throughout then prepar~~ing~~ation of candidate schemes 2. referred to in paragraph 1 of this Article, ENISA shall consult all relevant stakeholders and closely cooperate with the Group. TRelevant stakeholders and the Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary. Where relevant, ENISA may also set up a stakeholder expert group, composed of members of the Permanent Stakeholders’ Group and any other relevant stakeholders with specific expertise in the field of a given candidate scheme, in order to provide further assistance and advice.

Amendment 235 #

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult all relevant stakeholders and closely cooperate with the Group in defining the security objectives of the candidate certification scheme in line with Article 45, which will lead to the compilation of a checklist of risks and corresponding cybersecurity features. The Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary.

Amendment 236 #

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult ~~all relevant stakeholders~~the Permanent Stakeholders’ Group, in particular the European standardisation organisations, and all other relevant stakeholders in a formal, standardised and transparent process, and closely cooperate with the Group. The Group and all other relevant stakeholders shall provide ENISA with the assistance and expert advice ~~required by ENISA~~ in relation to the preparation of the candidate scheme, including by providing opinions ~~where necessary~~.

Amendment 237 #

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult all relevant stakeholders in a formal, standardised, and transparent process and closely cooperate with the Group. The Group and all relevant stakeholders shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary.

Amendment 238 #

Lucy ANDERSON, Sergio GUTIÉRREZ PRIETO, Kerstin WESTPHAL, Marc TARABELLA, Christel SCHALDEMOSE, Liisa JAAKONSAARI

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult all relevant stakeholders and closely cooperate with the Group as well as with the consumer organisations, Article 29 Working Party and the European Data Protection Board. The Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary.

Amendment 239 #

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult all relevant stakeholders, including the relevant civil society representatives such as consumer organisations, and closely cooperate with the Group. The Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary.

Amendment 240 #

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall take into account already existing national and international standards. ENISA shall consult all relevant stakeholders and closely cooperate with the Group. The Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary.

Amendment 241 #

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult the Consultation Committee and all relevant stakeholders and closely cooperate with the Group. The Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary.

Amendment 242 #

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes ~~referred to in paragraph 1 of this Article~~, ENISA shall consult all relevant stakeholders and closely cooperate with the Group. The Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary.

Amendment 243 #

Roberta METSOLA, Lara COMI, Pascal ARIMONT, Andreas SCHWAB, Carlos COELHO

Proposal for a regulation
Article 44 – paragraph 2 a (new)

2a. ENISA shall coordinate the compilation of a checklist of risks associated with the hardware or software of the ICT product or service. The risks shall be matched with corresponding cybersecurity features to be included in the candidate European cybersecurity certification scheme.

Amendment 244 #

Catherine STIHLER, Liisa JAAKONSAARI

Proposal for a regulation
Article 44 – paragraph 2 a (new)

2a. The certification framework shall benefit from the expertise of Member States with a major track record as regards these strategic issues, with the backing of industries that have acquired significant experience in the area.

Amendment 245 #

Proposal for a regulation
Article 44 – paragraph 2 a (new)

2a. ENISA shall seek to align any candidate cybersecurity certification scheme, prepared pursuant to paragraph 1 of this Article, with relevant internationally recognised standards to the greatest extent possible.

Amendment 246 #

Proposal for a regulation
Article 44 – paragraph 2 a (new)

2a. ENISA shall observe professional secrecy with regard to all information obtained in carrying out its tasks under this Regulation.

Amendment 247 #

Roberta METSOLA, Lara COMI, Pascal ARIMONT, Andreas SCHWAB, Carlos COELHO

Proposal for a regulation
Article 44 – paragraph 2 b (new)

2b. The checklist prepared shall draw from Member States’ experience in designing and implementing cybersecurity certificates within their jurisdictions. A list of expected risks will be drawn up, analysed and depending on an assessment of the risk environment that the ICT software or hardware product or ICT service will eventually operate in as well as the expected end user.

Amendment 248 #

Proposal for a regulation
Article 44 – paragraph 3

3. ~~ENISA shall transmit~~Upon approval by the Group of the candidate European cybersecurity certification scheme, ENISA shall, after consulting the Permanent Stakeholders’ Group, transmit the candidate scheme prepared in accordance with paragraph 2 of this Article to the Commission.

Amendment 249 #

Proposal for a regulation
Article 44 – paragraph 3

3. ENISA shall transmit the ~~candidate~~ European cybersecurity certification scheme ~~prepared~~ultimately adopted by Member States in accordance with paragraph 2 of this Article to the Commission.

Amendment 250 #

Proposal for a regulation
Article 44 – paragraph 4

4. The Commission~~, based~~ shall consult all relevant stakeholders on the candidate scheme proposed by ENISA, and shall assess its suitability for meeting the objectives of the request and whether the scheme contributes to a high level of consumer and end-user protection and European competitiveness. Following a consultation and assessment, the Commission may adopt implementing acts, in accordance with Article 55(1), providing for European cybersecurity certification schemes for ICT products and services meeting the requirements of Articles 45, 46 and 47 of this Regulation.

Amendment 251 #

Nicola DANTI, Maria GRAPINI, Sergio GUTIÉRREZ PRIETO, Lucy ANDERSON, Arndt KOHN, Pina PICIERNO, Marc TARABELLA, Christel SCHALDEMOSE

Proposal for a regulation
Article 44 – paragraph 4

4. The Commission~~, based on the candidate scheme proposed by ENISA, may adopt implementing~~ is empowered to adopt delegated acts, in accordance with Article 55~~(1), providing for~~a, concerning the establishment of European cybersecurity certification schemes for ICT products and services meeting the requirements of Articles 45, 46 and 47 of this Regulation. When adopting those delegated acts, the Commission shall base the cybersecurity certification schemes for ICT products and services on any relevant candidate scheme proposed by ENISA.

Amendment 252 #

Proposal for a regulation
Article 44 – paragraph 4

4. The Commission, based on the candidate scheme proposed by ENISA, may adopt implementing acts, in accordance with Article 55(1), providing for European cybersecurity certification schemes for ICT products and services meeting the requirements of Articles 45, 46 and 47 of this Regulation. The Commission may consult the European Data Protection Board and take account of its view before adopting such implementing acts.

Amendment 253 #

Proposal for a regulation
Article 44 – paragraph 4

4. The Commission, based on the c~~andidate scheme proposed by ENISA, may~~ertification scheme transmitted by ENISA and adopted by Member States, may then adopt implementing acts, in accordance with Article 55(1), providing for European cybersecurity certification schemes for ICT products and services meeting the requirements of Articles 45, 46 and 47 of this Regulation.

Amendment 254 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Carlos COELHO

Amendment 255 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Carlos COELHO

Proposal for a regulation
Article 44 – paragraph 5

5. ENISA shall maintain a dedicated website providing information on, and publicity of, European cybersecurity certification schemes as well as candidate cybersecurity certification schemes in preparation.

Amendment 256 #

Proposal for a regulation
Article 44 – paragraph 5 a (new)

5a. ENISA requires a branch office in Brussels, to monitor the work on EU certification closely and to work in close contact with Commission and Parliament to establish European common standards on cybersecurity.

Amendment 257 #

Proposal for a regulation
Article 44 a (new)

Article 44a Working Programme 1. After consulting the Group and the Permanent Stakeholders’ Group, ENISA, as an addition to, or part of, its general working programme, shall, after approval by the Commission and in any event by ... [six months after the date of entry into force of this Regulation] and every two years thereafter, establish a working plan for the development of European cybersecurity certification schemes, which shall be made publicly available. The working plans shall set out, for the following two years, an indicative list of products, processes and services which are considered to be priorities for the adoption of European cybersecurity certification schemes. The working plan shall be amended by ENISA, where appropriate, after consulting the Commission, the Group and the Permanent Stakeholders’ Group in order to take into account, inter alia, the demands of the internal market.

Amendment 258 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Carlos COELHO

Proposal for a regulation
Article 45 – paragraph 1 – introductory part

A European cybersecurity certification scheme shall be so designed to take into account, as applicable, the following non- exhaustive list of security objectives:

Amendment 259 #

Proposal for a regulation
Article 45 – paragraph 1 – introductory part

A European cybersecurity certification scheme shall be so designed to take into account, a~~s applicable,~~t least the following security objectives, insofar as they are relevant:

Amendment 260 #

Proposal for a regulation
Article 45 – paragraph 1 – introductory part

A European cybersecurity certification scheme shall be so designed as to take into account, as applicable, the following security objectives:

Amendment 261 #

Proposal for a regulation
Article 45 – paragraph 1 – introductory part

A European cybersecurity certification scheme shall be so designed to take into account~~, as applicable,~~ the following security objectives:

Amendment 262 #

Proposal for a regulation
Article 45 – paragraph 1 – point a

(a) Confidentiality : protect data stored, transmitted or otherwise processed against accidental or unauthorised storage, processing, access or disclosure;

Amendment 263 #

Proposal for a regulation
Article 45 – paragraph 1 – point b

(b) Integrity : protect data stored, transmitted or otherwise processed against accidental or unauthorised destruction, accidental loss or alteration;

Amendment 264 #

Proposal for a regulation
Article 45 – paragraph 1 – point c

~~(c) ensure that authorised persons, programmes or machines can access exclusively the data, services or functions to which their access rights refer;~~deleted

Amendment 265 #

Proposal for a regulation
Article 45 – paragraph 1 – point c a (new)

(ca) protect and secure devices against spoofing and other forms of device mimicking;

Amendment 266 #

Proposal for a regulation
Article 45 – paragraph 1 – point d

~~(d) record which data, functions or services have been communicated, at what times and by whom;~~deleted

Amendment 267 #

Proposal for a regulation
Article 45 – paragraph 1 – point e

~~(e) ensure that it is possible to check which data, services or functions have been accessed or used, at what times and by whom;~~deleted

Amendment 268 #

Proposal for a regulation
Article 45 – paragraph 1 – point f

(f) ~~restore the availability and access to data, services and functions in a timely manner in the event of physical or technical incident~~Availability : promote accessibility of data, services and functions by authorised users;

Amendment 269 #

Proposal for a regulation
Article 45 – paragraph 1 – point g

(g) ensure that ICT products and services are provided with up to date software that does not contain known vulnerabilities critical to the assurance offered by the scheme, have been designed and implemented in such a way as to effectively limit the inclusion or introduction of vulnerabilities, and are provided mechanisms for secure software updates.

Amendment 270 #

Proposal for a regulation
Article 45 – paragraph 1 – point g

(g) ensure that ICT products and services are provided with up ~~to date software that~~dates, upgrades and patches, which does not contain known vulnerabilities, and ~~are provided mechanisms for secure software updates~~which must be offered during a reasonable lifecycle of the product or service to enable continuous protection.

Amendment 271 #

Proposal for a regulation
Article 45 – paragraph 1 – point g

(g) ensure that ICT products and services are provided with up -to -date hardware and software , that does not contain known vulnerabilities, and are provided with mechanisms for secure software updates., including automatic security updates;

Amendment 272 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Pascal ARIMONT, Carlos COELHO

Proposal for a regulation
Article 45 – paragraph 1 – point g

(g) ensure that ICT hardware and software products and services are provided with up to date software that does not contain known vulnerabilities, and are provided with mechanisms for secure software updates.

Amendment 273 #

Proposal for a regulation
Article 45 – paragraph 1 – point g

g) ensure that ICT products and services are provided with up to date software that does not contain known vulnerabilities or defects, and are provided mechanisms for secure software updates.

Amendment 274 #

Catherine STIHLER, Liisa JAAKONSAARI, Christel SCHALDEMOSE, Arndt KOHN, Lucy ANDERSON

Proposal for a regulation
Article 45 – paragraph 1 – point g a (new)

(ga) ensure that ICT products and services are developed and operated in accordance with appropriate security standards and policies and that the highest appropriate level of cybersecurity and data protection is preconfigured by default into products, services and processes.

Amendment 275 #

Proposal for a regulation
Article 45 – paragraph 1 – point g a (new)

(ga) ensure that ICT products and services are developed according to the principle of ‘security by design’, following a risk-based approach depending on the context and severity of the situation as defined in Article 46.

Amendment 276 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Carlos COELHO

Proposal for a regulation
Article 46 – title

Risk-Based Assurance levels of European cybersecurity certification schemes

Amendment 277 #

Proposal for a regulation
Article 46 – title

~~Assurance level~~Security requirements of European cybersecurity certification schemes

Amendment 278 #

Proposal for a regulation
Article 46 – paragraph 1

1. A European cybersecurity certification scheme may specify ~~one or more of the following assurance levels: basic, substantial and/or high, for~~distinct assurance levels for ICT products and services issued under that scheme. Those levels shall be distinguished on the basis of the degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product~~s and~~ or service~~s issued under that scheme~~, characterised with reference to standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of cybersecurity incidents.

Amendment 279 #

Proposal for a regulation
Article 46 – paragraph 1

1. ~~A European cybersecurity certification scheme may specify one or more of the following assurance levels: basic, substantial and/or high, for ICT products and services issued under that~~ In consultation with relevant stakeholders, ENISA shall identify or develop assurance levels to be specified in European cybersecurity certification schemes.

Amendment 280 #

Proposal for a regulation
Article 46 – paragraph 1

1. A European cybersecurity certification scheme may specify one or more ~~of the following assurance levels: basic, substantial and/or high, for ICT products and~~assurance requirements based on the risk and threats determined by the context in which the product, process or services is~~sued under that schem~~ to operate.

Amendment 281 #

Proposal for a regulation
Article 46 – paragraph 1

1. A European cybersecurity certification scheme may specify one or more of the following ~~assurance level~~security requirements: basic, substantial and/or high, for ICT products and services issued under that scheme. The security requirements shall be defined following a risk-based approach and taking into account the intended use of the ICT product or service.

Amendment 282 #

Nicola DANTI, Evelyne GEBHARDT, Maria GRAPINI, Sergio GUTIÉRREZ PRIETO, Lucy ANDERSON, Arndt KOHN, Kerstin WESTPHAL, Pina PICIERNO, Marc TARABELLA, Christel SCHALDEMOSE

Proposal for a regulation
Article 46 – paragraph 1

1. AEach European cybersecurity certification scheme may specify one or more of the following assurance levels~~: basic~~ - “functionally secure”, “substantially secure” and/or “high,ly secure” - for ICT products and services issued under that scheme, taking into account, inter alia, their intended use and their inherent risk.

Amendment 283 #

Roberta METSOLA, Lara COMI

Proposal for a regulation
Article 46 – paragraph 1

1. AEach European cybersecurity certification scheme may specify one or more of the following assurance levels~~: basic~~ - “functionally secure”, “substantial ~~and/or high~~ly secure”, “highly secure”, for ~~ICT products and services issued under that schem~~a combination thereof - for cybersecurity certificates issued under that scheme, taking into account, inter alia, their intended use.

Amendment 284 #

Proposal for a regulation
Article 46 – paragraph 1

1. A European cybersecurity certification scheme may specify one or more of the following assurance levels: ~~basic~~elemental, substantial and/or high, for ICT hardware and software products and services issued under that scheme.

Amendment 285 #

Roberta METSOLA, Lara COMI, Andreas SCHWAB, Jiří POSPÍŠIL

Proposal for a regulation
Article 46 – paragraph 1

~~more of the following assurance levels: basic, substantial and/or high, for ICT products and services issued under that scheme. basic, substantial and/or high.~~

Amendment 286 #

Nicola DANTI, Maria GRAPINI, Sergio GUTIÉRREZ PRIETO, Lucy ANDERSON, Arndt KOHN, Catherine STIHLER, Pina PICIERNO, Marc TARABELLA, Christel SCHALDEMOSE

Proposal for a regulation
Article 46 – paragraph 1 a (new)

1a. Each scheme shall indicate the assessment methodology or evaluation process that is to be followed for issuing certificates at each assurance level, depending on the intended use and the risk inherent to the ICT products and services under that scheme.

Amendment 287 #

Proposal for a regulation
Article 46 – paragraph 1 a (new)

1a. A European cybersecurity certification scheme shall specify whether self-declaration of conformity is permissible or third party assessment strictly required.

Amendment 288 #

Proposal for a regulation
Article 46 – paragraph 2

2. The assurance levels basic, substantial and high shall meet the following criteria respectively: (a) assurance level basic shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a limited degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of cybersecurity incidents; (b) assurance level substantial shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a substantial degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of cybersecurity incidents; (c) assurance level high shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a higher degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service than certificates with the assurance level substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent cybersecurity incidents.deleted

Amendment 289 #

Proposal for a regulation
Article 46 – paragraph 2

Amendment 290 #

Proposal for a regulation
Article 46 – paragraph 2 – introductory part

2. ~~The assurance levels basic, substantial and high shall meet the following criteria respectively:~~A European cybersecurity certification scheme shall specify whether self-declaration of conformity is permitted and/or third party assessment is required.

Amendment 291 #

Roberta METSOLA, Eva MAYDELL, Lara COMI

Proposal for a regulation
Article 46 – paragraph 2 – introductory part

2. The risk-based assurance levels ~~basic~~elemental, substantial and high shall meet the following criteria respectively:

Amendment 292 #

Proposal for a regulation
Article 46 – paragraph 2 – introductory part

2. The ~~assurance level~~security requirements basic, substantial and high shall meet the following criteria respectively:

Amendment 293 #

Proposal for a regulation
Article 46 – paragraph 2 – point a

Amendment 294 #

Arndt KOHN, Evelyne GEBHARDT, Kerstin WESTPHAL, Pina PICIERNO, Christel SCHALDEMOSE

Proposal for a regulation
Article 46 – paragraph 2 – point a

Amendment 295 #

Proposal for a regulation
Article 46 – paragraph 2 – point a

(a) assurance level basic shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a limited degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of cybersecurity inciden“functionally secure” shall be related to a low risk of an ICT product and service. A low level of risk exists when an attack on the ICT product and service does not compromise the confidentiality, integrity, availability, privacy or other important objectives, nor the health of users or third parties, the environment, other important legal interests or critical infrastructure and its supporting systems or products;.

Amendment 296 #

Roberta METSOLA, Lara COMI

Proposal for a regulation
Article 46 – paragraph 2 – point a

(a) assurance level ~~basic~~“functionally secure” shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a ~~limi~~n adequated degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of cybersecurity incidents; where a European cybersecurity certification scheme includes certification of a cybersecurity process by a manufacturer, that certification of a cybersecurity process may include granting permission to a manufacturer for a self-declaration of ICT products or services conformity to the “functionally secure” assurance level;

Amendment 297 #

Proposal for a regulation
Article 46 – paragraph 2 – point a

(a) risk-based assurance level ~~basic~~elemental shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a ~~limited~~n essential minimum degree of confidence and security in the event of common cyber-security threats faced by predominantly consumer products in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of cybersecurity incidents;

Amendment 298 #

Proposal for a regulation
Article 46 – paragraph 2 – point a

(a) ~~assurance level~~security requirement basic shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a limited degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of cybersecurity incidents;

Amendment 299 #

Proposal for a regulation
Article 46 – paragraph 2 – point b

Amendment 300 #

Arndt KOHN, Evelyne GEBHARDT, Kerstin WESTPHAL, Pina PICIERNO, Christel SCHALDEMOSE

Proposal for a regulation
Article 46 – paragraph 2 – point b

Amendment 301 #

Proposal for a regulation
Article 46 – paragraph 2 – point b

(b) assurance level “substantial shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a substantial degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of cybersecurity incidenly secure” shall be related to a higher risk of an ICT product and service. A higher level of risk exists when an attack on the ICT product and service compromises the confidentiality, integrity, availability, privacy or other important objectives, and has implications to the health of users or third parties, the environment, other important legal interests or critical infrastructure and its supporting systems or products;.

Amendment 302 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Carlos COELHO

(b) risk-based assurance level substantial shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a substantial degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls that are generally used at industry level, the purpose of which is to decrease substantially the risk of cybersecurity incidents;

Amendment 303 #

Proposal for a regulation
Article 46 – paragraph 2 – point b

(b) ~~assurance level~~security requirement substantial shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a substantial degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of cybersecurity incidents;

Amendment 304 #

Proposal for a regulation
Article 46 – paragraph 2 – point c

Amendment 305 #

Arndt KOHN, Evelyne GEBHARDT, Kerstin WESTPHAL, Pina PICIERNO, Christel SCHALDEMOSE

Proposal for a regulation
Article 46 – paragraph 2 – point c

Amendment 306 #

Proposal for a regulation
Article 46 – paragraph 2 – point c

(c) assurance level “high ~~shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a higher degree of confidence in the claimed or asserted cybersecurity qualities~~ly secure” shall be related to a high risk of an ICT product and service. A high level of risk exists when an attack ofn an ICT product orand service than certificates with the assurance level substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent cybercompromises the confidentiality, integrity, availability, privacy or other important objectives and reasonably endangers the national sovereignty or public security ~~incident~~of states.

Amendment 307 #

Liisa JAAKONSAARI, Christel SCHALDEMOSE, Lucy ANDERSON

Proposal for a regulation
Article 46 – paragraph 2 – point c

(c) assurance level high shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a higher degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service than certificates with the assurance level substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent cybersecurity incidents. This assurance level must not suggest absolute security, so as not to mislead the end-user.

Amendment 308 #

Proposal for a regulation
Article 46 – paragraph 2 – point c

(c) ~~assurance level~~security requirement high shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a higher degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service than certificates with the ~~assurance level~~security requirement substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent cybersecurity incidents. This shall especially apply to critical infrastructure products and services.

Amendment 309 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Carlos COELHO

Proposal for a regulation
Article 46 – paragraph 2 – point c

(c) risk-based assurance level high shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a higher degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service than certificates with the assurance level substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls that are generally used at industrial level, the purpose of which is to prevent cybersecurity incidents.

Amendment 310 #

Roberta METSOLA, Lara COMI, Carlos COELHO

Proposal for a regulation
Article 46 – paragraph 2 – point c

(c) assurance level “highly secure” shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a higher degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service than certificates with the assurance level “substantially secure”, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent cybersecurity incidents.

Amendment 311 #

Proposal for a regulation
Article 46 – paragraph 2 a (new)

2a. The risk-based assurance level for a candidate European cybersecurity certification scheme shall be identified on the basis of the risks identified in the checklist established in Article 44(2) and the availability of cybersecurity measures to counter those risks in the ICT hardware and software products and services to which the certification scheme applies.

Amendment 312 #

Philippe JUVIN, Andreas SCHWAB

Proposal for a regulation
Article 46 – paragraph 2 a (new)

2a. As regards assurance levels substantial and high, the ethical hacking method may be used by national conformity control bodies.

Amendment 313 #

Roberta METSOLA, Lara COMI, Antonio LÓPEZ-ISTÚRIZ WHITE, Carlos COELHO

Proposal for a regulation
Article 46 – paragraph 2 b (new)

2b. The characteristics identified in the risk-based assurance level elemental in Article 46(2) are the minimum cybersecurity measures acceptable for consumer products. The characteristics identified in the risk-based assurance levels substantial and high are the minimum cybersecurity measures acceptable for ICT hardware and software products and services used on an industrial scale. These general characteristics should not restrict ENISA, following consultation with the Member States and the Permanent Stakeholders’ Group from selecting a higher risk-based assurance level than is strictly required following a thorough assessment.

Amendment 314 #

Proposal for a regulation
Article 47 – title

Elements of European cybersecurity ~~certification~~ schemes

Amendment 315 #

Proposal for a regulation
Article 47 – paragraph 1 – introductory part

1. AThe following elements shall be considered when preparing a European cybersecurity certification scheme ~~shall include the following elements~~:

Amendment 316 #

Proposal for a regulation
Article 47 – paragraph 1 – introductory part

1. A European cybersecurity certification scheme shall include one or more of the following elements:

Amendment 317 #

Roberta METSOLA, Lara COMI, Eva MAYDELL, Carlos COELHO

Proposal for a regulation
Article 47 – paragraph 1 – introductory part

1. A European cybersecurity certification scheme shall include at least the following elements:

Amendment 318 #

Proposal for a regulation
Article 47 – paragraph 1 – introductory part

1. A European cybersecurity ~~certification~~ scheme shall include the following elements:

Amendment 319 #

Proposal for a regulation
Article 47 – paragraph 1 – point a

(a) subject-matter and scope of the certification scheme, including the type or categories of ICT products, processes and services covered, such certification being specific to one or more sector(s) or applying on a horizontal basis;

Amendment 320 #

Roberta METSOLA, Lara COMI, Pascal ARIMONT, Carlos COELHO

Proposal for a regulation
Article 47 – paragraph 1 – point a

(a) subject-matter and scope of the certification, including the type or categories of ICT hardware and software products and services covered;

Amendment 321 #

Proposal for a regulation
Article 47 – paragraph 1 – point b

(b) detailed specification of the cybersecurity requirements against which the specific ICT products and services are evaluated, ~~for example~~ by reference to ~~Union or inter~~international, European or national standards or technical specifications followed in the evaluation and certification process;

Amendment 322 #

Roberta METSOLA, Lara COMI, Pascal ARIMONT, Carlos COELHO

Proposal for a regulation
Article 47 – paragraph 1 – point b

(b) detailed specification of the cybersecurity requirements against which the specific ICT hardware and software products and services are evaluated, for example by reference to Union or international standards or technical specifications;

Amendment 323 #

Proposal for a regulation
Article 47 – paragraph 1 – point b

(b) detailed specification of the cybersecurity requirements against which the specific ICT products and services are evaluated, for example by reference to ~~Union or~~ international or European standards or technical specifications;

Amendment 324 #

Proposal for a regulation
Article 47 – paragraph 1 – point b

(b) detailed specification of the cybersecurity requirements against which the specific ICT products and services are evaluated, ~~for example by~~with particular reference to ~~Union or~~ international standards or technical specifications;

Amendment 325 #

Proposal for a regulation
Article 47 – paragraph 1 – point b a (new)

(ba) detailed specification if a granted certification can apply to only an individual product or can be applied to a product range [different versions/models of the same base product structure];

Amendment 326 #

Proposal for a regulation
Article 47 – paragraph 1 – point b a (new)

(ba) relevance of promoting “security by design”;

Amendment 327 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Carlos COELHO

Proposal for a regulation
Article 47 – paragraph 1 – point c

Amendment 328 #

Proposal for a regulation
Article 47 – paragraph 1 – point c

Amendment 329 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Jiří POSPÍŠIL

Proposal for a regulation
Article 47 – paragraph 1 – point c a (new)

(ca) the applicable conformity assessment procedure and/or self- declaration of conformity

Amendment 330 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Carlos COELHO

Proposal for a regulation
Article 47 – paragraph 1 – point c b (new)

(cb) certification requirements defined in a way that certification can be incorporated into or based on the producer’s systematic cybersecurity processes followed during the design, development and lifecycle of the ICT product or service;

Amendment 331 #

Proposal for a regulation
Article 47 – paragraph 1 – point e

(e) in relation to the scheme’s third- party certification option referred to in Article 47a(2)(b), information to be supplied to the conformity assessment bodies by an applicant which is necessary for certification;

Amendment 332 #

Proposal for a regulation
Article 47 – paragraph 1 – point f

~~(f) where the scheme provides for marks or labels, the conditions under which such marks or labels may be used;~~deleted

Amendment 333 #

Roberta METSOLA, Lara COMI, Pascal ARIMONT, Carlos COELHO

Proposal for a regulation
Article 47 – paragraph 1 – point f

(f) where the scheme provides for marks or labels, such an EU Cybersecurity Conformity Label signifying that the ICT product or service conforms to the criteria of a European cybersecurity certificate scheme, the conditions under which such marks or labels may be used;

Amendment 334 #

Proposal for a regulation
Article 47 – paragraph 1 – point g

Amendment 335 #

Proposal for a regulation
Article 47 – paragraph 1 – point g

(g) where surveillance is part of the scheme, the rules for monitoring compliance with the requirements of the certificates, including mechanisms to demonstrate the continued compliance with the specified cybersecurity requirements, where relevant and possible also through obligatory updates, upgrades or patches of the concerned ICT product or service. For all ICT products and services with substantial and high security requirements, surveillance shall be mandatory on a regular basis;

Amendment 336 #

Proposal for a regulation
Article 47 – paragraph 1 – point g

(g) where surveillance is part of the scheme, the rules for monitoring compliance with the requirements of the certificates, including, where applicable, mechanisms to demonstrate the continued compliance with the specified cybersecurity requirements;

Amendment 337 #

Proposal for a regulation
Article 47 – paragraph 1 – point h

~~(h) conditions for granting, maintaining, continuing, extending and reducing the scope of certification;~~deleted

Amendment 338 #

Lucy ANDERSON, Marc TARABELLA, Christel SCHALDEMOSE, Liisa JAAKONSAARI

Proposal for a regulation
Article 47 – paragraph 1 – point h

(h) conditions for granting, maintaining, continuing, renewing, extending and reducing the scope of certification;

Amendment 339 #

Proposal for a regulation
Article 47 – paragraph 1 – point h a (new)

(ha) The certification scheme shall specify the conditions for recertification or assessment of a product or service. This is of particular importance for software services possessing continuous security and update features, such as patches, for which a rapid assessment or re-certification is necessary in order to avoid detrimental impacts on that product or service’s overall security.

Amendment 340 #

Arndt KOHN, Sergio GUTIÉRREZ PRIETO, Pina PICIERNO, Christel SCHALDEMOSE

Proposal for a regulation
Article 47 – paragraph 1 – point h a (new)

(ha) the specific cases for recertification of an ICT product and service shall be defined in the corresponding certification scheme. Security and feature updates with reference to any security measures need to follow an assessment and, if necessary, a recertification process;

Amendment 341 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Dita CHARANZOVÁ

Proposal for a regulation
Article 47 – paragraph 1 – point i

~~(i) rules concerning the consequences of non-conformity of certified ICT products and services with the certification requirements;~~deleted

Amendment 342 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Carlos COELHO

Proposal for a regulation
Article 47 – paragraph 1 – point i

(i) rules concerning the consequences of non-conformity of certified ICT hardware and software products and services with the certification requirements, including general information about the penalties to be incurred as laid down in Article 54 of this Regulation;

Amendment 343 #

Roberta METSOLA, Lara COMI, Pascal ARIMONT, Carlos COELHO

Proposal for a regulation
Article 47 – paragraph 1 – point j

(j) ~~rules~~the requirement that an ICT hardware or software product trader or service provider has procedures and rules in place concerning how previously undetected cybersecurity vulnerabilities in ICT hardware and software products and services are to be reported and dealt with;

Amendment 344 #

Proposal for a regulation
Article 47 – paragraph 1 – point j

(j) rules ~~concerning how previously undetected cybersecurity vulnerabilities in ICT products and services are to be reported and dealt with;~~requiring vulnerabilities in ICT products and services that are not publicly known to be reported expeditiously by the appropriate authorities to relevant vendors and manufacturers using a coordinated vulnerability disclosure process.

Amendment 345 #

Proposal for a regulation
Article 47 – paragraph 1 – point j

(j) rules ~~concerning how previously undetected cybersecurity vulnerabilities in ICT products and services are to be reported and dealt with~~requiring vulnerabilities in ICT products and services that are not publicly known to be reported expeditiously by the appropriate authorities to relevant vendors and manufacturers using a coordinated vulnerability disclosure process;

Amendment 346 #

Proposal for a regulation
Article 47 – paragraph 1 – point j

j) rules concerning how previously undetected cybersecurity vulnerabilities or defects in ICT products and services are to be reported and dealt with;

Amendment 347 #

Proposal for a regulation
Article 47 – paragraph 1 – point j

(j) rules concerning how previously undetected cybersecurity vulnerabilities in ICT products and services are to be ~~reported and~~ dealt with;

Amendment 348 #

Proposal for a regulation
Article 47 – paragraph 1 – point k

(k) in relation to the scheme’s third- party certification option referred to in Article 47a(2)(b), rules concerning the retention of records by conformity assessment bodies;

Amendment 349 #

Proposal for a regulation
Article 47 – paragraph 1 – point l

(l) identification of national or international cybersecurity certification schemes covering the same type or categories of ICT products ~~and service~~, services, processes, security requirements and evaluation criteria and methods;

Amendment 350 #

Roberta METSOLA, Eva MAYDELL, Lara COMI

Proposal for a regulation
Article 47 – paragraph 1 – point l

(l) identification of national cybersecurity certification schemes or industry-led methods covering the same type or categories of ICT hardware and software products and services;

Amendment 351 #

Proposal for a regulation
Article 47 – paragraph 1 – point l

(l) identification of national cybersecurity certification or self- assessment schemes covering the same type orf categories of ICT products and services; and

Amendment 352 #

Proposal for a regulation
Article 47 – paragraph 1 – point l

(l) identification of national or international cybersecurity certification schemes covering the same type or categories of ICT products and services;

Amendment 353 #

Proposal for a regulation
Article 47 – paragraph 1 – point l a (new)

(la) identification of existing international mutual recognition agreements and certifications;

Amendment 354 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Dita CHARANZOVÁ

Proposal for a regulation
Article 47 – paragraph 1 – point m a (new)

(ma) governance mechanism for updating, amending and coordinating particular certification schemes, in particular detailed specification on how a certification scheme is to be amended in light of additional security threats, once they become known;

Amendment 355 #

Proposal for a regulation
Article 47 – paragraph 1 – point m a (new)

(ma) Rules concerning how and when Member States are to inform each other when they acquire knowledge of a vulnerability that is not publicly known in an ICT product or service that is certified under this certification scheme.

Amendment 356 #

Proposal for a regulation
Article 47 – paragraph 1 – point m a (new)

(ma) a mechanism and tools to efficiently manage minor version releases(s) or security updates (e.g. in relation to patching);

Amendment 357 #

Proposal for a regulation
Article 47 – paragraph 1 – point m a (new)

(ma) the maximum period of validity of certificates.

Amendment 358 #

Proposal for a regulation
Article 47 – paragraph 1 – point m a (new)

(ma) the period of validity of issued certificates.

Amendment 359 #

Roberta METSOLA, Eva MAYDELL, Lara COMI

Proposal for a regulation
Article 47 – paragraph 1 – point m a (new)

(ma) the period of validity of the certificate

Amendment 360 #

Proposal for a regulation
Article 47 – paragraph 1 – point m b (new)

(mb) resistance and resilience testing for the “highly secure” and “substantially secure” assurance levels;

Amendment 361 #

Proposal for a regulation
Article 47 – paragraph 1 – point m c (new)

(mc) where necessary, applicable self- declaration procedures for the “functionally secure” assurance level;

Amendment 362 #

1a. a mechanism and tools to efficiently manage minor version releases(s) or security updates (for example in relation to patching);

Amendment 363 #

Proposal for a regulation
Article 47 – paragraph 2

2. The specified requirements of the scheme shall not contradict any applicable legal ~~requirements, in particular~~ requirements emanating from harmonised Union legislation.

Amendment 364 #

Proposal for a regulation
Article 47 – paragraph 3

3. Where a specific Union act so provides, certification under a European cybersecurity certification scheme may be used as an alternative means to demonstrate the presumption of conformity with requirements of that act.

Amendment 365 #

Proposal for a regulation
Article 47 – paragraph 4 a (new)

4a. Schemes created pursuant to this Regulation shall not require notification of changes, amendments of certifications, or recertification, unless such changes have a substantial adverse effect on the security of ICT products and services. This includes: (a) A reduction in the scope of a certificate; (b) Enhancements to the priorities referred to in Article 45; (c) Software updates, as referred to in Article 45(c); and (d) Any other measure intended to address previously undetected cybersecurity vulnerabilities referred to in Article 45(c).

Amendment 366 #

Proposal for a regulation
Article 47 a (new)

Article 47a First- and third-party assessment 1. A European cybersecurity scheme shall provide options for both self- assessment and third-party certification, as described in paragraphs 2(a) and 2(b) respectively. 2. The manufacturer or provider of ICT products and services may freely decide whether the assessment and certification of such products or services under a European cybersecurity scheme should be undertaken by: (a) the manufacturer or provider itself (“self-assessment”); or (b) a conformity assessment body referred to in Article 51 (“third-party certification”).

Amendment 367 #

Roberta METSOLA, Pascal ARIMONT, Antonio LÓPEZ-ISTÚRIZ WHITE, Lara COMI, Carlos COELHO

Proposal for a regulation
Article 48 – paragraph 1

1. ICT products and services that have been certified under a European cybersecurity certification scheme adopted pursuant to Article 44 shall be presumed to be compliant with the requirements of such scheme. This might include obligatory updates, upgrades or patches where relevant and possible.

Amendment 368 #

Proposal for a regulation
Article 48 – paragraph 1

1. ICT hardware and software products and services that have been certified under a European cybersecurity certification scheme adopted pursuant to Article 44 shall be presumed to be compliant with the requirements of such scheme.

Amendment 369 #

Proposal for a regulation
Article 48 – paragraph 1

1. ICT products ~~and servic~~, services and processes that have been certified under a European cybersecurity certification scheme adopted pursuant to Article 44 shall be presumed to be compliant with the requirements of such scheme.

Amendment 370 #

Proposal for a regulation
Article 48 – paragraph 2

2. The certification shall be mandatory for those products and services that fall under a high security requirement. For all other ICT products and services, certification shall be voluntary, unless otherwise specified in Union law.

Amendment 371 #

Proposal for a regulation
Article 48 – paragraph 2

2. The certification shall be voluntary mandatory, unless otherwise specified in Union law.

Amendment 372 #

Proposal for a regulation
Article 48 – paragraph 2

2. The certification shall be voluntary~~, unless otherwise specified in Union law~~.

Amendment 373 #

Proposal for a regulation
Article 48 – paragraph 2

2. The certification shall be voluntary~~, unless otherwise specified in Union law~~.

Amendment 374 #

Proposal for a regulation
Article 48 – paragraph 2

2. The certification shall be ~~volunta~~mandatory, unless otherwise specified in Union law.

Amendment 375 #

Proposal for a regulation
Article 48 – paragraph 3

3. A European cybersecurity certificate pursuant to this Article shall be issued either by self-declaration of conformity, or by the conformity assessment bodies referred to in Article 51 on the basis of criteria included in the European cybersecurity certification scheme, adopted pursuant to Article 44. For ICT products and services with high security requirements, the European cybersecurity certificate shall be issued by the conformity assessment bodies referred to in Article 51, without the possibility of self-declaration of conformity.

Amendment 376 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Antonio LÓPEZ-ISTÚRIZ WHITE, Jiří POSPÍŠIL

Proposal for a regulation
Article 48 – paragraph 3

3. A European cybersecurity certificate pursuant to this Article shall be either subject to a declaration of conformity by a manufacturer or service provider or issued by the conformity assessment bodies referred to in Article 51 on the basis of criteria included in the European cybersecurity certification scheme, adopted pursuant to Article 44. Where a scheme offers more than one level of assurance, it may choose a combination of methods to determine compliance with the scheme.

Amendment 377 #

Proposal for a regulation
Article 48 – paragraph 3

3. A European cybersecurity certificate pursuant to this Article shall be issued either by self-declaration of conformity or by the conformity assessment bodies referred to in Article 51 on the basis of criteria included in the European cybersecurity certification scheme, adopted pursuant to Article 44.

Amendment 378 #

Proposal for a regulation
Article 48 – paragraph 3 a (new)

3a. Where a European certification scheme requires a manufacturer or service provider to draw up a declaration of conformity, these shall be kept by the manufacturer or service provider and provided to the national certification supervisory authorities upon request. By drawing up the declaration of conformity, the manufacturer shall assume responsibility for compliance with the requirements of the Scheme.

Amendment 379 #

Proposal for a regulation
Article 48 – paragraph 4 – introductory part

4. By the way of derogation from paragraph 3, in duly justified cases a particular European cybersecurity certification scheme may provide that a European cybersecurity certificate resulting from that scheme can only be issued by a public body. Such public body shall be one of the following:

Amendment 380 #

Proposal for a regulation
Article 48 – paragraph 4 – introductory part

Amendment 381 #

Proposal for a regulation
Article 48 – paragraph 5

5. The natural or legal person which submits its ICT products or, services or processes to the certification mechanism shall provide the conformity assessment body referred to in Article 51 with all information necessary to conduct the certification procedure, including information on any known security vulnerabilities.

Amendment 382 #

Roberta METSOLA, Lara COMI, Andreas SCHWAB, Antonio LÓPEZ-ISTÚRIZ WHITE, Carlos COELHO

Proposal for a regulation
Article 48 – paragraph 6

6. Certificates shall be issued for a maximum period ~~of three years and~~as deemed appropriate for each scheme, which shall not be less than 24 months where those are issued by a conformity assessment body. Certificates may be renewed, under the same conditions, provided that the relevant requirements continue to be met. Certificates shall not become invalid following the provision of updates or other changes in hardware or software versions where the requirements of Article 47(1)(j) are complied with.

Amendment 383 #

Proposal for a regulation
Article 48 – paragraph 6

6. Certificates shall be issued and shall remain valid for a maximum period defined in each cybersecurity certification scheme according to Article 47(1)(n) and depending on the risk environment, the hardware and/or software product or services’ expected uses for a maximum period of three years and may be renewed, under the same conditions, provided that the relevant requirements continue to be met.

Amendment 384 #

Proposal for a regulation
Article 48 – paragraph 6

6. Certificates shall be issued for ~~a maximum period of three years and may be renewed, under the same conditions, provided that the relevant~~the period established in the relevant European cybersecurity certification scheme and may be renewed, under the same conditions, provided that the requirements of that European cybersecurity certification scheme, including any revised or amended requirements, continue to be met.

Amendment 385 #

Roberta METSOLA, Lara COMI, Andreas SCHWAB, Antonio LÓPEZ-ISTÚRIZ WHITE, Carlos COELHO

Proposal for a regulation
Article 48 – paragraph 6

6. Certificates shall be issued for a maximum period of t~~hree years~~ime as defined by the European cybersecurity certification scheme and may be renewed, under the same conditions, provided that the relevant requirements continue to be met.

Amendment 386 #

Proposal for a regulation
Article 48 – paragraph 6 a (new)

6a. A European cybersecurity certification scheme shall remain valid for all new versions, patches, fixes, updates, etc. issued by the ICT hardware or software product or service trader and/or manufacturer to address security vulnerabilities that have been addressed through the trader and/or manufacturer’s procedures as defined under Article 47(1)(j).

Amendment 387 #

Proposal for a regulation
Article 48 – paragraph 6 a (new)

6a. In particular, a certificate shall remain valid for all new versions of a product or service, where the primary reason for the new version is to patch, fix, or otherwise address known or potential security vulnerabilities or threats.

Amendment 388 #

Proposal for a regulation
Article 48 – paragraph 7 a (new)

7a. For substantial and high insurance levels, an independent-expert group made up of experts from national certification supervisory authorities and ENISA should be set up. That expert group will be responsible for auditing all national conformity assessment bodies with a view to checking their expertise and skills, thus guaranteeing that European certification systems are adopted uniformly throughout all the Member States.

Amendment 389 #

Proposal for a regulation
Article 48 – paragraph 7 b (new)

7b. That expert group shall have at least the following powers: - to ask for any information from national conformity assessment bodies and holders of European cybersecurity certificates; - to check compliance with the requirements laid down in Title III of this Regulation; - to take appropriate measures to ensure that national conformity assessment bodies and holders of European cybersecurity certificates comply with the European cybersecurity certification system; - to access the premises of national conformity assessment bodies and holders of European certificates in accordance with the Member States’ law and EU law; - to revoke certificates that do not comply with this Regulation or a European cybersecurity certification scheme; - to revoke the accreditation of national conformity assessment bodies which do not comply with this Regulation.

Amendment 390 #

Proposal for a regulation
Article 48 a (new)

Article 48 a Baseline IT security requirements 1. The agency shall, by ... [two years after the date of entry into force of this regulation], propose to the Commission clear and mandatory baseline IT security requirements for all IT devices sold in or exported from the Union such as: (a) the manufacturer providing a written certification that the device does not contain any hardware, software or firmware component with any known security vulnerabilities; (b) the device relies on software or firmware components capable of accepting properly authenticated and trusted updates from the vendor; (c) documented remote access capabilities of the device that are secured against unauthorized access during the installation at the latest; no default hardcoded standard passwords for all devices, a documented possibility for updates which clearly points out responsibilities in case the user does not update the device; (d) an obligation of the manufacturer of the internet-connected device, software, or firmware component to notify the competent authority of any known security vulnerabilities; (e) an obligation of the manufacturer of the internet-connected device, software, or firmware component to provide a repair in respect to any new security vulnerability discovered; (f) an obligation of the manufacturer of the internet-connected device, software, or firmware component to provide information on how the device receives updates, the anticipated timeline for ending security support and a notification when such security support has ended. g) an obligation of the manufacturer to release the source code and documentation after the end of support date; 2. The Agency shall review and, where necessary, amend the requirements referred to in paragraph 1 every two years, and submit any amendments as proposals to the Commission. 3. The Commission may, by way of implementing acts, decide that the proposed or amended requirements referred to in paragraphs 1 and 2 have general validity within the Union. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 55(2). 4. The Commission shall ensure appropriate publicity for the requirements which have been decided as having general validity in accordance with paragraph 3. 5. The Agency shall collate all proposed requirements and their amendments in a register and shall make them publicly available by way of appropriate means. 6. While manufacturers are responsible for ensuring product compliance of an ICT product or service, importers must make sure that the products they place on the market comply with the applicable requirements and do not present a risk to the European public. The importer has to verify that the manufacturer outside the EU has taken the necessary steps and that the product or service complies with the provisions of paragraph 1. Distributors of ICT products or services must have a basic knowledge of the legal requirements and the accompanying documentation. Distributors should be able to identify products that are clearly not in compliance. They must also be able to demonstrate to national authorities that they have acted with due care and have affirmation from the manufacturer or the importer that the necessary measures have been taken. Furthermore, a distributor must be able to assist national authorities in their efforts to receive the required documentation.

Amendment 391 #

Proposal for a regulation
Article 48 a (new)

Article 48a Compatibility with international mutual recognition schemes 1. In the preparatory phase of a candidate European cyber security certification scheme, ENISA, and as appropriate, the Consultation Committee shall evaluate the relevance of existing international mutual recognition agreement and certifications. 2. In accordance with Article 49(5), this should include an evaluation of whether any national cyber security certification schemes covered by the candidate scheme are subject to an international mutual recognition agreement. 3. Where relevant international mutual recognition agreements and certifications are determined to exist, the ENISA shall aim to ensure compatibility by : (a) predicating the certification on the same standards (b) aligning the scope, security objectives, evaluation methodology and assurance levels, (c) opening a dialogue with the equivalent governance body with a view to joining the mutual recognition agreement, where feasible.

Amendment 392 #

Proposal for a regulation
Article 49 – paragraph 1

1. Without prejudice to paragraph 3, national cybersecurity certification schemes and the related procedures for the ICT products and services covered by a European cybersecurity certification scheme shall cease to produce effects from the date established in the implementing act adopted pursuant Article 44(4). Where a European cybersecurity certification has replaced a national scheme, certificates issued under the European scheme shall be accepted as valid in cases where certification under a national scheme was required. Existing national cybersecurity certification schemes and the related procedures for the ICT products and services not covered by a European cybersecurity certification scheme shall continue to exist.

Amendment 393 #

Proposal for a regulation
Article 49 – paragraph 1

1. Without prejudice to paragraph 3, national cybersecurity certification schemes and the related procedures for the ICT products and services covered by a European cybersecurity certification scheme ~~shall cease to produce effects from the date established in the implementing act adopted pursuant Article 44(4). Existing~~, with the exception of cases involving the processing of classified information, national ~~cyber~~security ~~certification schemes and~~, or public supply contracts pertaining the re~~lated procedures for the ICT products and services not covered by a European cybersecurity certification scheme shall continue to exist~~to, shall cease to produce effects from the date established in the implementing act adopted pursuant Article 44(4).

Amendment 394 #

Nicola DANTI, Maria GRAPINI, Sergio GUTIÉRREZ PRIETO, Lucy ANDERSON, Arndt KOHN, Catherine STIHLER, Pina PICIERNO, Marc TARABELLA

Proposal for a regulation
Article 49 – paragraph 1

1. Without prejudice to paragraph 3, national cybersecurity certification schemes and the related procedures for the ICT products and services covered by a European cybersecurity certification scheme shall cease to produce effects from the date established in the implementing act adopted pursuant Article 44(4). The Commission shall monitor compliance with this subparagraph, in order to avoid the existence of concurrent schemes. Existing national cybersecurity certification schemes and the related procedures for the ICT products and services not covered by a European cybersecurity certification scheme shall continue to exist.

Amendment 395 #

Proposal for a regulation
Article 49 – paragraph 1

1. Without prejudice to paragraph 3, national cybersecurity certification schemes and the related procedures for the ICT products ~~and servic~~, services and processes covered by a European cybersecurity certification scheme shall cease to produce effects from the date established in the implementing act adopted pursuant Article 44(4). Existing national cybersecurity certification schemes and the related procedures for the ICT products and services not covered by a European cybersecurity certification scheme shall continue to exist.

Amendment 396 #

Proposal for a regulation
Article 49 – paragraph 1 a (new)

1a. The national authorities responsible for cybersecurity certification may be in a position to issue high-level certificates;

Amendment 397 #

Proposal for a regulation
Article 49 – paragraph 2

~~2. Member States shall not introduce new national cybersecurity certification schemes for ICT products and services covered by a European cybersecurity certification scheme in force.~~deleted

Amendment 398 #

Proposal for a regulation
Article 49 – paragraph 2

2. Member States shall not introduce new national cybersecurity certification schemes for ICT products and services covered by a European cybersecurity certification scheme in force. Existing cybersecurity certification schemes shall be entitled to be recognized at the EU level, following an assessment by ENISA.

Amendment 399 #

Proposal for a regulation
Article 49 – paragraph 2

2. Member States shall not introduce new national cybersecurity certification schemes for ICT products, processes and services covered by a European cybersecurity certification scheme in force.

Amendment 400 #

Proposal for a regulation
Article 49 – paragraph 2

2. Member States shall not introduce new national cybersecurity certification schemes for ICT products ~~and servic~~, services and processes covered by a European cybersecurity certification scheme in force.

Amendment 401 #

Proposal for a regulation
Article 49 – paragraph 3

3. Existing certificates issued under national cybersecurity certification schemes ~~shall remain valid until their expiry date~~and covered by a European cyber security certification scheme shall remain valid until their expiry date. Maintenance processes that lead to minor updates shall not invalidate the certification.

Amendment 402 #

Proposal for a regulation
Article 49 – paragraph 3

3. Existing certificates issued under national cybersecurity certification schemes covered by a European cybersecurity certification scheme shall remain valid until their expiry date.

Amendment 403 #

Proposal for a regulation
Article 49 – paragraph 3

3. Existing certificates issued under national cybersecurity certification schemes and covered by a European cybersecurity certification scheme shall remain valid until their expiry date.

Amendment 404 #

Proposal for a regulation
Article 49 – paragraph 3 a (new)

3a. Where national cybersecurity schemes are recognised under international mutual recognition arrangement(s) for the purpose of security certification, they shall cease to exist only when the European certification scheme qualifies for recognition under the same international arrangement(s) or when the Commission deems the international mutual recognition arrangement to be no longer necessary.

Amendment 405 #

Proposal for a regulation
Article 49 – paragraph 3 a (new)

3a. Until an equivalent European scheme is adopted, existing certificates delivered according to national schemes could benefit from recognition under Article 48(7) provided they have been previously thoroughly assessed by ENISA to meet specific cyber security requirements.

Amendment 406 #

Proposal for a regulation
Article 49 – paragraph 3 a (new)

3a. The Member States remain free to set additional certification requirements where they enable strategic content or activities that fall entirely under their sovereign powers to be secured.

Amendment 407 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Antonio LÓPEZ-ISTÚRIZ WHITE, Jiří POSPÍŠIL

Proposal for a regulation
Article 49 – paragraph 3 b (new)

3b. Where national cybersecurity schemes are recognised under international mutual recognition arrangement(s) for security certification, they shall only cease to exist when the European certification scheme qualifies for recognition under the same international arrangement(s).

Amendment 408 #

Nicola DANTI, Evelyne GEBHARDT, Maria GRAPINI, Sergio GUTIÉRREZ PRIETO, Lucy ANDERSON, Arndt KOHN, Pina PICIERNO, Marc TARABELLA, Christel SCHALDEMOSE

Proposal for a regulation
Article 50 – paragraph 3

3. Each national certification supervisory authority shall, in its organisation, funding decisions, legal structure and decision-making, be independent of the entities they supervise and shall not be a conformity assessment body or a national accreditation body.

Amendment 409 #

Proposal for a regulation
Article 50 – paragraph 6 – point a

(a) monitor and enforce the application of the provisions under this Title at national level and supervise and verify the compliance of the self-declarations of conformity and the cybersecurity certificates that have been issued by conformity assessment bodies established in their respective territories with the requirements set out in this Title and in the corresponding European cybersecurity certification scheme in accordance with the rules adopted by the European Cybersecurity Certification Group pursuant to Article 53(3)(ba);

Amendment 410 #

Roberta METSOLA, Lara COMI, Eva MAYDELL, Pascal ARIMONT, Antonio LÓPEZ-ISTÚRIZ WHITE, Jiří POSPÍŠIL, Carlos COELHO

Proposal for a regulation
Article 50 – paragraph 6 – point a

(a) monitor and enforce the application of the provisions under this Title at national level and supervise compliance of the certificates that have been issued by conformity assessment bodies established in their respective territories with the requirements set out in this Title and in the corresponding European cybersecurity certification scheme or any self- declaration of conformity issued under a scheme for a product or service with a "functionally secure" assurance level;

Amendment 411 #

Proposal for a regulation
Article 50 – paragraph 6 – point b

(b) monitor ~~and~~, supervise and assess the activities of conformity assessment bodies for the purpose of this Regulation, including in relation to the notification of conformity assessment bodies and the related tasks set out in Article 52 of this Regulation;

Amendment 412 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Antonio LÓPEZ-ISTÚRIZ WHITE

Proposal for a regulation
Article 50 – paragraph 6 – point b a (new)

(ba) scrutinise self-declarations of conformity, and monitor, supervise and assess the activities of firms that issue them for the purpose of this Regulation;

Amendment 413 #

Roberta METSOLA, Lara COMI, Antonio LÓPEZ-ISTÚRIZ WHITE

Proposal for a regulation
Article 50 – paragraph 6 – point b b (new)

(bb) report the results of verifications under point (a) and the assessments under points (b) and (c) to the European Cybersecurity Certification Group and to ENISA;

Amendment 414 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Antonio LÓPEZ-ISTÚRIZ WHITE, Jiří POSPÍŠIL

Proposal for a regulation
Article 50 – paragraph 6 – point c

(c) handle complaints lodged by natural or legal persons in relation to certificates issued by conformity assessment bodies established in their territories or any self-declaration of conformity issued under a scheme for a product or service with a "functionally secure" assurance level in relation to certificates issued by conformity assessment bodies established in their territories, investigate, to the extent appropriate, the subject matter of the complaint, and inform the complainant of the progress and the outcome of the investigation within a reasonable time period;

Amendment 415 #

Proposal for a regulation
Article 50 – paragraph 6 – point c

(c) handle complaints lodged by natural or legal persons in relation to certificates issued by self-declaration and by conformity assessment bodies established in their territories, investigate, to the extent appropriate, the subject matter of the complaint, and inform the complainant of the progress and the outcome of the investigation within a reasonable time period;

Amendment 416 #

Proposal for a regulation
Article 50 – paragraph 6 – point c

Amendment 417 #

Proposal for a regulation
Article 50 – paragraph 6 – point d

(d) cooperate with other national certification supervisory authorities or other public authorities, including by sharing information on possible non- compliance, including deceptive, false, or fraudulent claims of certification, of ICT products ~~and~~, services or processes with the requirements of this Regulation or specific European cybersecurity certification schemes;

Amendment 418 #

Proposal for a regulation
Article 50 – paragraph 6 – point d

(d) cooperate with other national certification supervisory authorities or other public authorities, including by sharing information on ~~possible non- compliance of~~ ICT products, processes and services ~~with the requirements of this Regulation or~~that make false claims of certification against specific European cybersecurity certification schemes;

Amendment 419 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Pascal ARIMONT, Antonio LÓPEZ-ISTÚRIZ WHITE, Carlos COELHO

Proposal for a regulation
Article 50 – paragraph 7 – point c a (new)

(ca) - to revoke the accreditation of the national conformity assessment bodies referred to in Article 51 which do not comply with this Regulation;

Amendment 420 #

Proposal for a regulation
Article 50 – paragraph 7 – point e

(e) to withdraw, in accordance with national law, certificates that are not compliant with this Regulation or a European cybersecurity certification scheme and inform national accreditation bodies accordingly;

Amendment 421 #

Proposal for a regulation
Article 50 – paragraph 7 – point f a (new)

(fa) to suggest experts who could be part of the independent expert group referred to in Article 48(8).

Amendment 422 #

Proposal for a regulation
Article 50 – paragraph 7 a (new)

7a. National accreditation bodies shall establish procedures for internal audits. The internal audits shall be performed at least once a year. However, where a national accreditation body can demonstrate that its management system has been effectively implemented and is stable, the internal audits may be performed less frequently.

Amendment 423 #

Proposal for a regulation
Article 50 – paragraph 8

8. National certification supervisory authorities shall cooperate amongst each other and the Commission and, in particular, exchange information, experiences and good practices as regards cybersecurity certification and technical issues concerning cybersecurity of ICT products ~~and servic~~, services and processes.

Amendment 424 #

Proposal for a regulation
Article 50 – paragraph 8

Amendment 425 #

Proposal for a regulation
Article 50 a (new)

Article 50a Peer Review 1. National accreditation bodies shall be subject to peer evaluation in respect of any activity which they carry out related to the assessment and monitoring of conformity assessment bodies which have been accredited pursuant to Article 51. 2. Peer evaluations shall cover the assessments that have been carried out by national accreditation bodies of the entire or partial operations of conformity assessment bodies. That assessment shall include the competence of personnel, the correctness of the test and the inspection methodology, and the correctness of test results based on adopted cybersecurity certification schemes. 3. A Member State shall provide the Commission, ENISA, the Group and, upon request, the other Member States with information on its procedures for the assessment, designation and notification of technical services and for the monitoring of conformity assessment bodies, and of any changes thereto. 4. The Commission may, by means of implementing acts, lay down a model for the provision of information on the procedures referred to in paragraph 3 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 55. 5. Peer evaluation of national accreditation bodies shall be carried out by the national accreditation bodies of two other Member States, at least once every five years. ENISA may participate in the peer evaluation and shall decide on its participation on the basis of a risk assessment analysis. The evaluation shall be carried out under the responsibility of the evaluated accreditation body and shall include an on-site visit at a conformity assessment body elected in the discretion of the peer evaluation team. 6. Taking into account the views of the Group, the Commission may, by means of implementing acts, establish a plan for the peer evaluations covering a period of at least five years, laying down criteria concerning the composition of the peer evaluation team, the methodology used for the evaluation, the schedule, periodicity and the other tasks related to the evaluation. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 55. 7. The outcome of the peer evaluations shall be examined by the Group. ENISA shall draw up a summary of the outcome and shall make it public.

Amendment 426 #

Proposal for a regulation
Article 51 – paragraph 1

1. The conformity assessment bodies shall be accredited by the national accreditation body named pursuant to Regulation (EC) No 765/2008 ~~only when they meet the requirements set out in the Annex to this Regulation.~~;

Amendment 427 #

Proposal for a regulation
Article 51 – paragraph 1 a (new)

1a. The national accreditation body shall be responsible for the assessment, designation, notification and monitoring of conformity assessment bodies, including, where appropriate, the subcontractors or subsidiaries of those conformity assessment bodies.

Amendment 428 #

Roberta METSOLA, Lara COMI, Antonio LÓPEZ-ISTÚRIZ WHITE, Jiří POSPÍŠIL

Proposal for a regulation
Article 51 – paragraph 2 a (new)

2a. Where a conformity assessment body believes preliminary assessment results of a product, service or process suggest deceptive, false, or fraudulent claims or representations, the conformity assessment body shall inform the national certification supervisory authority. The national certification supervisory authority may authorise the conformity assessment body to require the submission of further additional information pursuant to Article 48(5) before the granting of a certification. Where deemed absolutely necessary, this may include disclosure of the source code of products or services.

Amendment 429 #

Proposal for a regulation
Article 51 – paragraph 2 a (new)

2a. Where manufacturers opt for ‘self- declaration of conformity’ as established in Article 48(3) of this Regulation, conformity assessment bodies will take additional steps to verify the internal procedures undertaken by the manufacturer to ensure that their products and/or services conform with the requirements of the European cybersecurity certification scheme.

Amendment 430 #

Roberta METSOLA, Lara COMI, Pascal ARIMONT, Antonio LÓPEZ-ISTÚRIZ WHITE

Proposal for a regulation
Article 51 a (new)

Article 51 a Peer-Review Assessment 1. National accreditation bodies shall subject themselves to peer evaluation coordinated by ENISA. 2. Member States shall ensure that their national accreditation bodies periodically undergo peer evaluation. 3. Peer evaluation shall be conducted based on a set of transparent evaluation criteria and procedures that include structural resources, human resources, certification conformity procedures, confidentiality and complaints. National accreditation bodies shall have recourse to appeal procedures against decisions taken as a result of this peer evaluation. 4. Peer evaluation shall ascertain whether the national accreditation bodies meet the requirements enshrined in Regulation 765/2008/EC. 5. ENISA shall publish and communicate the outcome of the peer evaluation exercises to all Member States and to the Commission. 6. Together with Member States, the commission shall oversee the rules and the proper functioning of the peer evaluation system.

Amendment 431 #

Roberta METSOLA, Lara COMI, Pascal ARIMONT, Antonio LÓPEZ-ISTÚRIZ WHITE, Carlos COELHO

Proposal for a regulation
Article 52 – paragraph 1

1. For each European cybersecurity certification scheme adopted pursuant Article 44, national certification supervisory authorities shall notify the Commission of the accredited conformity assessment bodies accredited to issue certificates at specified ~~assurance level~~security requirements as referred to in Article 46 and, without undue delay, of any subsequent changes thereto.

Amendment 432 #

Proposal for a regulation
Article 53 – paragraph 3 – point a a (new)

(aa) to provide ENISA with strategic guidance and to establish a work programme including the common actions to be undertaken at EU level to ensure the consistent application of this Title across all Member States;

Amendment 433 #

Roberta METSOLA, Eva MAYDELL, Lara COMI, Pascal ARIMONT, Antonio LÓPEZ-ISTÚRIZ WHITE, Carlos COELHO

Proposal for a regulation
Article 53 – paragraph 3 – point a b (new)

(ab) to establish and periodically update a priority list of ICT products and services that urgently require an EU cybersecurity certification scheme;

Amendment 434 #

Roberta METSOLA, Lara COMI, Pascal ARIMONT, Antonio LÓPEZ-ISTÚRIZ WHITE, Carlos COELHO

Proposal for a regulation
Article 53 – paragraph 3 – point b a (new)

(ba) to adopt binding rules determining the intervals at which national certification supervisory authorities are to carry out verifications of certificates and the criteria, scale and scope of these verifications and to adopt common rules and standards for reporting, in accordance with Article 50(6).

Amendment 435 #

Proposal for a regulation
Article 53 – paragraph 3 – point c

(c) to ~~propose to the Commission that it~~ requests the Agency to prepare a candidate European cybersecurity certification scheme in accordance with Article 44 of this Regulation;

Amendment 436 #

Catherine STIHLER, Sergio GUTIÉRREZ PRIETO, Liisa JAAKONSAARI

Proposal for a regulation
Article 53 – paragraph 3 – point d

(d) to adopt ~~opin~~recommendations addressed to the Commission relating to the maintenance and review of existing European cybersecurity certifications schemes;

Amendment 437 #

Proposal for a regulation
Article 53 – paragraph 3 – point f a (new)

(fa) to facilitate the alignment of European cybersecurity certification schemes with internationally recognised standards, including by: i) on an ongoing basis, reviewing existing European cybersecurity certification schemes to identify areas in which such schemes should be updated or modified to align with internationally recognised standards; ii) when appropriate, making recommendations to ENISA on areas where it should undertake engagement with relevant international standardisation organisations to address insufficiencies or gaps in available internationally recognised standards;

Amendment 438 #

Proposal for a regulation
Article 53 – paragraph 3 – point f a (new)

(fa) to decide on the composition of the independent-expert group referred to in Article 48(8) of this Regulation.

Amendment 439 #

Proposal for a regulation
Article 53 – paragraph 4

~~4. The Commission shall chair the Group and provide the secretariat to it, with the assistance of ENISA as provided for in Article 8(a).~~deleted

Amendment 440 #

Proposal for a regulation
Article 53 – paragraph 4 – subparagraph 1 a (new)

ENISA shall ensure that the agenda, minutes and a record of decisions taken are registered and that published versions of those documents are made available to the public on the ENISA website after each meeting of the Group.

Amendment 441 #

Proposal for a regulation
Article 55 – paragraph 2

2. Where reference is made to this paragraph, Article 45 of Regulation (EU) No 182/2011 shall apply.

Amendment 442 #

Nicola DANTI, Maria GRAPINI, Sergio GUTIÉRREZ PRIETO, Arndt KOHN, Pina PICIERNO, Marc TARABELLA

Proposal for a regulation
Article 55 a (new)

Article 55a Exercise of the delegation The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article. The power to adopt delegated acts referred to in Article 44(4) shall be conferred on the Commission for a period of 5 years from [date of entry into force of the basic legislative act]. The Commission shall draw up a report in respect of the delegation of power not later than nine months before the end of the 5 year period. The delegation of power shall be tacitly extended for periods of an identical duration, unless the European Parliament or the Council opposes such extension not later than three months before the end of each period. The delegation of power referred to in Article 44(4) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council. A delegated act adopted pursuant to Article 44(4) shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of [two months] of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by[two months] at the initiative of the European Parliament or of the Council.

Amendment 443 #

Proposal for a regulation
Annex I – paragraph 1 – point 2

2. A conformity assessment body shall be a third-party body independent of the organisation or the ICT products or, services or processes it assesses.

Amendment 444 #

Nicola DANTI, Evelyne GEBHARDT, Maria GRAPINI, Sergio GUTIÉRREZ PRIETO, Lucy ANDERSON, Arndt KOHN, Kerstin WESTPHAL, Pina PICIERNO, Marc TARABELLA, Christel SCHALDEMOSE

Proposal for a regulation
Annex I – paragraph 1 – point 3

3. A body belonging to a business association or professional federation representing undertakings involved in the design, manufacturing, provision, assembly, use or maintenance of ICT products or services which it assesses, may, on condition that its independence and the absence of any conflict of interest are demonstrated, be considered a conformity assessment body.Deleted

Amendment 445 #

Proposal for a regulation
Annex I – paragraph 1 – point 9 – introductory part

9. At all times and for each conformity assessment procedure and each kind, category or sub-category of ICT products or, services, or processes a conformity assessment body shall have at its disposal the necessary:

Amendment 52 #

Proposal for a regulation
Title

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on ENISA, the “EU ~~Cybers~~Network and Information Security Agency”, and repealing Regulation (EU) 526/2013, and on Information and Communication Technology ~~cyber~~IT security certification (“~~Cybers~~IT Security Act”) (Text with EEA relevance) (This amendment applies throughout the text. Adopting it will necessitate corresponding changes throughout.)

Amendment 53 #

Proposal for a regulation
Recital 1

(1) Network and information systems and telecommunications networks and services play a vital role for society and have become the backbone of economic growth. Information and communications technology (ICT) underpins the complex systems which support everyday societal activities, keep our economies running in key sectors such as health, energy, finance and transport, and in particular support the functioning of the internal market.

Amendment 54 #

Liisa JAAKONSAARI, Christel SCHALDEMOSE, Lucy ANDERSON

Proposal for a regulation
Recital 2

Amendment 55 #

Amendment 56 #

Proposal for a regulation
Recital 3

Amendment 57 #

Proposal for a regulation
Recital 3

(3) Increased digitisation and connectivity lead to considerably increased cybersecurity risks, thus making society at large more vulnerable to cyber threats and exacerbating dangers faced by individuals, including vulnerable persons such as children. In order to mitigate this risk to society, all necessary actions need to be taken to improve cybersecurity in the EU to better protect network and information systems, telecommunication networks, digital products, services and devices used by citizens, governments and business – from SMEs to operators of critical infrastructures – from cyber threats.

Amendment 58 #

Proposal for a regulation
Recital 4

Amendment 59 #

Proposal for a regulation
Recital 5

(5) In light of the increased cybersecurity challenges faced by the Union, there is a need for a comprehensive set of measures that would build on previous Union action and foster mutually reinforcing objectives. These include the need to further increase capabilities and preparedness of Member States and businesses, as well as to improve cooperation and coordination across Member States and EU institutions, agencies and bodies. Furthermore, given the borderless nature of cyber threats, there is a need to increase capabilities at Union level that could complement the action of Member States, in particular in the case of large scale cross-border cyber incidents and crises. Additional efforts are also needed to increase awareness of citizens and businesses on cybersecurity issues. Moreover, ~~the trust in the digital single marke~~given that cyber incidents undermine trust in digital service providers and in the digital single market itself, especially among consumers, trust should be further improved by offering transparent information on the level of security of ICT products and services. This can be facilitated by EU- wide certification providing common cybersecurity requirements and evaluation criteria across national markets and sectors. Alongside Union-wide certification, there are a range of voluntary measures that the private sector itself should take to bolster trust in the security of ICT products and services, in particular in view of the growing availability of IoT devices. For example, more effective use should be made of encryption and other technologies as well as technologies to prevent successful cyber-attacks, in order to improve the security of end-users’ data and communications and the overall security of network and information systems in the Union.

Amendment 60 #

Proposal for a regulation
Recital 5

Amendment 61 #

Proposal for a regulation
Recital 5

Amendment 62 #

Proposal for a regulation
Recital 5 a (new)

(5a) Protection against cyber-attacks is an overarching security issue, with Member States assuming responsibility for security assessment and sharing with the Union responsibility for management of the area of freedom, security and justice (Article 4 TFEU). In view of the implications of cybersecurity in terms of national security, this is largely a question of national sovereignty. For this reason, the role of Member States and hence the national certification authorities should be more than just an advisory one within the European single certification framework. Given their expertise in this area, the Member States should play a substantial part in the new cybersecurity certification system.

Amendment 63 #

Proposal for a regulation
Recital 5 a (new)

(5a) While certification and other forms of conformity assessment for ICT products, services, and processes plays an important role, improving cybersecurity requires a multi-faceted approach spanning people, processes, and technologies. The EU must also continue to strongly emphasise and promote other efforts including cybersecurity education, training, and skills development; raising awareness at corporate executive and board-levels; promoting voluntary cyber threat information sharing; and shifting the EU from a reactive to a proactive approach to responding to threats by emphasising the prevention of successful cyber-attacks.

Amendment 64 #

Proposal for a regulation
Recital 11

(11) Given the increasing cybersecurity threats and challenges the Union is facing, the financial and human resources allocated to the Agency should be increased to reflect its enhanced role and tasks, and its critical position in the ecosystem of organisations defending the European digital ecosystem.

Amendment 65 #

Proposal for a regulation
Recital 21 a (new)

(21a) The Commission is called upon to introduce mandatory cooperation provisions between Member States to ensure the protection of vital infrastructure.

Amendment 66 #

Proposal for a regulation
Recital 28

(28) The Agency should contribute towards raising the awareness of the public about risks related to cybersecurity and provide guidance on good practices for individual users aimed at citizens and organisations. The Agency should also contribute to promote cyber-hygiene best practices and solutions at the level of individuals and organisations by collecting and analysing publicly available information regarding significant incidents, and by compiling reports with a view to providing guidance to businesses and citizens and improving the overall level of preparedness and resilience. The Agency should furthermore organise, in cooperation with the Member States and the Union institutions, bodies, offices and agencies regular outreach and public education campaigns directed to end-users, aiming at promoting safer individual online behaviour and raising awareness of potential threats in cyberspace, including cybercrimes such as phishing attacks, botnets, financial and banking fraud, as well as promoting basic multi-factor authentication, patching, encryption, and access management principles and data protection advice. The Agency should play a central role in accelerating end-user awareness on security of devices. The Agency should encourage all end users to take appropriate steps to prevent and minimise the impact of incidents affecting the security of their networks and information systems.

Amendment 67 #

Proposal for a regulation
Recital 28

(28) The Agency should contribute towards raising the awareness of the public about risks related to ~~cyber~~IT security and provide guidance on good practices for individual users aimed at citizens and organisations. The Agency should also contribute to promote best practices and solutions at the level of individuals and organisations by collecting and analysing publicly available information regarding significant incidents, and by compiling ~~report~~and publishing reports and guides with a view to providing guidance to businesses and citizens and improving the overall level of preparedness and resilience. The Agency should furthermore organise, in cooperation with the Member States and the Union institutions, bodies, offices and agencies regular outreach and public education campaigns directed to end-users, aiming at promoting safer individual online behaviour and raising awareness of potential threats in cyberspace, including cybercrimes such as phishing attacks, botnets, financial and banking fraud, as well as promoting ~~basic~~ authentication, encryption, anonymisation and data protection advice. The Agency should play a central role in accelerating end-user awareness on security of devices and popularising at EU level security-by- design, privacy-by-design and the incidents and their solutions.

Amendment 68 #

Liisa JAAKONSAARI, Christel SCHALDEMOSE, Lucy ANDERSON, Arndt KOHN

Proposal for a regulation
Recital 28

Amendment 69 #

Proposal for a regulation
Recital 28

Amendment 70 #

Liisa JAAKONSAARI, Christel SCHALDEMOSE, Lucy ANDERSON, Arndt KOHN

Proposal for a regulation
Recital 28 a (new)

(28a) The Agency should promote mainstreaming the security by design principle, which is paramount to improving the security of connected devices. Security by design is especially important for devices targeted at vulnerable end-users, such as children.

Amendment 71 #

Proposal for a regulation
Recital 30

(30) To ensure that it fully achieves its objectives, the Agency should liaise with relevant institutions, agencies and bodies, including CERT-EU, European Cybercrime Centre (EC3) at Europol, European Defence Agency (EDA), European Agency for the operational management of large-scale IT systems (eu- LISA), European Aviation Safety Agency (EASA) and any other EU Agency that is involved in ~~cyber~~IT security. It should also liaise with authorities dealing with data protection in order to exchange know-how and best practices and provide advice on ~~cyber~~IT security aspects that might have an impact on their work. Representatives of national and Union law enforcement and data protection authorities should be eligible to be represented in the Agency’s Permanent Stakeholders Group. In liaising with law enforcement bodies regarding network and information security aspects that might have an impact on their work, the Agency should respect existing channels of information and established networks. Partnerships should be established with academic institutions that have research initiatives in the relevant areas, while the input from consumer organisations and other organisations should have appropriate channels and be always analysed.

Amendment 72 #

Liisa JAAKONSAARI, Lucy ANDERSON

Proposal for a regulation
Recital 33

(33) The Agency should ~~further develop and maintain its expertise on cybersecurity certification with a view to supporting the Union policy in this field. The Agency should promote the uptake of cybersecurity~~promote the use of certification while avoiding the fragmentation caused by lack of coordination between existing certification ~~with~~schemes in the Union~~, including by~~. The Agency should contribut~~ing~~e to the establishment and maintenance of a cybersecurity certification framework at Union level in accordance with Articles 43 to 54 [Title III], with a view to increasing the transparency of cybersecurity assurance of ICT products and services and thus strengthening trust in the digital sin~~ternal~~gle market.

Amendment 73 #

Proposal for a regulation
Recital 35

(35) The Agency should encourage Member States and service providers to raise their general security standards so that all internet users can take the necessary steps to ensure their own personal cybersecurity. In particular, service providers and product manufacturers should withdraw or recycle products and services that do not meet cybersecurity standards. In cooperation with competent authorities, ENISA may disseminate information regarding the level of cybersecurity of the products and services offered in the internal market, and issue warnings targeting providers and manufacturers and requiring them to improve the security, including cybersecurity, of their products and services. Any providers or manufacturers receiving a warning regarding the level of cybersecurity of their products should be made public on a dedicated portal.

Amendment 74 #

Proposal for a regulation
Recital 35

Amendment 75 #

Proposal for a regulation
Recital 41

(41) In order for the Agency to function properly and effectively, the Commission and the Member States should ensure that persons to be appointed to the Management Board have appropriate professional expertise and experience in functional areas. The Commission and the Member States should also make efforts to limit the turnover of their respective Representatives on the Management Board in order to ensure continuity in its work. Due to the high market value of the skills required in the Agency work, it is necessary to ensure that the salaries and the social conditions offered to all Agency staff are competitive and ensure that the best professionals can choose to work there.

Amendment 76 #

Proposal for a regulation
Recital 41

Amendment 77 #

Proposal for a regulation
Recital 42

(42) The smooth functioning of the Agency requires that its Executive Director be appointed on grounds of merit and documented administrative and managerial skills, as well as competence and experience relevant for ~~cyber~~IT security, and that the duties of the Executive Director be carried out with complete independence. The Executive Director should prepare a proposal for the Agency’s work programme, after prior consultation with the Commission, and take all necessary steps to ensure the proper execution of the work programme of the Agency. The Executive Director should prepare an annual report to be submitted to the Management Board, draw up a draft statement of estimates of revenue and expenditure for the Agency, and implement the budget. Furthermore, the Executive Director should have the option of setting up ad hoc Working Groups to address specific matters, in particular of a scientific, technical, legal or socioeconomic nature. The Executive Director should ensure that the ad hoc Working Groups’ members are selected according to the highest standards of expertise, taking due account of a representative and gender balance, as appropriate according to the specific issues in question, between the public administrations of the Member States, the Union institutions and the private sector, including industry, users, and academic experts in network and information security.

Amendment 78 #

Proposal for a regulation
Recital 42

(42) The smooth functioning of the Agency requires that its Executive Director be appointed on grounds of merit and documented administrative and managerial skills, as well as competence and experience relevant for cybersecurity, and that the duties of the Executive Director be carried out with complete independence. The Executive Director should prepare a proposal for the Agency’s work programme~~, after prior consultation with the Commission,~~ and take all necessary steps to ensure the proper execution of the work programme of the Agency. The Executive Director should prepare an annual report to be submitted to the Management Board, draw up a draft statement of estimates of revenue and expenditure for the Agency, and implement the budget. Furthermore, the Executive Director should have the option of setting up ad hoc Working Groups to address specific matters, in particular of a scientific, technical, legal or socioeconomic nature. The Executive Director should ensure that the ad hoc Working Groups’ members are selected according to the highest standards of expertise, taking due account of a representative balance, as appropriate according to the specific issues in question, between the public administrations of the Member States, the Union institutions and the private sector, including industry, users, and academic experts in network and information security.

Amendment 79 #

Proposal for a regulation
Recital 44

(44) The Agency should have a Permanent Stakeholders’ Group as an advisory body, to ensure regular dialogue with the private sector, consumers’ organisations, academia and other relevant stakeholders. The Permanent Stakeholders’ Group, set up by the Management Board on a proposal by the Executive Director, should focus on issues relevant to stakeholders and bring them to the attention of the Agency, providing input on which ICT products and services to cover in future European IT security certification schemes . The composition of the Permanent Stakeholders Group and the tasks assigned to this Group, to be consulted in particular regarding the draft Work Programme, should ensure suefficient and equitable representation of stakeholders in the work of the Agency.

Amendment 80 #

Proposal for a regulation
Recital 44

advisory body, to ensure regular dialogue with the private sector, consumers’ organisations and other relevant stakeholders. The Permanent Stakeholders’ Group, set up by the Management Board on a proposal by the Executive Director, should focus on issues relevant to stakeholders and bring them to the attention of the Agency. The composition of the Permanent Stakeholders Group and the tasks assigned to this Group, to be consulted in particular regarding the draft Work Programme, should ensure sufficient representation of stakeholders in the work of the Agency.

Amendment 81 #

Proposal for a regulation
Recital 46

(46) In order to guarantee the full autonomy and independence of the Agency and to enable it to perform additional and new tasks, including unforeseen emergency tasks, the Agency should be granted a sufficient and autonomous budget whose revenue comes primarily from a contribution from the Union and contributions from third countries participating in the Agency’s work. The majority of the Agency staff should be directly engaged in the operational implementation of the Agency’s mandate. The host Member State, or any other Member State, should be allowed to make voluntary contributions to the revenue of the Agency. The Union’s budgetary procedure should remain applicable as far as any subsidies chargeable to the general budget of the Union are concerned. Moreover, the Court of Auditors should audit the Agency’s accounts to ensure transparency ~~and~~, accountability, efficiency and the effectiveness of the expenditure.

Amendment 82 #

Proposal for a regulation
Recital 47

(47) Conformity assessment is the process demonstrating whether specified requirements relating to a product, process, service, system, person or body have been fulfilled. For the purposes of this Regulation, certification should be considered as a type of conformity assessment regarding the ~~cyber~~IT security features of a product, process, service, system, or a combination of those (“ICT products and services”) by an independent third party, other than the product manufacturer or service provider. While certification for lower assurance levels than high may require merely conformity assessment, for assurance level high, a profound security assessment and neutral certification is needed. Certificates on this assurance level therefore should be issued only by Cybersecurity Supervisory Authorities. The issuing of those certificates should be subject to mutual peer reviews by other Cybersecurity Supervisory Authorities. Certification cannot guarantee per se that certified ICT products and services are cyber secure. It is rather a procedure and technical methodology to attest that ICT products and services have been tested and that they comply with certain ~~cyber~~IT security requirements laid down elsewhere, for example as specified in technical standards.

Amendment 83 #

Proposal for a regulation
Recital 47

(47) Conformity assessment is the process demonstrating whether specified requirements relating to a product, process, service, system, person or body have been fulfilled. For the purposes of this Regulation, certification should be considered as a type of conformity assessment regarding the cybersecurity features of a product, process, service, system, or a combination of those (“ICT hardware and software products and services”) by an independent third party, o~~the~~r th~~an the product manufacturer or serv~~rough a strict procedure of self- declaration of conformity as outlined in Article 2(16a), Article 46, Article ~~provider~~50 and Article 51 of this Regulation. Certification cannot guarantee per se that certified ICT products and services are cyber secure. It is rather a procedure and technical methodology to attest that ICT hardware and software products and services have been tested and that they comply with certain cybersecurity requirements laid down elsewhere, for example as specified in technical standards.

Amendment 84 #

Liisa JAAKONSAARI, Christel SCHALDEMOSE, Lucy ANDERSON

Amendment 85 #

Proposal for a regulation
Recital 47

Amendment 86 #

Proposal for a regulation
Recital 48

(48) CEuropean cybersecurity certification plays an ~~important~~essential role in increasing trust and security in ICT products and services. The digital single market, and particularly the data economy and the Internet of Things, can only thrive if there is general public trust that such products and services provide a ~~certain~~high level of cybersecurity assurance. Connected and automated cars, electronic medical devices, industrial automation control systems or smart grids are only some examples of sectors in which certification is already widely used or is likely to be used in the near future. The sectors regulated by the NIS Directive are also sectors in which cybersecurity certification is critical.

Amendment 87 #

Proposal for a regulation
Recital 49

(49) In the 2016 Communication “Strengthening Europe’s Cyber Resilience System and Fostering a Competitive and Innovative Cybersecurity Industry”, the Commission outlined the need for high- quality, affordable and interoperable cybersecurity products and solutions. The supply of ICT hardware and software products and services within the single market remains very fragmented geographically. This is because the cybersecurity industry in Europe has developed largely on the basis of national governmental demand. In addition, the lack of interoperable solutions (technical standards), practices and EU-wide mechanisms of certification are among the other gaps affecting the single market in cybersecurity. On the one hand, this makes it difficult for European companies to compete at national, European and global level. On the other, it reduces the choice of viable and usable cybersecurity technologies that individuals and enterprises have access to. Similarly, in the Mid-Term Review on the implementation of the Digital Single Market Strategy, the Commission highlighted the need for safe connected products and systems, and indicated that the creation of a European ICT security framework setting rules on how to organise ICT security certification in the Union could both preserve trust in the internet and tackle the current fragmentation of the cybersecurity market.

Amendment 88 #

Proposal for a regulation
Recital 50

(50) Currently, the cybersecurity certification of ICT products and services is used only to a limited extent. When it exists, it mostly occurs at Member State level or in the framework of industry driven schemes. In this context, a certificate issued by one national cybersecurity authority is not in principle recognised by other Member States. Companies thus may have to certify their products and services in several Member States where they operate, for example with a view to participating in national procurement procedures, thereby adding to their costs. Moreover, while new schemes are emerging, there seems to be no coherent and holistic approach with regard to horizontal cybersecurity issues, for instance in the field of the Internet of Things. Existing schemes present significant shortcomings and differences in terms of product coverage, levels of assurance, substantive criteria and actual utilisation.

Amendment 89 #

Proposal for a regulation
Recital 50

(50) Currently, the cybersecurity certification of ICT products and services is used only to a limited extent. When it exists, it mostly occurs at Member State level or in the framework of industry driven schemes. In this context, a certificate issued by one national cybersecurity authority is not in principle recognised by other Member States. Companies thus may have to certify their products and services in several Member States where they operate, for example with a view to participating in national procurement procedures. Moreover, while new schemes are emerging, there seems to be no coherent and holistic approach with regard to horizontal cybersecurity issues, for instance in the field of the Internet of Things. Existing schemes present significant shortcomings and differences in terms of product coverage, levels of risk- based assurance, substantive criteria and actual utilisation.

Amendment 90 #

Proposal for a regulation
Recital 52

(52) In view of the above, it is necessary to establish a European ~~cyber~~IT security certification framework laying down the main horizontal requirements for European ~~cyber~~IT security certification schemes to be developed and allowing certificates for ICT products and services to be recognised and used in all Member States. The European framework should have a twofold purpose: on the one hand, it should help increase trust in ICT products and services that have been certified according to such schemes. On the other hand, it should avoid the multiplication of conflicting or overlapping national ~~cyber~~IT security certifications and thus reduce costs for undertakings operating in the digital single market. The schemes should be guided by security-by-design and the principles referred in Regulation 2016/679. They should also be non- discriminatory and based on international and / or Union standards, unless those standards are ineffective or inappropriate to fulfil the EU’s legitimate objectives in that regard.

Amendment 91 #

Proposal for a regulation
Recital 52

(52) In view of the above, it is necessary to establish a European cybersecurity certification framework laying down the main horizontal requirements for European cybersecurity certification schemes to be developed and allowing certificates for ICT hardware and software products and services to be recognised and used in all Member States. The European framework should have a twofold purpose: on the one hand, it should help increase trust in ICT hardware and software products and services that have been certified according to such schemes. On the other hand, it should avoid the multiplication of conflicting or overlapping national cybersecurity certifications and thus reduce costs for undertakings operating in the digital single market. The schemes should be non-discriminatory and based on international and / or Union standards, unless those standards are ineffective or inappropriate to fulfil the EU’s legitimate objectives in that regard.

Amendment 92 #

Philippe JUVIN, Andreas SCHWAB

Proposal for a regulation
Recital 52

(52) In view of the above, it is necessary to adopt a common approach and establish a European cybersecurity certification framework laying down the main horizontal requirements for European cybersecurity certification schemes to be developed and allowing certificates for ICT products and services to be recognised and used in all Member States. The European framework should have a twofold purpose: on the one hand, it should help increase trust in ICT products and services that have been certified according to such schemes. On the other hand, it should avoid the multiplication of conflicting or overlapping national cybersecurity certifications and thus reduce costs for undertakings operating in the digital single market. The schemes should be non-discriminatory and based on international and / or Union standards, unless those standards are ineffective or inappropriate to fulfil the EU’s legitimate objectives in that regard.

Amendment 93 #

Proposal for a regulation
Recital 52 a (new)

(52a) The European cybersecurity certification framework should be established in a uniform manner in all Member States in order to prevent ‘certification shopping’ based on differences in costs or levels of stringency between Member States.

Amendment 94 #

Proposal for a regulation
Recital 53

(53) The Commission should be empowered to adopt European cybersecurity certification schemes concerning specific groups of ICT hardware and software products and services. These schemes should be implemented and supervised by national certification supervisory authorities and certificates issued within these schemes should be valid and recognised throughout the Union. Certification schemes operated by the industry or other private organisations should fall outside the scope of the Regulation. However, the bodies operating such schemes may propose to the Commission to consider such schemes as a basis for approving them as a European scheme.

Amendment 95 #

(53) ~~The Commission should be empowered to adopt~~Member States will notify the Commission of their decisions on European cybersecurity certification schemes concerning specific groups of ICT products and services. These schemes should be implemented and supervised by national certification supervisory authorities and certificates issued within these schemes should be valid and recognised throughout the Union. Certification schemes operated by the industry or other private organisations should fall outside the scope of the Regulation. However, the bodies operating such schemes may propose to the Commission to consider such schemes as a basis for approving them as a European scheme.

Amendment 96 #

Proposal for a regulation
Recital 55

(55) The purpose of European cybersecurity certification schemes should be to ensure that ICT products and services certified under such a scheme comply with specified requirements. Such requirements concern the ability to resist, at a given level of assurance, actions that aim to compromise the availability, authenticity, integrity and confidentiality of stored or transmitted or processed data or the related functions of or services offered by, or accessible via those products, processes, services and systems within the meaning of this Regulation. It is not possible to set out in detail in this Regulation the cybersecurity requirements relating to all ICT products and services. ICT products and services and related cybersecurity needs are so diverse that it is very difficult to come up with general cybersecurity requirements valid across the board. It is, therefore necessary to adopt a broad and general notion of cybersecurity for the purpose of certification, complemented by a set of specific cybersecurity objectives that need to be taken into account when designing European cybersecurity certification schemes. The modalities with which such objectives will be achieved in specific ICT products and services should then be further specified in detail at the level of the individual certification scheme adopted by the Commission, for example by reference to standards or technical specifications. It is of paramount importance that each European cybersecurity certification scheme be designed in such a way as to stimulate and encourage all actors involved in the sector concerned to develop and adopt security standards, technical norms and security-by-design principles, at all stages of the product or service lifecycle.

Amendment 97 #

Liisa JAAKONSAARI, Christel SCHALDEMOSE, Lucy ANDERSON

Proposal for a regulation
Recital 55

(55) The purpose of European cybersecurity certification schemes should be to ensure that ICT hardware and software products and services certified under such a scheme comply with specified requirements. Such requirements concern the ability to resist, at a given level of assurance, actions that aim to compromise the availability, authenticity, integrity and confidentiality of stored or transmitted or processed data or the related functions of or services offered by, or accessible via those products, processes, services and systems within the meaning of this Regulation. It is not possible to set out in detail in this Regulation the cybersecurity requirements relating to all ICT hardware and software products and services. ICT hardware and software products and services and related cybersecurity needs are so diverse that it is very difficult to come up with general cybersecurity requirements valid across the board. It is, therefore necessary to adopt a broad and general notion of cybersecurity for the purpose of certification, complemented by a set of specific cybersecurity objectives that need to be taken into account when designing European cybersecurity certification schemes. This shall be done by means of a checklist listing the risks that the ICT hardware or software product or service is expected to face by a given category of users in a particular environment. The modalities with which such objectives will be achieved in specific ICT hardware and software products and services should then be further specified in detail at the level of the individual certification scheme adopted by the Commission, for example by reference to standards or technical specifications.

Amendment 98 #

Proposal for a regulation
Recital 55

(55) The purpose of European cybersecurity certification schemes should be to ensure that ICT products and services certified under such a scheme comply with specified requirements. Such requirements concern the ability to resist, at a given level of assurance, actions that aim to compromise the availability, authenticity, integrity and confidentiality of stored or transmitted or processed data or the related functions of or services offered by, or accessible via those products, processes, services and systems within the meaning of this Regulation. It is not possible to set out in detail in this Regulation the cybersecurity requirements relating to all ICT products and services. ICT products and services and related cybersecurity needs are so diverse that it is very difficult to come up with general cybersecurity requirements valid across the board. It is, therefore necessary to adopt a broad and general notion of cybersecurity for the purpose of certification, complemented by a set of specific cybersecurity objectives that need to be taken into account when designing European cybersecurity certification schemes. The modalities with which such objectives will be achieved in specific ICT products and services should then be further specified in detail at the level of the individual certification scheme adopted by the Commission, for example by reference to standards or technical specifications. Where the certification scheme provides for marks or labels, the conditions under which such marks or labels may be used have to be outlined; The marks and labels must be clear and easily understandable for the end-user.

Amendment 99 #

Proposal for a regulation
Recital 55

(55) The purpose of European cybersecurity certification schemes should be to ensure that ICT products and services certified under such a scheme comply with specified requirements. Such requirements concern the ability to resist, at a given level of assurance, actions that aim to compromise the availability, authenticity, integrity and confidentiality of stored or transmitted or processed data or the related functions of or services offered by, or accessible via those products, processes, services and systems within the meaning of this Regulation. It is not possible to set out in detail in this Regulation the cybersecurity requirements relating to all ICT products and services. ICT products and services and related cybersecurity needs are so diverse that it is very difficult to come up with general cybersecurity requirements valid across the board. It is, therefore necessary to adopt a broad and general notion of cybersecurity for the purpose of certification, complemented by a set of specific cybersecurity objectives that need to be taken into account when designing European cybersecurity certification schemes. The modalities with which such objectives will be achieved in specific ICT products and services should then be further specified in detail at the level of the individual certification scheme adopted by the Commission, for example by reference to standards or technical specifications. Depending on the certification scheme, the specified requirements of the scheme could, in principle, make use of existing best practices where applicable.

source: 619.102

2018/03/28 BUDG 14 amendments...

Amendment 10 #

Proposal for a regulation
Recital 13 a (new)

(13 a) Cooperation between the EU and NATO is essential in order to organise regular strategic level exercises with the participation of the top political leadership of both organisations. A good example of that cooperation is the Estonian exercise EU CYBRID 2017.

Amendment 11 #

Proposal for a regulation
Recital 15 a (new)

(15 a) International law applies to cyberspace and the 2013 and 2015 UN Group of Governmental Experts on Information Security (UNGGE) reports provide relevant guidelines, in particular as regards the prohibition for states to conduct or knowingly support cyber activities contrary to their obligations under international rules. The relevance of the Tallinn Manual 2.0 in this context is an excellent basis for a debate on how international law applies to cyberspace and it is now time for the Member States to start analysing and applying the Manual.

Amendment 12 #

Proposal for a regulation
Recital 46 a (new)

(46 a) The Agency's budget should be prepared in accordance with the principle of performance-based budgeting, taking into account the Agency's objectives and the expected results of its tasks.

Amendment 13 #

Proposal for a regulation
Article 4 – paragraph 4

4. The Agency shall promote cooperation and coordination at Union level among Member States, Union institutions, agencies and bodies, and relevant stakeholders, including the private sector, on matters related to cybersecurity in order to achieve coordination and financial savings, to avoid duplication and to promote synergy and complementarity as regards their activities.

Amendment 14 #

Tomáš ZDECHOVSKÝ

Proposal for a regulation
Article 9 – paragraph 1 – point g a (new)

(g a) publish and promote its activities and the results of its work in order to increase visibility and awareness among citizens.

Amendment 15 #

Proposal for a regulation
Article 26 – paragraph 1 – subparagraph 1 (new)

The provisional draft statement of estimates shall be based on the objectives and expected results of the single programming document referred to in Article 21(1) and shall take into account the financial resources necessary to achieve those objectives and expected results, in accordance with the principle of performance-based budgeting.

Amendment 16 #

Tomáš ZDECHOVSKÝ

Proposal for a regulation
Article 36 – paragraph 5

5. The personal liability of its servants towards the Agency shall be governed by the relevant conditions applying to the staff of the Agency. Effective recruitment of staff shall be ensured.

Amendment 17 #

Tomáš ZDECHOVSKÝ

Proposal for a regulation
Article 41 – paragraph 2

2. The Agency’s host Member State shall provide the best possible conditions to ensure the proper functioning of the Agency, including the accessibility of the location, the existence of adequate education facilities for the children of staff members, appropriate access to the labour market, social security and medical care for both children and spouses. Location on the mainland would therefore be preferable.

Amendment 18 #

Jean ARTHUIS

Proposal for a regulation
Article 41 – paragraph 2

2. The Agency’s host Member State shall provide the best possible conditions to ensure the proper functioning of the Agency, including a single location for the entire Agency, the accessibility of the location, the existence of adequate education facilities for the children of staff members, appropriate access to the labour market, social security and medical care for both children and spouses.

Amendment 19 #

Proposal for a regulation
Article 41 – paragraph 2

Amendment 20 #

Jens GEIER

Proposal for a regulation
Article 41 – paragraph 2

Amendment 7 #

Proposal for a regulation
Recital 3 a (new)

(3 a) ENISA should give more practical and information based support to the EU cybersecurity industry, in particular SMEs and start-ups, which are key sources of innovative solutions in the area of cyber defence, and should promote closer cooperation with university research organisations and large players with a view to reducing dependencies on cybersecurity products form external sources and to creating a strategic supply chain inside the Union.

Amendment 8 #

Proposal for a regulation
Recital 4

(4) Cyber-attacks are on the increase and a connected economy and society that is more vulnerable to cyber threats and attacks requires stronger defences. However, while cyber-attacks are often cross-border, policy responses by cybersecurity authorities and law enforcement competences are predominantly national. Large-scale cyber incidents could disrupt the provision of essential services across the EU. This requires effective EU level response and crisis management, building upon dedicated policies and wider instruments for European solidarity and mutual assistance. Training needs in the area of cyber defence are substantial and increasing, and are most efficiently met cooperatively at Union level. Moreover, a regular assessment of the state of cybersecurity and resilience in the Union, based on reliable Union data, as well as systematic forecast of future developments, challenges and threats, both at Union and global level, is therefore important for policy makers, industry and users.

Amendment 9 #

Proposal for a regulation
Recital 12

(12) The Agency should develop and maintain a high level of expertise and operate as a point of reference establishing trust and confidence in the single market by virtue of its independence, the quality of the advice it delivers and the information it disseminates, the transparency of its procedures and methods of operation, and its diligence in carrying out its tasks. The Agency should proactively contribute to national and Union efforts while carrying out its tasks in full cooperation with the Union institutions, bodies, offices and agencies and the Member States, avoiding any duplication of work, promoting synergy and complementarity and thus achieving coordination and fiscal savings. In addition, the Agency should build on input from and cooperation with the private sector as well as other relevant stakeholders. A set of tasks should establish how the Agency is to accomplish its objectives while allowing flexibility in its operations.

source: 620.724

2018/04/30 ITRE 539 amendments...

Amendment 100 #

Proposal for a regulation
Recital 5

(5) In light of the increased cybersecurity challenges faced by the Union, there is a need for a comprehensive set of measures that would build on previous Union action and foster mutually reinforcing objectives. These include the need to further increase capabilities and preparedness of Member States and businesses, as well as to improve cooperation and coordination across Member States and EU institutions, agencies and bodies. Furthermore, given the borderless nature of cyber threats, there is a need to increase capabilities at Union level that could complement the action of Member States, in particular in the case of large scale cross-border cyber incidents and crises. Additional efforts are also needed to increase awareness of citizens and businesses on cybersecurity issues. Moreover, the trust in the digital single market should be further improved by offering transparent information on the level of security of ICT products and services. This can be facilitated by EU- wide certification providing common cybersecurity requirements and evaluation criteria across national markets and sectors. The challenges faced should be proportianally reflected on the budget allocated to the Agency, so as to ensure the optimal functionality under the current circumstances.

Amendment 101 #

Clare MOODY, Theresa GRIFFIN, Peter KOUROUMBASHEV, Arne LIETZ

Proposal for a regulation
Recital 5

(5) In light of the increased cybersecurity challenges faced by the Union, there is a need for a comprehensive set of measures that would build on previous Union action and foster mutually reinforcing objectives. These include the need to further increase capabilities and preparedness of Member States and businesses, as well as to improve cooperation ~~and~~, coordination and information sharing across Member States and EU institutions, agencies and bodies. Furthermore, given the borderless nature of cyber threats, there is a need to increase capabilities at Union level that could complement the action of Member States, in particular in the case of large scale cross-border cyber incidents and crises. Additional efforts are also needed to increase awareness of citizens and businesses on cybersecurity issues, also with regard to an awareness of the increased relevance of information- sharing rather than concealment as a main deterrent to cyber attacks. Moreover, the trust in the digital single market should be further improved by offering transparent information on the level of security of ICT products and services. This can be facilitated by EU- wide certification providing common cybersecurity requirements and evaluation criteria across national markets and sectors.

Amendment 102 #

Proposal for a regulation
Recital 5

(5) In light of the increased cybersecurity challenges faced by the Union, there is a need for a comprehensive set of measures that would build on previous Union action and foster mutually reinforcing objectives. These include the need to further increase capabilities and preparedness of Member States and businesses, as well as to improve cooperation and coordination across Member States and EU institutions, agencies and bodies. Furthermore, given the borderless nature of cyber threats, there is a need to increase capabilities at Union level that could complement the action of Member States, in particular in the case of large scale cross-border cyber incidents and crises. Additional efforts are also needed to increase awareness of citizens and businesses on cybersecurity issues. Moreover, the trust in the digital single market should be further improved by offering transparent information on the level of security of ICT products and services stressing that even a high level of cybersecurity certification cannot guarantee that an ICT product or service is completely safe. This can be facilitated by EU- wide certification providing common cybersecurity requirements and evaluation criteria across national markets and sectors as well as promoting cyber literacy.

Amendment 103 #

Proposal for a regulation
Recital 5 a (new)

(5 a) For the purpose of strengthening European security and cyber defence structures, it is important to maintain and develop the capabilities of Member States to comprehensively respond to cyber threats, including cross-border incidents while coordination on EU-level by the Agency should not lead to the diminishing of capabilities or efforts in the Member States.

Amendment 104 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Caroline NAGTEGAAL, Gesine MEISSNER, Morten PETERSEN

Proposal for a regulation
Recital 5 a (new)

(5 a) Due to the specific position of small and medium sized enterprises and with regard to the crucial role they play in the economy of the Union, requirements for EU-wide certification, which might put an exceedingly high burden on these enterprises and which are not crucial to critical infrastructures, have to be regarded with caution and/or have to be rejected.

Amendment 105 #

Proposal for a regulation
Recital 5 a (new)

(5 a) Businesses as well as individual consumers should have accurate information regarding the level of security of their ICT products. At the same time, it has to be understood that no product is cyber secure and that basic rules of cyber hygiene have to be promoted and prioritized.

Amendment 106 #

Rolandas PAKSAS

Proposal for a regulation
Recital 5 a (new)

(5 a) Cybersecurity requirements should always aim for the highest level of security for consumers and where appropriate establish additional elements for products in which higher standards of security are needed due to the object of protection.

Amendment 107 #

Michał BONI, Seán KELLY, Henna VIRKKUNEN, Massimiliano SALINI, Krišjānis KARIŅŠ, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Recital 7

(7) The Union has already taken important steps to ensure cybersecurity and increase trust in digital technologies. In 2013, an EU Cybersecurity Strategy was adopted to guide the Union's policy response to cybersecurity threats and risks. In its effort to better protect Europeans online, in 2016 the Union adopted the first legislative act in the area of cybersecurity, the Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union (the "NIS Directive"). The NIS Directive fulfills the digital single market strategy and together with other instruments, such as the Directive establishing the European Electronic Communications Code, Regulation (EU) 2016/679 and Directive 2002/58/EC, puts in place requirements concerning national capabilities in the area of cybersecurity, established the first mechanisms to enhance strategic and operational cooperation between Member States, and introduced obligations concerning security measures and incident notifications across sectors which are vital for economy and society such as energy, transport, water, banking, financial market infrastructures, healthcare, digital infrastructure as well as key digital service providers (search engines, cloud computing services and online marketplaces). A key role was attributed to ENISA in supporting implementation of this Directive. In addition, effective fight against cybercrime is an important priority in the European Agenda on Security, contributing to the overall aim of achieving a high level of cybersecurity.

Amendment 108 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Caroline NAGTEGAAL, Gesine MEISSNER, Morten PETERSEN

Proposal for a regulation
Recital 8

(8) It is recognised that, since the adoption of the 2013 EU Cybersecurity Strategy and the last revision of the Agency's mandate, the overall policy context has changed significantly, also in relation to a more uncertain and less secure global environment. In this context and in the context of the positive role the Agency has played over the years in pooling of expertise, coordination, capacity building and within the framework of the new Union cybersecurity policy, it is necessary to review the mandate of ENISA to define its role in the changed cybersecurity ecosystem and ensure it contributes effectively to the Union's response to cybersecurity challenges emanating from this radically transformed threat landscape, for which, as recognised by the evaluation of the Agency, the current mandate is not sufficient.

Amendment 109 #

Proposal for a regulation
Recital 9

(9) The Agency established by this Regulation should succeed ENISA as established by Regulation (EU) No 526/2013. The Agency should carry out the tasks conferred on it by this Regulation and legal acts of the Union in the field of cybersecurity by, among other things, providing expertise and advice and acting as a Union centre of information and knowledge. ~~It shoul~~Since the vast majority of IT networks and systems are in the private sector, the Agency should improve cooperation and promote the exchange of best practices between Member States and private stakeholders, offering policy suggestions to the European Commission and Member States, acting as a reference point for Union sectoral policy initiatives with regard to cybersecurity matters, fostering operational cooperation between the Member States and between the Member States and the EU institutions, agencies and bodies.

Amendment 110 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Recital 11

(11) Given the increasing cybersecurity challenges the Union is facing, the financial and human resources allocated to the Agency should be increased to reflect its enhanced role and tasks, and its critical position in the ecosystem of organisations defending the European digital ecosystem, allowing ENISA to effectively carry out the tasks conferred on it by this Regulation.

Amendment 111 #

Proposal for a regulation
Recital 12

(12) The Agency should develop and maintain a high level of expertise and operate as a point of reference establishing trust and confidence in the single market by virtue of its independence, the quality of the advice it delivers and the information it disseminates, the transparency of its procedures and methods of operation, and its diligence in carrying out its tasks. The Agency should proactively contribute to national and Union efforts while carrying out its tasks in full cooperation with the Union institutions, bodies, offices and agencies and the Member States. In addition, the Agency should build on input from and cooperation with the private and public sectors as well as other relevant stakeholders. A set of tasks should establish how the Agency is to accomplish its objectives while allowing flexibility in its operations.

Amendment 112 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Gesine MEISSNER

Proposal for a regulation
Recital 12 a (new)

(12 a) The role of the Agency should be subject to continuous assessment and timely review, in particular its coordinating role vis-à-vis the Member States and their national authorities, the eventual possibility of acting as a One- Stop-Shop for Member States and EU bodies and institutions. The Agency´s role in the avoidance of fragmentation of the internal market and the possible introduction of mandatory cybersecurity certification schemes, should the situation in the future require such a shift, should also be assessed as well as the Agency´s role in respect of the assessment of third country products entering the EU market and the possible blacklisting of companies which do not comply with EU criteria.

Amendment 113 #

Michał BONI, Seán KELLY, Henna VIRKKUNEN, Massimiliano SALINI, Krišjānis KARIŅŠ, Gunnar HÖKMARK

Proposal for a regulation
Recital 13

(13) The Agency should assist the Commission, on its own initiative and upon request, by means of advice, opinions and analyses on all the Union matters related to policy and law development, update and review in the area of cybersecurity, including critical infrastructure protection and cyber resilience. The Agency should act as a reference point of advice and expertise for Union sector-specific policy and law initiatives where matters related to cybersecurity are involved. The Agency should regularly provide Parliament with updates, analysis and review in the area of cybersecurity and the evolution of its tasks.

Amendment 114 #

Proposal for a regulation
Recital 14

(14) The underlying task of the Agency is to promote the consistent implementation of the relevant legal framework, in particular the effective implementation of the NIS Directive, the Directive establishing the European Electronic Communications Code, Regulation (EU) 2016/679 and Directive 2002/58/EC, which is essential in order to increase cyber resilience. In view of the fast evolving cybersecurity threat landscape, it is clear that Member States must be supported by more comprehensive, cross-policy approach to building cyber resilience.

Amendment 115 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Recital 15

(15) The Agency should assist the Member States and Union institutions, bodies, offices and agencies in their efforts to build and enhance capabilities and preparedness to prevent, detect and respond to cybersecurity problems and incidents and in relation to the security of network and information systems. In particular, the Agency should support the development and enhancement of national CSIRTs, with a view of achieving a high common level of their maturity in the Union. The Agency should also assist with the development and update of Union and Member States strategies on the security of network and information systems, in particular on cybersecurity, promote their dissemination and track progress of their implementation. TMoreover, the Agency should assist and advise Members States and Union institutions in establishing transparent policies and practices for the management and coordinated disclosure of vulnerabilities in ICT products, processes, services and systems that are not publicly known, including the establishment of a government vulnerability disclosure review process and coordinated vulnerability disclosure policies. Finally, the Agency should also offer trainings and training material to public bodies, and where appropriate "train the trainers" with a view to assisting Member States in developing their own training capabilities.

Amendment 116 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Caroline NAGTEGAAL, Gesine MEISSNER, Morten PETERSEN

Proposal for a regulation
Recital 15

(15) The Agency should assist the Member States and Union institutions, bodies, offices and agencies in their efforts to build and enhance capabilities and preparedness to prevent, detect and respond to cybersecurity problems and incidents and in relation to the security of network and information systems. In particular, the Agency should support the development and enhancement of national CSIRTs, with a view of achieving a high common level of their maturity in the Union. The Agency should also assist with the development and update of Union and Member States strategies on the security of network and information systems, in particular on cybersecurity, promote their dissemination and track progress of their implementation. The Agency should also offer trainings and training material to public bodies, and where appropriate "train the trainers" with a view to assisting Member States in developing their own training capabilities. The Agency should also serve as a contact point for Member States and Union institutions, who should be able to request an assistance of the Agency within the competences and roles assigned to it.

Amendment 117 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Recital 15

(15) The Agency should assist the Member States and Union institutions, bodies, offices and agencies in their efforts to build and enhance capabilities and preparedness to prevent, detect and respond to cybersecurity problems and incidents and in relation to the security of network and information systems. In particular, the Agency should support the development and enhancement of national CSIRTs, with a view of achieving a high common level of their maturity in the Union. The Agency should also assist with the development and update of Union and Member States strategies on the security of network and information systems, in particular on cybersecurity, promote their dissemination and track progress of their implementation. TConsidering that human mistakes are one of the most pertinent risks to cyber security, the Agency should also offer trainings and training material to public bodies, and ~~where appropriat~~to the maximum extent possible "train the trainers" with a view to assisting Member States and Union institutions and agencies in developing their own training capabilities.

Amendment 118 #

Proposal for a regulation
Recital 18

(18) The Agency should aggregate and analyse national reports from CSIRTs and CERT-EU, setting up common rules, language and terminology for exchange of information. The Agency should also involve the private and public sectors, within the framework of the NIS Directive which laid down the grounds for voluntary technical information exchange at the operational level with the creation of the CSIRTs Network.

Amendment 119 #

Proposal for a regulation
Recital 19

(19) The Agency should contribute to an EU level response in case of large-scale cross-border cybersecurity incidents and crises. This function should include gathering relevant information and acting as facilitator between the CSIRTs Network and the technical community as well as decision makers responsible for crisis management. Furthermore, the Agency could support the handling of incidents from a technical perspective by facilitating relevant technical exchange of solutions between Member States and by providing input into public communications. The Agency should support the process by testing modalities of such cooperation through yearly cybersecurity exercises. The national competences of the Member States regarding issues of specific national interest should be respected by the Agency.

Amendment 120 #

Proposal for a regulation
Recital 19

(19) The Agency should contribute to an EU level response in case of large-scale cross-border cybersecurity incidents and crises. This function should include convening Member States' authorities and assisting in the coordination of their response, gathering relevant information and acting as facilitator between the CSIRTs Network and the technical community as well as decision makers responsible for crisis management. Furthermore, the Agency could support the handling of incidents from a technical perspective by facilitating relevant technical exchange of solutions between Member States and by providing input into public communications. The Agency should support the process by testing modalities of such cooperation through yearly cybersecurity exercises.

Amendment 121 #

Michał BONI, Seán KELLY, Henna VIRKKUNEN, Massimiliano SALINI, Krišjānis KARIŅŠ, Gunnar HÖKMARK

Proposal for a regulation
Recital 19

(19) The Agency should contribute to an EU level response in case of large-scale cross-border cybersecurity incidents and crises. This function should include gathering relevant information and acting as facilitator between the CSIRTs Network and the technical community as well as decision makers responsible for crisis management. Furthermore, the Agency could support the handling of incidents from a technical perspective, for example by facilitating relevant technical exchange of solutions between Member States and by providing input into public communications. The Agency should support the process by testing modalities of such cooperation through yearly cybersecurity exercises.

Amendment 122 #

Proposal for a regulation
Recital 26

(26) To understand better the challenges in the field of cybersecurity, and with a view to providing strategic long term advice to Member States and Union institutions, the Agency needs to analyse current and emerging risks, incidents, threats and vulnerabilities. For that purpose, the Agency should, in cooperation with Member States and, as appropriate, with statistical bodies and others, collect relevant information and perform analyses of emerging technologies and provide topic-specific assessments on expected societal, legal, economic and regulatory impacts of technological innovations on network and information security, in particular cybersecurity. The Agency should furthermore support Member States and Union institutions, agencies and bodies in identifying emerging trends and preventing problems related to cybersecurity, by performing analyses of threats ~~and~~, incidents and vulnerabilities.

Amendment 123 #

Proposal for a regulation
Recital 27

(27) In order to increase the resilience of the Union, the Agency should develop excellence on the subject of security of internet infrastructure and of the critical infrastructures, by providing advice, guidance and best practices. With a view to ensuring easier access to better structured information on cybersecurity risks and potential remedies, the Agency should develop and maintain the "information hub" of the Union, a one-stop-shop portal providing the public with information on cybersecurity deriving from the EU and national institutions, agencies and bodies. Facilitating access to better structured information on cybersecurity risks and potential remedies should help Member States bolster their capacities and align their practices, hence increasing their overall resilience in the face of cyber- attacks.

Amendment 124 #

Proposal for a regulation
Recital 28

(28) The Agency should contribute towards raising the awareness of the public about risks related to cybersecurity and provide guidance on good practices for individual users aimed at citizens and organisations. The Agency should also contribute to promote cyber hygiene best practices and solutions at the level of individuals and organisations by collecting and analysing publicly available information regarding significant incidents, and by compiling reports with a view to providing guidance to businesses and citizens and improving the overall level of preparedness and resilience. The Agency should furthermore organise, in cooperation with the Member States and the Union institutions, bodies, offices and agencies regular outreach and public education campaigns directed to end-users, aiming at promoting safer individual online behaviour and raising awareness of potential threats in cyberspace, including cybercrimes such as phishing attacks, botnets, financial and banking fraud, as well as promoting basic multi-factor authentication, patching, encryption, micro-segmentation, least privilege principles, and data protection advice. The Agency should play a central role in accelerating end-user awareness on security of devices. Least Privilege refers to the case when users are allowed only the minimum necessary access to perform their job and nothing more, and system components are allowed only the minimum necessary function needed to perform their purpose and nothing more. The principle of micro-segmentation requires that the whole IT or network environment is divided into smaller subsystems and sub-networks to make it more manageable to protect and contain the damage if one subsystem or sub- network gets compromised.

Amendment 125 #

Proposal for a regulation
Recital 28

(28) (28) The Agency should contribute towards raising the awareness of the public about risks related to ~~cyber~~IT security and provide guidance on good practices for individual users aimed at citizens and organisations. The Agency should also contribute to promote best practices and solutions at the level of individuals and organisations by collecting and analysing publicly available information regarding significant incidents, and by compiling ~~report~~and publishing reports and guides with a view to providing guidance to businesses and citizens and improving the overall level of preparedness and resilience. The Agency should furthermore organise, in cooperation with the Member States and the Union institutions, bodies, offices and agencies regular outreach and public education campaigns directed to end-users, aiming at promoting safer individual online behaviour and raising awareness of potential threats in cyberspace, including cybercrimes such as phishing attacks, botnets, financial and banking fraud, as well as promoting ~~basic~~ authentication, encryption, anonymisation and data protection advice. The Agency should play a central role in accelerating end-user awareness on security of devices and secure use of services, popularising security by design at Union level, privacy by design and the incidents and their solutions. In achieving this objective the Agency should make the best use of available best practices and experience, especially from academic institutions and IT security researchers.

Amendment 126 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Recital 28

(28) The Agency should contribute towards raising the awareness of the public about risks related to cybersecurity and provide guidance on good practices for individual users aimed at citizens ~~and~~, organisations and businesses. The Agency should also contribute to promote best practices and solutions at the level of individuals ~~and~~, organisations and businesses by collecting and analysing publicly available information regarding significant incidents, and by compiling reports with a view to providing guidance to businesses and citizens and improving the overall level of preparedness and resilience. The Agency should furthermore organise, in cooperation with the Member States and the Union institutions, bodies, offices and agencies regular outreach and public education campaigns directed to end-users, aiming at promoting safer individual online behaviour, digital literacy and raising awareness of potential threats in cyberspace, including cybercrimes such as phishing attacks, botnets, financial and banking fraud, as well as promoting basic authentication and data protection advice. The Agency should play a central role in accelerating end-user awareness on security of devices. Given that individual mistakes and unawareness of cyber risks constitutes a main factor of uncertainty in cyber security, the Agency should be provided with adequate resources for exercising this function to the maximum degree possible.

Amendment 127 #

Proposal for a regulation
Recital 28

(28) The Agency should contribute towards raising the awareness of the public about risks related to cybersecurity and provide guidance on good practices for individual users aimed at citizens and organisations. The Agency should also contribute to promote best practices and solutions at the level of individuals and organisations by collecting and analysing publicly available information regarding significant incidents, and by compiling reports with a view to providing guidance to businesses and citizens and improving the overall level of preparedness and resilience. The Agency should furthermore organise, in cooperation with the Member States and the Union institutions, bodies, offices and agencies regular outreach and public education campaigns directed to end-users, aiming at promoting safer individual online behaviour and raising awareness of potential threats in cyberspace, including cybercrimes such as phishing attacks, botnets, financial and banking fraud, as well as promoting basic authentication and data protection advice. The Agency should play a central role in accelerating end-user awareness on security of devices and ICT products, processes, services and systems complying with the principle of security by design and by default, while provide end-users guidance on the best cyber hygiene practices also through awareness raising campaigns.

Amendment 128 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Recital 28

(28) The Agency should actively contribute towards raising the awareness of the public about risks, threats and vulnerabilities related to cybersecurity and provide guidance on good practices for individual users aimed at citizens and organisations. The Agency should also contribute to promote best practices and solutions at the level of individuals and organisations by collecting and analysing publicly available information regarding significant incidents, and by compiling reports with a view to providing guidance to businesses and citizens and improving the overall level of preparedness and resilience. The Agency should furthermore organise, in cooperation with the Member States and the Union institutions, bodies, offices and agencies regular outreach and public education campaigns, starting at school level, directed to end-users, aiming at promoting safer individual online behaviour and raising awareness of potential threats in cyberspace, including cybercrimes such as phishing attacks, botnets, financial and banking fraud, as well as promoting basic authentication and data protection advice. The Agency should play a central role in accelerating end-user awareness on security of devices.

Amendment 129 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Gesine MEISSNER, Morten PETERSEN

Proposal for a regulation
Recital 28

Amendment 130 #

Michał BONI, Henna VIRKKUNEN, Massimiliano SALINI, Gunnar HÖKMARK, Marian-Jean MARINESCU

Proposal for a regulation
Recital 28

Amendment 131 #

Proposal for a regulation
Recital 30

(30) To ensure that it fully achieves its objectives, the Agency should liaise with relevant institutions, agencies and bodies, including CERT-EU, European Cybercrime Centre (EC3) at Europol, European Defence Agency (EDA), European Agency for the operational management of large-scale IT systems (eu- LISA), European Aviation Safety Agency (EASA), European Central bank (ECB), European Banking Authority (EBA), the Single Resolution Board (SRB), European Securities and Markets Authority (ESMA), other European and national supervisory authorities as appropriate, the European Standards Organisations (ESOs), relevant stakeholders as appropriate, and any other EU Agency that is involved in cybersecurity. It should also liaise with authorities dealing with data protection in order to exchange know-how and best practices and provide advice on cybersecurity aspects that might have an impact on their work. Representatives of national and Union law enforcement and data protection authorities should be eligible to be represented in the Agency’s Permanent Stakeholders Group. In liaising with law enforcement bodies regarding network and information security aspects that might have an impact on their work, the Agency should respect existing channels of information and established networks.

Amendment 132 #

Proposal for a regulation
Recital 30

(30) To ensure that it fully achieves its objectives, the Agency should liaise with relevant institutions, agencies and bodies, including CERT-EU, European Cybercrime Centre (EC3) at Europol, European Defence Agency (EDA), European Agency for the operational management of large-scale IT systems (eu- LISA), European Aviation Safety Agency (EASA) and any other EU Agency that is involved in ~~cyber~~IT security. It should also liaise with authorities dealing with data protection in order to exchange know-how and best practices and provide advice on ~~cyber~~IT security aspects that might have an impact on their work. Representatives of national and Union law enforcement and data protection authorities should be eligible to be represented in the Agency’s Permanent Stakeholders Group. In liaising with law enforcement bodies regarding network and information security aspects that might have an impact on their work, the Agency should respect existing channels of information and established networks. Partnerships should be established with academic institutions that have research initiatives in the relevant areas, while the input from consumer organisations and other organisations should have appropriate channels and should always be analysed.

Amendment 133 #

Proposal for a regulation
Recital 30

(30) To ensure that it fully achieves its objectives, the Agency should liaise with relevant institutions, EU supervisory and other competent authorities, agencies and bodies, including CERT-EU, European Cybercrime Centre (EC3) at Europol, European Defence Agency (EDA), European Agency for the operational management of large-scale IT systems (eu- LISA), European Central Bank (ECB), European Banking Authority (EBA), European Data Protection Board (EDPB), European Aviation Safety Agency (EASA) and any other EU Agency that is involved in cybersecurity. It should also liaise with authorities dealing with data protection in order to exchange know- how and best practices and provide advice on cybersecurity aspects that might have an impact on their work. Representatives of national and Union law enforcement and data protection authorities should be eligible to be represented in the Agency’s Permanent Stakeholders Group. In liaising with law enforcement bodies regarding network and information security aspects that might have an impact on their work, the Agency should respect existing channels of information and established networks.

Amendment 134 #

Peter KOUROUMBASHEV, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY

Proposal for a regulation
Recital 30

(30) To ensure that it fully achieves its objectives, the Agency should liaise with relevant institutions, EU supervisory and other competent authorities, agencies and bodies, including CERT-EU, European Cybercrime Centre (EC3) at Europol, European Defence Agency (EDA), European Agency for the operational management of large-scale IT systems (eu- LISA), European Central Bank (ECB), European Banking Authority (EBA), European Aviation Safety Agency (EASA) and any other EU Agency that is involved in cybersecurity. It should also liaise with authorities dealing with data protection in order to exchange know-how and best practices and provide advice on cybersecurity aspects that might have an impact on their work. Representatives of national and Union law enforcement and data protection authorities should be eligible to be represented in the Agency’s Permanent Stakeholders Group. In liaising with law enforcement bodies regarding network and information security aspects that might have an impact on their work, the Agency should respect existing channels of information and established networks.

Amendment 135 #

Proposal for a regulation
Recital 30

(30) To ensure that it fully achieves its objectives, the Agency should liaise with relevant institutions, agencies and bodies, including CERT-EU, European Cybercrime Centre (EC3) at Europol, European Defence Agency (EDA), European GNSS Agency (GSA), European Agency for the operational management of large-scale IT systems (eu- LISA), European Aviation Safety Agency (EASA) and any other EU Agency that is involved in cybersecurity. It should also liaise with authorities dealing with data protection in order to exchange know-how and best practices and provide advice on cybersecurity aspects that might have an impact on their work. Representatives of national and Union law enforcement and data protection authorities should be eligible to be represented in the Agency’s Permanent Stakeholders Group. In liaising with law enforcement bodies regarding network and information security aspects that might have an impact on their work, the Agency should respect existing channels of information and established networks.

Amendment 136 #

Proposal for a regulation
Recital 30

(30) To ensure that it fully achieves its objectives, the Agency ~~should~~ought to liaise with relevant institutions, agencies and bodies, including CERT-EU, European Cybercrime Centre (EC3) at Europol, European Defence Agency (EDA), European Agency for the operational management of large-scale IT systems (eu- LISA), European Aviation Safety Agency (EASA) and any other EU Agency that is involved in cybersecurity. It should also liaise with authorities dealing with data protection in order to exchange know-how ~~and~~, for training purposes and to exchange best practices, and provide advice on cybersecurity aspects that might have an impact on their work. Representatives of national and Union law enforcement and data protection authorities should be eligible to be represented in the Agency’s Permanent Stakeholders Group. In liaising with law enforcement bodies regarding network and information security aspects that might have an impact on their work, the Agency should respect existing channels of information and established networks.

Amendment 137 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Recital 32

(32) With a view to increasing Union preparedness infor responding to cybersecurity incidents, the Agency should organise ~~yearly~~ cybersecurity exercises at Union level~~, and, at their request,~~. The frequency of the excercises should reflect similar activities performed on national and international level, and in particular take into account cybersecurity exercises carried out by NATO. At their request, theAgency should support Member States and EU institutions, agencies and bodies in organising exercises.

Amendment 138 #

Proposal for a regulation
Recital 35

(35) The Agency should encourage Member States, manufacturers and service providers to raise their general security standards ~~so that all internet users can~~of their ICT products, processes, services and systems which should comply with basic security obligations in line with the principle of security by design and by default, so that all internet users can be secured and incentivised to take the necessary steps to ensure their own personal cybersecurity. In particular, service providers and product manufacturers should recall, withdraw or recycle products and services that do not meet basic cybersecurity ~~standard~~obligations, while importers and distributors should make sure that ICT products, processes, services and systems they place on the EU market comply with the applicable requirements and do not present a risk to European consumers. In cooperation with competent authorities, ENISA may disseminate information regarding the level of cybersecurity of the products and services offered in the internal market, and issue warnings targeting providers ~~and~~, manufacturers and requiring them to improve the security, including cybersecurity, of their products ~~and service~~, processes, services and systems.

Amendment 139 #

Michał BONI, Seán KELLY, Henna VIRKKUNEN, Massimiliano SALINI, Krišjānis KARIŅŠ, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Recital 35

(35) The Agency should encourage Member States and service providers to raise their general security standards so that all internet users can take the necessary steps to ensure their own personal ~~cybersecurity~~IT security and refrain from allowing the sales or use of devices that do not meet minimum security conditions (for example containing hardware, software or firmware components with any known exploitable security vulnerabilities, unchangeable or uncrypted passwords or access code, incapable of accepting trusted and properly authenticated security updates, without an adequate hierarchy of remedies from the manufacturer or vendor or without proper lifecycle documentation). In particular, service providers and product manufacturers should withdraw or recycle products and services that do not meet ~~cyber~~IT security standards. In cooperation with competent authorities, ENISA may disseminate information regarding the level of ~~cyber~~IT security of the products and services offered in the internal market, and issue warnings targeting providers and manufacturers and requiring them to improve the security, including ~~cyber~~IT security, of their products and services.

Amendment 140 #

Proposal for a regulation
Recital 35

(35) The Agency should encourage Member States and service providers to raise their general security standards so that all internet users can take the necessary steps to ensure their own personal cybersecurity. In particular, service providers and product manufacturers should withdraw or recycle products and services that do not meet cybersecurity standards. In cooperation with competent authorities, ENISA may disseminate information regarding the level of cybersecurity of the products and services offered in the internal market, and issue warnings targeting providers and manufacturers and requiring them to improve the security, including cybersecurity, of their products and services. The Agency should work together with stakeholders towards developing a EU-wide approach to responsible vulnerabilities disclosure and should promote best practices in this area.

Amendment 141 #

Michał BONI, Seán KELLY, Henna VIRKKUNEN, Massimiliano SALINI, Gunnar HÖKMARK, Marian-Jean MARINESCU

Proposal for a regulation
Recital 36 a (new)

(36 a) Standards are a voluntary, market- driven tool providing technical requirements and guidance and resulting from an open, transparent and inclusive process. The Agency should regularly consult and work in close cooperation with the standardization organizations, in particular when preparing the European Cybersecurity Certification Schemes.

Amendment 142 #

Peter KOUROUMBASHEV, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Martina WERNER, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Recital 37

(37) Cybersecurity problems are global issues. There is a need for closer international cooperation to improve security standards, including the definition of common norms of behaviour and codes of conduct, use of international standards, and information sharing, promoting swifter international collaboration in response to, as well as a common global approach to, network and information security issues. To that end, the Agency should support further Union involvement and cooperation with third countries and international organisations by providing, where appropriate, the necessary expertise and analysis to the relevant Union institutions, bodies, offices and agencies.

Amendment 143 #

Proposal for a regulation
Recital 40

(40) The Management Board, composed of the Member States and the Commission, should define the general direction of the Agency’s operations and ensure that it carries out its tasks in accordance with this Regulation. The Management Board should be entrusted with the powers necessary to establish the budget, verify its execution, adopt the appropriate financial rules, establish transparent working procedures for decision making by the Agency, adopt the Agency’s Single Programming Document, adopt its own rules of procedure, appoint the Executive Director and decide on the extension of the Executive Director’s term of office and on the termination thereof. In the light of the highly technical and scientific tasks of the Agency, it is appropriate for the Management Board to consist of members with a high level of expertise in issues within the scope of the Agency’s missions.

Amendment 144 #

Michał BONI, Henna VIRKKUNEN, Massimiliano SALINI

Proposal for a regulation
Recital 40

(40) The Management Board, composed of the Member States and the Commission, should define the general direction of the Agency’s operations and ensure that it carries out its tasks in accordance with this Regulation. The Management Board should be entrusted with the powers necessary to establish the budget, verify its execution, adopt the appropriate financial rules, establish transparent working procedures for decision making by the Agency, adopt the Agency’s Single Programming Document, adopt its own rules of procedure, appoint the Executive Director and decide on the extension of the Executive Director’s term of office and on the termination thereof. Taking into account the highly technical nature of the Agency's mission, members of the Management Board should have appropriate experience in issues within the scope of the Agency's mission.

Amendment 145 #

Proposal for a regulation
Recital 40

(40) The Management Board, ~~composed of~~representing the Member States and the Commission as well as stakeholders relevant for the Agency's objectives, should define the general direction of the Agency’s operations and ensure that it carries out its tasks in accordance with this Regulation. The Management Board should be entrusted with the powers necessary to establish the budget, verify its execution, adopt the appropriate financial rules, establish transparent working procedures for decision making by the Agency, adopt the Agency’s Single Programming Document, adopt its own rules of procedure, appoint the Executive Director and decide on the extension of the Executive Director’s term of office and on the termination thereof.

Amendment 146 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Recital 41

(41) In order for the Agency to function properly and effectively, the Commission and the Member States should ensure that persons to be appointed to the Management Board have appropriate professional expertise and experience in functional areas. The Commission and the Member States should also make efforts to limit the turnover of their respective Representatives on the Management Board in order to ensure continuity in its work. Due to the high market value of the skills required in the Agency's work, it is necessary to ensure that the salaries and the social conditions offered to all Agency staff are competitive and ensure that the best professionals can choose to work there.

Amendment 147 #

Proposal for a regulation
Recital 42

(42) The smooth functioning of the Agency requires that its Executive Director be appointed on grounds of merit and documented administrative and managerial skills, as well as competence and experience relevant for cybersecurity, and that the duties of the Executive Director be carried out with complete independence. The Executive Director should prepare a proposal for the Agency’s work programme, after prior consultation with the Commission, and take all necessary steps to ensure the proper execution of the work programme of the Agency. The Executive Director should prepare an annual report to be submitted to the Management Board, draw up a draft statement of estimates of revenue and expenditure for the Agency, and implement the budget. Furthermore, the Executive Director should have the option of setting up ad hoc Working Groups to address specific matters, in particular of a scientific, technical, legal or socioeconomic nature. The Executive Director should ensure that the ad hoc Working Groups’ members are selected according to the highest standards of expertise, taking due account of a representative and gender balance, as appropriate according to the specific issues in question, between the public administrations of the Member States, the Union institutions and the private sector, including industry, users, and academic experts in network and information security.

Amendment 148 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Recital 42

Amendment 149 #

Proposal for a regulation
Recital 42

(42) The smooth functioning of the Agency requires that its Executive Director be appointed on grounds of merit and documented administrative and managerial skills, as well as competence and experience relevant for cybersecurity, and that the duties of the Executive Director be carried out with complete independence. The Executive Director should prepare a proposal for the Agency’s work programme, after prior consultation with the Commission, and take all necessary steps to ensure the proper execution of the work programme of the Agency. The Executive Director should prepare an annual report to be submitted to the Management Board, draw up a draft statement of estimates of revenue and expenditure for the Agency, and implement the budget. Furthermore, the Executive Director should have the option of setting up ad hoc Working Groups to address specific matters, in particular of a scientific, technical, legal or socioeconomic nature. The Executive Director should ensure that the ad hoc Working Groups’ members are selected according to the highest standards of expertise, taking due account of a representative gender balance, as appropriate according to the specific issues in question, between the public administrations of the Member States, the Union institutions and the private sector, including industry, users, and academic experts in network and information security.

Amendment 150 #

Michał BONI, Massimiliano SALINI, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Recital 44

(44) The Agency should have a Permanent Stakeholders’ Group as an advisory body, to ensure regular dialogue with the private sector, consumers’ organisations and other relevant stakeholders. The Permanent Stakeholders’ Group, set up by the Management Board on a proposal by the Executive Director, should focus on issues relevant to stakeholders and bring them to the attention of the Agency. The composition of the Permanent Stakeholders Group and the tasks assigned to this Group, to be consulted in particular regarding the draft Work Programme, should ensure sufficient representation of stakeholders in the work of the Agency. Given the importance of certification requirements for ensuring trust in the IoT, the Commission should specifically consider implementing measures to ensure the pan-EU security standards harmonisation for IoT devices.

Amendment 151 #

Proposal for a regulation
Recital 44

Amendment 152 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Recital 44

(44) The Agency should have a Permanent Stakeholders’ Group as an advisory body, to ensure regular dialogue with the private sector, consumers’ organisations and other relevant stakeholders. The Permanent Stakeholders’ Group, set up by the Management Board on a proposal by the Executive Director, should focus on issues relevant to stakeholders and bring them to the attention of the Agency. The composition of the Permanent Stakeholders Group and the tasks assigned to this Group, to be consulted in particular regarding the draft Work Programme, should ensure sufficient representation of stakeholders in the work of the Agency. The Permanent Stakeholder Group should be empowered to suggest the preparation of candidate certification schemes.

Amendment 153 #

Proposal for a regulation
Recital 44

(44) The Agency should have a Permanent Stakeholders’ Group as an advisory body, to ensure regular dialogue with the private sector, civil society and consumers’ organisations and other relevant stakeholders. The Permanent Stakeholders’ Group, set up by the Management Board on a proposal by the Executive Director, should focus on issues relevant to stakeholders and bring them to the attention of the Agency. The composition of the Permanent Stakeholders Group and the tasks assigned to this Group, to be consulted in particular regarding the draft Work Programme, should ensure sufficient representation of stakeholders in the work of the Agency and gender balance should be pursued.

Amendment 154 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Recital 44

(44) The Agency should have a Permanent Stakeholders’ Group as an advisory body, to ensure regular dialogue with the public and private sector, consumers’ organisations and other relevant stakeholders. The Permanent Stakeholders’ Group, set up by the Management Board on a proposal by the Executive Director, should focus on issues relevant to stakeholders and bring them to the attention of the Agency. The composition of the Permanent Stakeholders Group and the tasks assigned to this Group, to be consulted in particular regarding the draft Work Programme, should ensure sufficient representation of stakeholders in the work of the Agency.

Amendment 155 #

Michał BONI, Seán KELLY, Henna VIRKKUNEN, Massimiliano SALINI, Gunnar HÖKMARK, Marian-Jean MARINESCU

Proposal for a regulation
Recital 46

(46) In order to guarantee the full autonomy and independence of the Agency and to enable it to perform additional and new tasks, including unforeseen emergency tasks, the Agency should be granted a sufficient and autonomous budget whose revenue comes primarily from a contribution from the Union and contributions from third countries participating in the Agency’s work. The appropriate budget is paramount to ensure that the Agency has sufficient capacities to fulfill all its growing tasks and objectives. The majority of the Agency staff should be directly engaged in the operational implementation of the Agency’s mandate. The host Member State, or any other Member State, should be allowed to make voluntary contributions to the revenue of the Agency. The Union’s budgetary procedure should remain applicable as far as any subsidies chargeable to the general budget of the Union are concerned. Moreover, the Court of Auditors should audit the Agency’s accounts to ensure transparency and accountability.

Amendment 156 #

Proposal for a regulation
Recital 46

(46) In order to guarantee the full autonomy and independence of the Agency and to enable it to perform additional and new tasks, including unforeseen emergency tasks, the Agency should be granted a sufficient and autonomous budget whose revenue comes primarily from a contribution from the Union and contributions from third countries participating in the Agency’s work. The majority of the Agency staff should be directly engaged in the operational implementation of the Agency’s mandate. The host Member State, or any other Member State, should be allowed to make voluntary contributions to the revenue of the Agency. The Union’s budgetary procedure should remain applicable as far as any subsidies chargeable to the general budget of the Union are concerned. Moreover, the Court of Auditors should audit the Agency’s accounts to ensure transparency and accountability, and the efficiency of the expenditure.

Amendment 157 #

Eva KAILI

Proposal for a regulation
Recital 47

(47) Conformity assessment is the process demonstrating whether specified requirements relating to a product, process, service, system, person or body have been fulfilled. For the purposes of this Regulation, certification and self- assessment should be considered as a type of conformity assessment regarding the cybersecurity features of a product, process, service, system, or a combination of those ("ICT products ~~and~~, services"), processes"). Certification is undertaken by an independent third party, other than the product manufacturer or service provider. ~~Certification~~Self-assessment may be undertaken by the product manufacturer or operator where the likelihood of a cybersecurity incident occurring, and/or the likelihood of such incident causing substantial harm to society or a large section thereof, is not expected to be high or substantial, taking into account the manufacturer or service provider’s intended use of the product or service in question. Conformity assessment cannot guarantee per se that certified ICT products and services are cyber secure. It is rather a procedure and technical methodology to attest that ICT products and services have been tested and that they comply with certain cybersecurity requirements laid down elsewhere, for example as specified in technical standards.

Amendment 158 #

Peter KOUROUMBASHEV, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY

Proposal for a regulation
Recital 47

(47) Conformity assessment is the process demonstrating whether specified requirements relating to a product, process, service, system, person or body have been fulfilled. For the purposes of this Regulation, certification and, where permitted, self-assessment should be considered as a type of conformity assessment regarding the cybersecurity features of a product, process, service, system, or a combination of those ("ICT products and services"). Certification is undertaken by an independent third party, other than the product manufacturer or service provider. Self-assessment may be undertaken by the product manufacturer or service provider, as foreseen in and according to the New Legislative Framework and specified in this Regulation, where the likelihood of a cybersecurity incident occurring, or the likelihood of such an incident causing substantial harm to the user, society, or a part thereof, is not expected to be high. Certification cannot guarantee per se that certified ICT products and services are cyber secure. It is rather a procedure and technical methodology to attest that ICT products and services have been tested and that they comply with certain cybersecurity requirements laid down elsewhere, for example as specified in technical standards.

Amendment 159 #

Proposal for a regulation
Recital 47

(47) Conformity assessment is the process demonstrating whether specified requirements relating to a product, process, service, system, person or body have been fulfilled. For the purposes of this Regulation, certification and self- assessment should be considered as a type of conformity assessment regarding the cybersecurity features of a product, process, service, system, or a combination of those ("ICT products and services"). Certification is undertaken by an independent third party, other than the product manufacturer or service provider. ~~Certification~~Self-assessment may be undertaken by the product manufacturer or operator where the likelihood of a cybersecurity incident occurring, and/or the likelihood of such incident causing substantial harm to society or a large section thereof, is not expected to be high, taking into account the manufacturer or service provider’s intended use of the product or service in question. Conformity assessment cannot guarantee per se that certified ICT products and services are cyber secure. It is rather a procedure and technical methodology to attest that ICT products and services have been tested and that they comply with certain cybersecurity requirements laid down elsewhere, for example as specified in technical standards.

Amendment 160 #

Clare MOODY, Theresa GRIFFIN

Proposal for a regulation
Recital 47

(47) Conformity assessment is the process demonstrating whether specified requirements relating to a product, process, service, system, person or body have been fulfilled. For the purposes of this Regulation, certification and self assessment should be considered as a type of conformity assessment regarding the cybersecurity features of a product, process, service, system, or a combination of those ("ICT products and services") by an independent third party, other than the product manufacturer or service provider. Self-assessment may be undertaken by SMEs for conformity with the lowest assurance level. Certification cannot guarantee per se that certified ICT products and services are cyber secure and this must be duly communicated to consumers and businesses. It is rather a procedure and technical methodology to attest that ICT products and services have been tested and that they comply with certain cybersecurity requirements laid down elsewhere, for example as specified in technical standards.

Amendment 161 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Caroline NAGTEGAAL, Gesine MEISSNER, Morten PETERSEN

Proposal for a regulation
Recital 47

(47) Conformity assessment is the process demonstrating whether specified requirements relating to a product, process, service, system, person or body have been fulfilled. For the purposes of this Regulation, certification should be considered as a type of conformity assessment regarding the cybersecurity features of a product, process, service, system, or a combination of those ("ICT products and services") by an independent third party, other than the product manufacturer or service provider. Certification cannot guarantee per se that certified ICT products and services are cyber secure. It is rather a procedure and technical methodology to attest that ICT products and services have been tested and that they comply with certain cybersecurity requirements laid down elsewhere, for example as specified in technical standards. Undertakings should also ensure the security by design and by default of their ICT products and services taking into account the state of the art.

Amendment 162 #

Esther DE LANGE

Proposal for a regulation
Recital 47

(47) Conformity assessment is the process demonstrating whether specified requirements relating to a product, process, service, system, person or body have been fulfilled. For the purposes of this Regulation, certification should be considered as a type of conformity assessment regarding the cybersecurity features of a product, process, service, system, or a combination of those ("ICT products and services") by an independent third party, other than the product manufacturer or service provider. Certification cannot guarantee per se that certified ICT products and services are cyber secure. It is rather a procedure and technical methodology to attest that ICT products and services have been tested and that they comply with certain cybersecurity requirements laid down elsewhere, for example as specified in technical standards. These include an indication whether an ICT product and service is able to execute its regular functions while disconnected from the internet.

Amendment 163 #

Pavel TELIČKA, Carolina PUNSET, Caroline NAGTEGAAL, Gesine MEISSNER, Morten PETERSEN

Proposal for a regulation
Recital 47

(47) Conformity assessment is the process demonstrating whether specified requirements relating to a product, process, service, system, person or body have been fulfilled. For the purposes of this Regulation, certification should be considered as a type of conformity assessment regarding the cybersecurity features ofand practices comprised in a product, process, service, system, or a combination of those ("ICT products and services") by an independent third party, other than the product manufacturer or service provider. Certification cannot guarantee per se that certified ICT processes and systems result in ICT products and services that are cyber secure. It is rather a procedure and technical methodology to attest that ICT products and services as well as processes and systems have been tested and that they comply with certain cybersecurity requirements laid down elsewhere, for example as specified in ~~technical~~relevant standards.

Amendment 164 #

Proposal for a regulation
Recital 48 a (new)

(48 a) Despite the fact that it is not possible to foresee future technology and market developments, producers should take into account all known threats when developing their products. Producers should also be liable for the quality of a product put on the EU market, including cyber resilience. At the same time, consumers should assume their share of responsibility by following basic rules of cyber hygiene, which could significantly reduce the number of human errors in the field of cybersecurity.

Amendment 165 #

Michał BONI, Seán KELLY, Massimiliano SALINI, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Recital 50

(50) Currently, the cybersecurity certification of ICT products and services is used only to a limited extent. When it exists, it mostly occurs at Member State level or in the framework of industry driven schemes. In this context, a certificate issued by one national cybersecurity authority is not in principle recognised by other Member States. Companies thus may have to certify their products and services in several Member States where they operate, for example with a view to participating in national procurement procedures. Moreover, while new schemes are emerging, there seems to be no coherent and holistic approach with regard to horizontal cybersecurity issues, for instance in the field of the Internet of Things. Existing schemes present significant shortcomings and differences in terms of product coverage, levels of assurance, substantive criteria and actual utilisation. A case by case approach is required to ensure that services, processes and products are subject to appropriate certification schemes. Additionally, a risk- based approach is needed for effective identification and mitigation of risks whilst acknowledging that a one size fits all scheme is not possible.

Amendment 166 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Gesine MEISSNER, Morten PETERSEN

Proposal for a regulation
Recital 50

(50) Currently, the cybersecurity certification of ICT products and services is used only to a limited extent. When it exists, it mostly occurs at Member State level or in the framework of industry driven schemes. In this context, a certificate issued by one national cybersecurity authority is not in principle recognised by other Member States. Companies thus may have to certify their products and services in several Member States where they operate, for example with a view to participating in national procurement procedures. Moreover, while new schemes are emerging, there seems to be no coherent and holistic approach with regard to horizontal cybersecurity issues, for instance in the field of the Internet of Things. Existing schemes present significant shortcomings and differences in terms of product coverage, levels of assurance, substantive criteria and actual utilisation. Mutual recognition and trust among Member States is a key element in this respect. ENISA has an important role to play in helping the Member States develop a solid institutional structure and expertise in protection against potential cyber attacks.

Amendment 167 #

Michał BONI, Seán KELLY, Henna VIRKKUNEN, Massimiliano SALINI, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Recital 52

(52) In view of the above, it is necessary to establish a European ~~cyber~~IT security certification framework laying down the main horizontal requirements for European ~~cyber~~IT security certification schemes to be developed and allowing certificates for ICT products and services to be recognised and used in all Member States. The European framework should have a twofold purpose: on the one hand, it should help increase trust in ICT products and services that have been certified according to such schemes. On the other hand, it should avoid the multiplication of conflicting or overlapping national ~~cyber~~IT security certifications and thus reduce costs for undertakings operating in the digital single market. The schemes should be guided by security-by-design and the principles referred in Regulation (EU) 2016/679, be non-discriminatory and based on ~~international~~selected ISO/IEC and / or Union standards, unless those standards are ineffective or inappropriate to fulfil the EU’s legitimate objectives in that regard.

Amendment 168 #

Proposal for a regulation
Recital 52 a (new)

(52 a) Notes that certification schemes should build upon what already exists at national and international level, learning from current strong points and assessing and correcting weaknesses.

Amendment 169 #

Michał BONI, Seán KELLY, Henna VIRKKUNEN, Massimiliano SALINI, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Recital 52 b (new)

(52 b) Flexible cybersecurity solutions are necessary for industry to stay ahead of malicious attacks and threats, therefore any certification scheme should avoid the risk of being outdated quickly.

Amendment 170 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Caroline NAGTEGAAL, Gesine MEISSNER, Morten PETERSEN

Proposal for a regulation
Recital 53

(53) The Commission should be empowered to adopt European cybersecurity certification schemes concerning specific groups of ICT products and services. These schemes should be implemented and supervised by national certification supervisory authorities and certificates issued within these schemes should be valid and recognised throughout the Union. Certification schemes operated by the industry or other private organisations should fall outside the scope of the Regulation. However, the bodies operating such schemes may propose to the Commission to consider such schemes as a basis for approving them as a European scheme. Industry actors can operate a self-assessment of their products or services prior to certification, thereby indicating their product or service is ready to begin the certification process if required or needed.

Amendment 171 #

Peter KOUROUMBASHEV, Carlos ZORRINHO, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Recital 53

(53) The Commission ~~should be empowered to adopt~~, the European Cybersecurity Certification Group and the Stakeholer Certification Group should propose to ENISA to prepare a European cybersecurity certification schemes concerning specific groups of ICT products and services. These schemes should be implemented and supervised by national certification supervisory authorities and certificates issued within these schemes should be valid and recognised throughout the Union. Certification schemes operated by the industry or other private organisations should fall outside the scope of the Regulation. However, the bodies operating such schemes may propose to the Commission to consider such schemes as a basis for approving them as a European scheme.

Amendment 172 #

Proposal for a regulation
Recital 53 a (new)

(53 a) The Agency and the Commission should make the best use of already existing certification schemes on the EU and / or international level. ENISA should be able to assess which schemes already in use are fit for purpose and can be brought in the European legislation in cooperation with EU standardisation organisations and, as far as possible, internationally recognised. Existing good practices should be collected and shared among Member States.

Amendment 173 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Recital 55

(55) The purpose of European cybersecurity certification schemes should be to ensure that ICT products ~~and servic~~, services and processes certified under such a scheme comply with specified requirements. Such requirements concern the ability to resist, at a given level of ~~assurance~~risk, actions that aim to compromise the availability, authenticity, integrity and confidentiality of stored or transmitted or processed data or the related functions of or services offered by, or accessible via those products, processes, services and systems within the meaning of this Regulation. It is not possible to set out in detail in this Regulation the cybersecurity requirements relating to all ICT products ~~and services. ICT products and servic~~, services and processes. ICT products, services and processes and related cybersecurity needs are so diverse that it is very difficult to come up with general cybersecurity requirements valid across the board. It is, therefore necessary to adopt a broad and general notion of cybersecurity for the purpose of certification, complemented by a set of specific cybersecurity objectives that need to be taken into account when designing European cybersecurity certification schemes. The modalities with which such objectives will be achieved in specific ICT products ~~and servic~~, services and processes should then be further specified in detail at the level of the individual certification scheme adopted by the Commission, for example by reference to standards or technical specifications. All actors involved in a given supply chain should be encouraged in order to develop and adopt security standards, technical norms and security by design principles, at all stages of the product, service or process lifecycle; each European cybersecurity certification scheme should be designed to reach this scope.

Amendment 174 #

Proposal for a regulation
Recital 55

(55) The purpose of European cybersecurity certification schemes should be to ensure that ICT products and services certified under such a scheme comply with specified ~~requirements~~cybersecurity requirements defined on a risk assessment checklist developed by ENISA. Such requirements concern the ability to resist, at a given level of assurance, actions that aim to compromise the availability, authenticity, integrity and confidentiality of stored or transmitted or processed data or the related functions of or services offered by, or accessible via those products, processes, services and systems within the meaning of this Regulation. It is not possible to set out in detail in this Regulation the cybersecurity requirements relating to all ICT products and services. ICT products and services and related cybersecurity needs are so diverse that it is very difficult to come up with general cybersecurity requirements valid across the board. It is, therefore necessary to adopt a broad and general notion of cybersecurity for the purpose of certification, complemented by a set of specific cybersecurity objectives that need to be taken into account when designing European cybersecurity certification schemes. The modalities with which such objectives will be achieved in specific ICT products and services should then be further specified in detail at the level of the individual certification scheme adopted by the Commission, for example by reference to standards or technical specifications.

Amendment 175 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Recital 56

(56) The Commission should be empowered to request ENISA to prepare candidate schemes for specific ICT products or services on the basis of justified grounds (i.e. fragmentation of the internal market, need to support specific Union legislation or consensual request from Members States, the European Cybersecurity Certification group and the Permanent Stakeholder Group) . The Commission, based on the candidate scheme proposed by ENISA, should then be empowered to adopt the European cybersecurity certification scheme by means of implementing acts. Taking account of the general purpose and security objectives identified in this Regulation, European cybersecurity certification schemes adopted by the Commission should specify a minimum set of elements concerning the subject-matter, the scope and functioning of the individual scheme. These should include among others the scope and object of the cybersecurity certification, including the categories of ICT products and services covered, the detailed specification of the cybersecurity requirements, for example by reference to standards or technical specifications, the specific evaluation criteria and evaluation methods, as well as the intended level of assurance: basic, substantial and/or high.

Amendment 176 #

Proposal for a regulation
Recital 56

(56) The process of preparation and adoption of the certification schemes should be inclusive and transparent. The Commission should be empowered to request ENISA to prepare candidate schemes for specific ICT products or services. The Commission, based on the candidate scheme proposed by ENISA, should then be empowered to adopt the European cybersecurity certification scheme by means of implementing acts. Taking account of the general purpose and security objectives identified in this Regulation, European cybersecurity certification schemes adopted by the Commission should specify a minimum set of elements concerning the subject-matter, the scope and functioning of the individual scheme. These should include among others the scope and object of the cybersecurity certification, including the categories of ICT products and services covered, the detailed specification of the cybersecurity requirements, for example by reference to standards or technical specifications, the specific evaluation criteria and evaluation methods, as well as the intended level of assurance: basic, substantial and/or high.

Amendment 177 #

Peter KOUROUMBASHEV, Edouard MARTIN, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Recital 56

(56) TAfter the completion of an appropriate stakeholder consultation by the Commission, ENISA should be empowered to ~~request ENISA to~~ prepare candidate schemes for specific ICT products or services. The Commission, based on the candidate scheme proposed by ENISA, should then be empowered to adopt the European cybersecurity certification scheme by means of ~~implementing~~delegated acts. Taking account of the general purpose and security objectives identified in this Regulation, European cybersecurity certification schemes adopted by the Commission should specify a minimum set of elements concerning the subject-matter, the scope and functioning of the individual scheme. These should include among others the scope and object of the cybersecurity certification, including the categories of ICT products and services covered, the detailed specification of the cybersecurity requirements, for example by reference to standards or technical specifications, the specific evaluation criteria and evaluation methods, as well as the intended level of assurance: basic, substantial and/or high.

Amendment 178 #

Michał BONI, Massimiliano SALINI, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Recital 57

(57) Recourse to European cybersecurity certification should remain voluntary, unless otherwise provided in Union or national legislation. However, was the existence of baseline IT security requirements is of utmost importance for the consumers as well as for the security of networks, some situations needs to be treated in a harmonised and mandatory way. Solutions need to be implemented on all consumer devices and services in order to tackle the challenges of an increasingly connected world. Such minimal requirements could include authentication, security of connections and patches for the discovered vulnerabilities. With a view to achieving the objectives of this Regulation and avoiding the fragmentation of the internal market, national cybersecurity certification schemes or procedures for the ICT products and services covered by a European cybersecurity certification scheme should cease to produce effects from the date established by the Commission by means of the implementing act. Moreover, Member States should not introduce new national certification schemes providing cybersecurity certification schemes for ICT products and services already covered by an existing European cybersecurity certification scheme.

Amendment 179 #

Proposal for a regulation
Recital 57

(57) Recourse to European cybersecurity certification should remain voluntary, unless otherwise provided in Union or national legislation. After this initial stage, and depending on the maturity of implementation in the Member States and the criticality of a product or service, it is recognised that, in the future, potentially mandatory schemes for certain ICT products, processes and services may begin to evolve in a phased approach for the future generations of technology and in response to the policy objectives of tomorrow. However, with a view to achieving the objectives of this Regulation and avoiding the fragmentation of the internal market, national cybersecurity certification schemes or procedures for the ICT products and services covered by a European cybersecurity certification scheme should cease to produce effects from the date established by the Commission by means of the implementing act. Moreover, Member States should not introduce new national certification schemes providing cybersecurity certification schemes for ICT products and services already covered by an existing European cybersecurity certification scheme.

Amendment 180 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Recital 57

(57) Recourse to European cybersecurity certification should remain voluntary, unless otherwise provided in ~~Union or national legislation. However, w~~the present Regulation or other Union and national legislation. European cybersecurity certification should for instance be mandatory for ICT product, processes, services and systems with high inherent risk intended for use by operators of essential services, by children, at home, in connected cars and medical devices, among others. With a view to achieving the objectives of this Regulation and avoiding the fragmentation of the internal market, national cybersecurity certification schemes or procedures for the ICT products and services covered by a European cybersecurity certification scheme should cease to produce effects from the date established by the Commission by means of the implementing act. Moreover, Member States should not introduce new national certification schemes providing cybersecurity certification schemes for ICT products and services already covered by an existing European cybersecurity certification scheme.

Amendment 181 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Recital 57

Amendment 182 #

Proposal for a regulation
Recital 57

(57) Recourse to European cybersecurity certification should ~~remain voluntary~~be voluntary for assurance levels considered basic or substantial but should be mandatory for assurance levels considered medium and high, unless otherwise provided in Union or national legislation. However, with a view to achieving the objectives of this Regulation and avoiding the fragmentation of the internal market, national cybersecurity certification schemes or procedures for the ICT products and services covered by a European cybersecurity certification scheme should cease to produce effects from the date established by the Commission by means of the implementing act. Moreover, Member States should not introduce new national certification schemes providing cybersecurity certification schemes for ICT products and services already covered by an existing European cybersecurity certification scheme.

Amendment 183 #

Esther DE LANGE

Proposal for a regulation
Recital 57

(57) Recourse to European cybersecurity certification should in the long run become mandatory, but can as a starting point remain voluntary, unless otherwise provided in Union or national legislation. However, with a view to achieving the objectives of this Regulation and avoiding the fragmentation of the internal market, national cybersecurity certification schemes or procedures for the ICT products and services covered by a European cybersecurity certification scheme should cease to produce effects from the date established by the Commission by means of the implementing act. Moreover, Member States should not introduce new national certification schemes providing cybersecurity certification schemes for ICT products and services already covered by an existing European cybersecurity certification scheme.

Amendment 184 #

Proposal for a regulation
Recital 57 a (new)

(57 a) When proposing new European cybersecurity schemes, ENISA and other relevant bodies should pay due attention to the competitive dynamics of the proposal, specifically making sure that where the sector concerned has many of small and medium sized enterprises, such as in software development, certification schemes do not form a barrier for entry for new businesses and innovations.

Amendment 185 #

Proposal for a regulation
Recital 57 a (new)

(57 a) A duty to issue a product declaration containing structured information in respect of the certification of the product, process or service is introduced to provide the consumer with more information and to allow the consumer to make a well-founded choice, thereby reinforcing trust in the digital internal market.

Amendment 186 #

Proposal for a regulation
Recital 57 b (new)

(57 b) European cybersecurity schemes will help to harmonise and unify cybersecurity practices within the EU. They must not however become the minimum level of cybersecurity. The design of European cybersecurity schemes should also take into account and allow for development of new innovations in the field of cybersecurity.

Amendment 187 #

Proposal for a regulation
Recital 58

(58) Once a European cybersecurity certification scheme is adopted, manufacturers of ICT products or providers of ICT services should be able to submit an application for certification of their products or services to a conformity assessment body of their choice. Conformity assessment bodies should be accredited by an accreditation body if they comply with certain specified requirements set out in this Regulation. Accreditation should be issued for a maximum of five years and may be renewed on the same conditions provided that the conformity assessment body meets the requirements. Accreditation bodies should revoke an accreditation of a conformity assessment body where the conditions for the accreditation are not, or are no longer, met or where actions taken by a conformity assessment body infringe this Regulation. Audits by the Agency should be carried out to ensure an equivalent level of quality and diligence of conformity assessment bodies with a view to avoiding regulatory arbitrage. The results should be reported to the Agency, the Commission and Parliament and should be made publicly available.

Amendment 188 #

Peter KOUROUMBASHEV, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Recital 58

(58) Once a European cybersecurity certification scheme is adopted, manufacturers of ICT products or providers of ICT services should be able to submit an application for certification of their products or services to a conformity assessment body of their choice, anywhere in the Union. Conformity assessment bodies should be accredited by an accreditation body if they comply with certain specified requirements set out in this Regulation. Accreditation should be issued for a maximum of five years and may be renewed on the same conditions provided that the conformity assessment body meets the requirements. Accreditation bodies should revoke an accreditation of a conformity assessment body where the conditions for the accreditation are not, or are no longer, met or where actions taken by a conformity assessment body infringe this Regulation.

Amendment 189 #

Proposal for a regulation
Recital 58 a (new)

(58 a) (58 a) Clear and mandatory baseline IT security requirements should be devised by the Agency, and should be proposed to the Commission to be promoted through binding acts, for all IT devices sold in or exported from the Union. Those requirements should be developed within two years after the date of entry into force of this Regulation and revised every two years thereafter, in order to ensure constant and dynamic improvements. These baseline IT security requirements should require, inter alia, that the device does not contain any known security vulnerability, that it is capable of accepting trusted security updates, that the vendor notifies competent authorities of known vulnerabilities and repairs or replaces the affected device, or that the vendor informs when security support for such device will end.

Amendment 190 #

Proposal for a regulation
Recital 58 a (new)

(58 a) Already existing national and international standards developed on the market, as well as informal agreements of international associations, notably the Internet Engineering Taskforce and the World Wide Web Consortium, should be taken into consideration when preparing candidate schemes.

Amendment 191 #

Peter KOUROUMBASHEV, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Recital 59

(59) It is necessary to require all Member States to designate one cybersecurity certification supervisory authority to supervise compliance of conformity assessment bodies and of certificates issued by conformity assessment bodies established in their territory with the requirements of this Regulation and of the relevant cybersecurity certification schemes, and to ensure that the European cybersecurity certificates are recognised on their territory. National certification supervisory authorities should handle complaints lodged by natural or legal persons in relation to certificates issued by conformity assessment bodies established in their territories, or in relation to alleged failures to recognise certificates on their territory, investigate to the extent appropriate the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable time period. Moreover, they should cooperate with other national certification supervisory authorities or other public authority, including by sharing information on possible non-compliance of ICT products and services with the requirements of this Regulation or specific cybersecurity schemes, or the non- recognition of European cybersecurity certificates.

Amendment 192 #

Peter KOUROUMBASHEV, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Recital 60 a (new)

(60 a) With a view to ensuring the consistent and future-proof application of the European cybersecurity certification framework, a Stakeholder Certification Group should be established within ENISA. It should consist of recognised experts representing academics, standardisation bodies, consumer groups, ICT industry and non-public sector operators of essential services as defined in Annex II of Directive (EU) 2016/1148, who will advise and assist ENISA to ensure a consistent implementation and application of the European cybersecurity certification framework; assist and closely cooperate with the Agency in the preparation and adoption of candidate cybersecurity certification schemes; recommend candidate European cybersecurity certification schemes; and adopt opinions addressed to the Commission relating to the maintenance and review of existing European cybersecurity certifications schemes. The Stakeholder Certification Group should be set up with the objective to allow expert input from relevant stakeholders to the European cybersecurity certification framework. The structure of the Stakeholder Certification Group should allow for ad-hoc members to be invited to contribute to the work on the proposal, development or adoption of any new candidate scheme.

Amendment 193 #

Peter KOUROUMBASHEV, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Recital 63

(63) In order to specify further the criteria for the accreditation of conformity assessment bodies and to ensure uniform conditions for the implementation of this Regulation, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission. The Commission should carry out appropriate consultations during its preparatory work, including at expert level and with all interested stakeholders, including those that do not participate in the above groups. Those consultations should be conducted in accordance with the principles laid down in the Interinstitutional Agreement on Better Law-Making of 13 April 2016. In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council should receive all documents at the same time as Member States' experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts.

Amendment 194 #

Proposal for a regulation
Recital 63

(63) In order to specify further the criteria for the accreditation of conformity assessment bodies, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission. The Commission should carry out appropriate consultations during its preparatory work, including at expert level and with relevant stakeholders, as appropriate. Those consultations should be conducted in accordance with the principles laid down in the Interinstitutional Agreement on Better Law-Making of 13 April 2016. In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council should receive all documents at the same time as Member States' experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts.

Amendment 195 #

Peter KOUROUMBASHEV, Edouard MARTIN, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Recital 64

(64) In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission when provided for by this Regulation. Those powers should be exercised in accordance with Regulation (EU) No 182/2011.deleted

Amendment 196 #

Peter KOUROUMBASHEV, Edouard MARTIN, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Recital 65

(65) ~~The examination procedure should be used for the adoption of implementing acts~~Delegated acts could be furthermore adopted on European cybersecurity certification schemes for ICT products and services; on modalities of carrying enquiries by the Agency; as well as on the circumstances, formats and procedures of notifications of accredited conformity assessment bodies by the national certification supervisory authorities to the Commission.

Amendment 197 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Recital 68 a (new)

(68a) ICT products and services are consumer products for electronic communications as well as other networked consumer products and products closely linked to consumers such as smart home products and smart meters that digitally collect and transmit information.

Amendment 198 #

Proposal for a regulation
Article 1 – paragraph 1 – introductory part

With a view to ensuring the proper functioning of the internal market while aiming at a high level of cyber~~security, cyber resilience~~ resilience, cybersecurity and trust within the Union, this Regulation:

Amendment 199 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 1 – paragraph 1 – point a

(a) lays down the objectives, tasks and organisational aspects of ENISA, the "EU Cyber~~security~~ resilience Agency", hereinafter ‘the Agency’; and (This amendment applies throughout the text and its adoption will entail corresponding change throughout.)

Amendment 200 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 1 – paragraph 1 – point a

(a) lays down the objectives, tasks and organisational aspects of ENISA, the "EU Cybersecurity Agency", hereinafter ‘the Agency’; ~~and~~

Amendment 201 #

Proposal for a regulation
Article 1 – paragraph 1 – point b

(b) lays down a framework for the establishment of European cybersecurity certification schemes for the purpose of ensuring an adequate level of cybersecurity of ICT products ~~and service~~, processes, services and systems in the Union. Such framework shall apply without prejudice to specific provisions regarding voluntary or mandatory certification in other Union acts. (This amendment applies throughout the text and its adoption will entail corresponding change throughout.)

Amendment 202 #

Peter KOUROUMBASHEV, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Martina WERNER, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 1 – paragraph 1 – point b

(b) lays down a framework for the establishment of European cybersecurity certification schemes for the purpose of ensuring an adequate level of cybersecurity of ICT products ~~and servic~~, services and processes in the Union. Such framework shall apply without prejudice to specific provisions regarding voluntary or mandatory certification in other Union acts.

Amendment 203 #

Proposal for a regulation
Article 1 – paragraph 1 – point b

Amendment 204 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Gerben-Jan GERBRANDY, Jan Philipp ALBRECHT, Felix REDA, Urmas PAET, Kaja KALLAS, Pavel TELIČKA, Fredrick FEDERLEY, Dita CHARANZOVÁ, Neena GILL, Morten LØKKEGAARD

Proposal for a regulation
Article 1 – paragraph 1 – point b

Amendment 205 #

Michał BONI, Henna VIRKKUNEN, Massimiliano SALINI, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Article 1 – paragraph 1 – point b

(b) lays down a framework for the establishment of European cybersecurity certification schemes for the purpose of ensuring an adequate level of cybersecurity of ICT products and services in the Union. Such framework shall apply without prejudice to specific provisions regarding voluntary or mandatory certification in other Union acts.; and

Amendment 206 #

Proposal for a regulation
Article 1 – paragraph 1 – point b

(b) lays down a framework for the establishment of European cybersecurity certification schemes for the purpose of ensuring an adequate level of cybersecurity of ICT products, processes and services in the Union. Such framework shall apply without prejudice to specific provisions regarding voluntary ~~or mandatory~~ certification in other Union acts.

Amendment 207 #

Proposal for a regulation
Article 1 – paragraph 1 – point b a (new)

(b a) The principles of free movement of goods and services and non- discrimination shall be regarded for all actions under this Regulation, in particular as regards the preparation, adoption and application of standards and technical specifications defining technical requirements and/or security evaluation methodology associated with a cybersecurity scheme.

Amendment 208 #

Proposal for a regulation
Article 1 – paragraph 1 – point b a (new)

(b a) c) protects the national interests and security of the Member States by respecting their competences regarding issues of specific national interest.

Amendment 209 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 1 – paragraph 1 a (new)

All measures to be taken under the Regulation shall have regard for the principles of free movement of goods and services established in the Treaty on the Functioning of the European Union and shall be non-discriminatory. This concerns in particular the preparation, adoption and application of standards and technical specifications defining technical requirements and/or a security evaluation methodology associated with a cybersecurity scheme.

Amendment 210 #

Proposal for a regulation
Article 2 – paragraph 1 – point 5 a (new)

(5 a) “national certification supervisory authority” means an authority of a Member State responsible for carrying out monitoring, enforcement and supervisory tasks in relation to IT security certification on its territory;

Amendment 211 #

Proposal for a regulation
Article 2 – paragraph 1 – point 8

(8) ‘cyber threat’ means any action including an automated command, potential circumstance or event, that may adversely impact network and information systems, their users and affected persons.;

Amendment 212 #

Peter KOUROUMBASHEV, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 2 – paragraph 1 – point 8

(8) ‘cyber threat’ means any pointentional ~~circumstance or event~~action, including an automated command, that may adversely impact network and information systems, their users and affected persons.;

Amendment 213 #

Proposal for a regulation
Article 2 – paragraph 1 – point 8 a (new)

(8 a) Cyber hygiene refers to establishing simple routine measures, such as multi-factor authentication, patching, encryption, micro-segmentation, and least privilege, that users and businesses can take to minimise the risks from cyber threats and better protect themselves online.

Amendment 214 #

Proposal for a regulation
Article 2 – paragraph 1 – point 8 a (new)

(8 a) 'cyber hygiene' refers to establishing simple routine measures, such as multi-factor authentication, patching, encryption, micro-segmentation, and least privilege, that users and businesses can take to minimise the risks from cyber threats and better protect themselves online.

Amendment 215 #

Peter KOUROUMBASHEV, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 2 – paragraph 1 – point 8 a (new)

(8 a) ‘cyber incident’ means any intentional or unintentional action or event that may adversely impact network and information systems, their users and affected persons;

Amendment 216 #

Henna VIRKKUNEN, Michał BONI

Proposal for a regulation
Article 2 – paragraph 1 – point 9

(9) ‘European cybersecurity certification scheme’ means the comprehensive set of rules, technical requirements~~, standards~~ and procedures defined at Union level and according to standards or ICT technical specifications as defined in Regulation (EU) No 1025/2012, applying to the certification of Information and Communication Technology (ICT) products, processes and services falling under the scope of that specific scheme;

Amendment 217 #

Proposal for a regulation
Article 2 – paragraph 1 – point 9

(9) ‘European cybersecurity certification scheme’ means the comprehensive set of rules, technical requirements, standards, taking into account international and national standards that already exist, and procedures defined at Union level applying to the certification of Information and Communication Technology (ICT) products, processes and services falling under the scope of that specific scheme;

Amendment 218 #

Proposal for a regulation
Article 2 – paragraph 1 – point 9

(9) ‘European cybersecurity certification scheme’ means the comprehensive set of rules, technical requirements, standards and procedures defined at Union level and according to ISO/IEC and European standards selected by ENISA, applying to the certification of Information and Communication Technology (ICT) products, processes and services falling under the scope of that specific scheme;

Amendment 219 #

Proposal for a regulation
Article 2 – paragraph 1 – point 9

(9) ‘European cybersecurity certification scheme’ means the comprehensive set of rules, technical requirements, standards and procedures defined at Union level applying to the certification of Information and Communication Technology (ICT) products ~~and service~~, processes, services and systems falling under the scope of that specific scheme;

Amendment 220 #

Peter KOUROUMBASHEV, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Martina WERNER, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 2 – paragraph 1 – point 9

(9) ‘European cybersecurity certification scheme’ means the comprehensive set of rules, technical requirements, standards and procedures defined at Union level applying to the certification of Information and Communication Technology (ICT) products ~~and servic~~, services and processes falling under the scope of that specific scheme;

Amendment 221 #

Michał BONI, Henna VIRKKUNEN, Massimiliano SALINI, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Article 2 – paragraph 1 – point 9

(9) ‘European cybersecurity certification scheme’ means the comprehensive set of rules, technical requirements~~, standards~~ and procedures defined at Union level applying to the certification of Information and Communication Technology (ICT) products and services falling under the scope of that specific scheme;

Amendment 222 #

Peter KOUROUMBASHEV, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Martina WERNER, Dan NICA, Clare MOODY

Proposal for a regulation
Article 2 – paragraph 1 – point 9 a (new)

(9 a) ‘European cybersecurity self- assurance scheme’ means the comprehensive set of rules, technical specifications or requirements, standards and procedures defined at Union level applying to the self-assessment of ICT products, services and processes falling under the scope of that specific scheme;

Amendment 223 #

Proposal for a regulation
Article 2 – paragraph 1 – point 9 a (new)

(9 a) "Cyber hygiene" means multi- factor authentication, patching, encryption, micro-segmentation that can minimise the risks from cyber threats and apply the principle of least privilege;

Amendment 224 #

Peter KOUROUMBASHEV, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 2 – paragraph 1 – point 9 b (new)

(9 b) ‘European cybersecurity scheme’ means a European cybersecurity certification scheme or a European cybersecurity self-assurance scheme.

Amendment 225 #

Proposal for a regulation
Article 2 – paragraph 1 – point 10

(10) ‘European cybersecurity certificate’ means a ~~document issued by a~~an attestation issued either through self-assessment or through an accredited conformity assessment body ~~attesting~~ that a given ICT ~~product or service fulfils the specific requirement~~development procedure, product or service has been evaluated using a standardised methodology for conformity assessment against specific security standards laid down in a European cybersecurity certification scheme;

Amendment 226 #

Proposal for a regulation
Article 2 – paragraph 1 – point 10

(10) ‘European cybersecurity certificate’ means a ~~document issued by a~~n attestation issued either through self assessment or through an accredited conformity assessment body attesting that a given ICT process, product or service fulfils the specific requirements laid down in a European cybersecurity certification scheme;

Amendment 227 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 2 – paragraph 1 – point 10

(10) ‘European cybersecurity certificate’ means a document issued either by a conformity assessment body or by self- assessment, where permitted, attesting that a given ICT product, process or service fulfils the specific requirements laid down in a European cybersecurity certification scheme;

Amendment 228 #

Proposal for a regulation
Article 2 – paragraph 1 – point 10

Amendment 229 #

Peter KOUROUMBASHEV, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Martina WERNER, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 2 – paragraph 1 – point 10

(10) ‘European cybersecurity certificate’ means a document issued by a conformity assessment body attesting that a given ICT product or, service, process fulfills the specific requirements laid down in a European cybersecurity certification scheme;

Amendment 230 #

Proposal for a regulation
Article 2 – paragraph 1 – point 11

(11) ‘ICT product ~~and service’ mean~~, process, service and system’ means a product, service, process, system or a combination thereof that it is any element or group of elements of network and information systems; (This amendment applies throughout the text and its adoption will entail corresponding changes throughout.)

Amendment 231 #

Proposal for a regulation
Article 2 – paragraph 1 – point 11

(11) ‘ICT product and service’ means any product, process, service that is an element or group of elements of network and information systems;

Amendment 232 #

Peter KOUROUMBASHEV, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 2 – paragraph 1 – point 11

(11) ‘ICT product ~~and service~~, service and process’ means any element or group of elements of network and information systems;

Amendment 233 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 2 – paragraph 1 – point 11 a (new)

(11 a) ‘consumer electronic device’ means a device consisting of hardware and software that process personal data or connect to the Internet for the operation of domotics and home control appliances, office appliances, routing equipment and devices that connect to a network, such as smart TV, toys and gaming consoles, virtual or personal assistants, connected streaming devices, wearables, voice- command and virtual reality systems;

Amendment 234 #

Proposal for a regulation
Article 2 – paragraph 1 – point 14

(14) ‘conformity assessment’ means conformity assessment as defined in point (12), Article 2 of Regulation (EC) No 765/2008, defined through a standard;

Amendment 235 #

Pavel TELIČKA, Caroline NAGTEGAAL, Gesine MEISSNER

Proposal for a regulation
Article 2 – paragraph 1 – point 14

(14) ‘conformity assessment’ means conformity assessment as defined in point (12), Article 2 of Regulation (EC) No 765/2008; defined through a standard;

Amendment 236 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 2 – paragraph 1 – point 16 a (new)

(16 a) 'functionality information scheme’ means a visual display of data in the form of a label, which aims to provide information to the end user on the functionality, connectivity, sensory, kinetic or security features of a consumer electronic device.

Amendment 237 #

Proposal for a regulation
Article 2 – paragraph 1 – point 16 a (new)

(16 a) ʽself-assessmentʼ is defined on the basis of Regulation (EC) 768/2008, module H Or. en (768/2008/EC, module H http://eur- lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2008:218:0082:0128:en:PDF)

Amendment 238 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Title 2

ENISA – the "EU Cyber~~security~~ resilience Agency"

Amendment 239 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 3 – paragraph 1

1. The Agency shall undertake the tasks assigned to it by this Regulation for the purpose of ~~contribut~~achieving to a high level of cyber resilience and in particular cybersecurity within the Union.

Amendment 240 #

Proposal for a regulation
Article 3 – paragraph 1

1. The Agency shall undertake the tasks assigned to it by this Regulation for the purpose of ~~contribut~~achieving to a high level of ~~cyber~~IT security within the Union.

Amendment 241 #

Proposal for a regulation
Article 3 – paragraph 2 a (new)

2 a. The Agency shall assist Member States and Union institutions in establishing policies and practices for the responsible management and coordinated disclosure of vulnerabilities in ICT products and services that are not publicly known.

Amendment 242 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 3 – paragraph 3

Amendment 243 #

Proposal for a regulation
Article 3 – paragraph 3 a (new)

3 a. The agency shall assist Member States and Union institutions in establishing transparent policies and practices for the responsible management and coordinated disclosure of vulnerabilities in ICT products, processes, services and systems that are not publicly known.

Amendment 244 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Kathleen VAN BREMPT, Dan NICA, Clare MOODY

Proposal for a regulation
Article 4 – paragraph 1

1. The Agency shall be a centre of expertise on theoretical and practical cybersecurity by virtue of its independence, the scientific and technical quality of the advice and assistance it delivers and the information it provides, the transparency of its operating procedures and methods of operation, and its diligence in carrying out its tasks.

Amendment 245 #

Proposal for a regulation
Article 4 – paragraph 1

1. The Agency shall be a centre of expertise onfor cybersecurity in Europe by virtue of its independence, the scientific and technical quality of the advice and assistance it delivers and the information it provides, the transparency of its operating procedures and methods of operation, and its diligence in carrying out its tasks.

Amendment 246 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Caroline NAGTEGAAL, Gesine MEISSNER, Morten PETERSEN

Proposal for a regulation
Article 4 – paragraph 2

2. The Agency shall assist the Union institutions, agencies and bodies, as well as Member States, in developing and implementing policies related to cybersecurity, including sectoral cybersecurity policies, in order to enhance the relevance of EU policies and legislation with a cybersecurity dimension and to promote consistency in their implementation at national level.

Amendment 247 #

Proposal for a regulation
Article 4 – paragraph 2

2. The Agency shall assist the Union institutions, agencies and bodies, as well as Member States, in developing and implementing policies related to cybersecurity and raising awareness among citizens and businesses.

Amendment 248 #

Proposal for a regulation
Article 4 – paragraph 2

2. The Agency shall assist and advise the Union institutions, agencies and bodies, as well as the Member States, in developing and implementing policies related to cybersecurity.

Amendment 249 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 4 – paragraph 3

3. The Agency shall support capacity building and preparedness across the Union, by assisting the Union, Member States and public and private stakeholders in order to increase the protection of their network and information systems, develop skills, awareness and competencies in the field of cybersecurity, and achieve cyber resilience and response capacities.

Amendment 250 #

Proposal for a regulation
Article 4 – paragraph 4

4. The Agency shall promote cooperation and coordination at Union level among Member States, Union institutions, agencies and bodies, and relevant stakeholders, including civil society organisations, including consumers’ organisations and the private sector, on matters related to cybersecurity.

Amendment 251 #

Proposal for a regulation
Article 4 – paragraph 4

4. The Agency shall promote cooperation and coordination at Union level among Member States, Union institutions, agencies and bodies, and relevant stakeholders, including the private sector, consumer organizations and other civil society organisations, on matters related to ~~cyber~~IT security.

Amendment 252 #

Proposal for a regulation
Article 4 – paragraph 4

4. The Agency shall promote and strengthen cooperation and coordination at Union level among Member States, Union institutions, agencies and bodies, and relevant stakeholders, including the private sector, ~~on matters related to cybersecurity~~thereby enabling a high level of cybersecurity to be attained in the Member States.

Amendment 253 #

Proposal for a regulation
Article 4 – paragraph 4

4. The Agency shall promote cooperation ~~and~~, coordination and information sharing at Union level among Member States, Union institutions, agencies and bodies, and relevant stakeholders, including the private sector, on matters related to cybersecurity.

Amendment 254 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Kathleen VAN BREMPT, Dan NICA, Clare MOODY

Proposal for a regulation
Article 4 – paragraph 5

5. The Agency shall increase cybersecurity capabilities at Union level in order to complement the action of Member States in preventing and responding to cyber threats, notably in the event of cross- border incidents, and in order to carry out its task of assisting Union institutions in developing policies related to cybersecurity.

Amendment 255 #

Proposal for a regulation
Article 4 – paragraph 5

5. The Agency shall increase cybersecurity capabilities at Union level in order to complement the action of Member States in preventing and responding to cyber threats, notably in the event of cross- border incidents, in accordance with the provisions of Directive (EU)2016/1148.

Amendment 256 #

Proposal for a regulation
Article 4 – paragraph 5

5. The Agency shall help to increase cybersecurity capabilities at Union level in order to complement and bolster the action of Member States in preventing and responding to cyber threats, notably in the event of cross- border incidents.

Amendment 257 #

Proposal for a regulation
Article 4 – paragraph 5

5. The Agency shall contribute to increased cybersecurity capabilities at Union level in order to complement the action of developing Member States skills in preventing and responding to cyber threats, ~~notably in the event of~~including cross- border incidents.

Amendment 258 #

Proposal for a regulation
Article 4 – paragraph 5

5. The Agency shall contribute to increaseing cybersecurity capabilities at Union level in order to complement the action of developing Member States skills in preventing and responding to cyber threats~~, notably in the event of cross-border incidents~~.

Amendment 259 #

Proposal for a regulation
Article 4 – paragraph 5 a (new)

5 a. The Agency shall have the capabilities to convene the Member States' authorities and assist in the coordination of their response, notably in the event of cross border incidents.

Amendment 260 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Caroline NAGTEGAAL, Gesine MEISSNER, Morten PETERSEN

Proposal for a regulation
Article 4 – paragraph 6

6. The Agency shall promote the use of certification, including by contributing to the establishment and maintenance of a cybersecurity certification framework at Union level in accordance with Title III of this Regulation, with a view to increasing transparency of cybersecurity assurance of ICT products and services and thus strengthen trust in the digital internal market, and without disregard for the specific sensibilities related to small and medium sized enterprises.

Amendment 261 #

Proposal for a regulation
Article 4 – paragraph 6

6. The Agency shall promote the use of certification, including by contributing to the establishment and maintenance of a cybersecurity certification framework at Union level in accordance with Title III of this Regulation, with a view to increasing transparency of cybersecurity assurance of ICT products and services, reducing fragmentation of the internal market and thus strengthen trust in the digital internal market.

Amendment 262 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Martina WERNER, Eva KAILI, Kathleen VAN BREMPT, Dan NICA, Clare MOODY

Proposal for a regulation
Article 4 – paragraph 6

6. The Agency shall promote the use of certification, including by contributing to the establishment and maintenance of a cybersecurity certification framework at Union level in accordance with Title III of this Regulation, with a view to increasing transparency of cybersecurity assurance of ICT products ~~and servic~~, services and processes and thus strengthen trust in the digital internal market.

Amendment 263 #

Michał BONI, Henna VIRKKUNEN, Massimiliano SALINI

Proposal for a regulation
Article 4 – paragraph 6 a (new)

6 a. The Agency shall promote cyber hygiene principles

Amendment 264 #

Clare MOODY, Theresa GRIFFIN, Peter KOUROUMBASHEV, Arne LIETZ

Proposal for a regulation
Article 4 – paragraph 7

7. The Agency shall promote and support projects contributing to a high level of awareness ofand cyber literacy among citizens and businesses on issues related to the cybersecurity.

Amendment 265 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 4 – paragraph 7

7. The Agency shall promote a high level of awareness of citizens and businesses on issues related to the cybersecurity and provide guidance on improving their cyber resilience.

Amendment 266 #

Proposal for a regulation
Article 4 – paragraph 7

7. The Agency shall promote a high level of awareness and digital literacy of citizens and businesses on issues related to the cybersecurity.

Amendment 267 #

Proposal for a regulation
Article 4 – paragraph 7

7. The Agency shall promote a high level of cyber hygiene and awareness of citizens and businesses on issues related to the cybersecurity.

Amendment 268 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 4 – paragraph 7

7. The Agency shall promote a high level of cyber hygiene and awareness of citizens and businesses on issues related to the cybersecurity.

Amendment 269 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Kathleen VAN BREMPT, Dan NICA, Clare MOODY

Proposal for a regulation
Article 4 – paragraph 7

7. The Agency shall promote a high level of cyber hygiene and awareness of citizens and businesses on issues related to the cybersecurity.

Amendment 270 #

Proposal for a regulation
Article 4 – paragraph 7 a (new)

7 a. The agency shall advise and assist Member States and the Union institutions in establishing policies and practices for the responsible management and coordinated disclosure of vulnerabilities in ICT products, processes, services and systems that are not publicly known, including in particular the establishment of government vulnerability disclosure review processes and coordinated vulnerability disclosure policies.

Amendment 271 #

Proposal for a regulation
Article 4 – paragraph 7 a (new)

7 a. The Agency shall assist and advise Member States and Union institutions in establishing policies and practices for the responsible management and coordinated disclosure of vulnerabilities in ICT products and services that are not publicly known, inter alia, by establishing government vulnerability disclosure review processes and coordinated vulnerability disclosure policies.

Amendment 272 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Martina WERNER, Eva KAILI, Kathleen VAN BREMPT, Dan NICA, Clare MOODY

Proposal for a regulation
Article 5 – paragraph 1 – point 1

1. assisting and advising, in particular by providing its independent opinion and analysis of relevant activities in cyberspace and supplying preparatory work, on the development and review of Union policy and law in the area of cybersecurity, as well as sector-specific policy and law initiatives where matters related to cybersecurity are involved;

Amendment 273 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2

2. assisting Member States to implement consistently the Union policy and law regarding cybersecurity notably in relation to Directive (EU) 2016/1148, including by means of opinions, guidelines, advice and best practices on topics such as secure software and systems development, risk management, incident reporting and information sharing, technical and organisational measures, in particular the establishment of coordinated vulnerability disclosure programmes, as well as facilitating the exchange of best practices between competent authorities in this regard;

Amendment 274 #

Michał BONI, Seán KELLY, Henna VIRKKUNEN, Massimiliano SALINI, Krišjānis KARIŅŠ, Gunnar HÖKMARK

Proposal for a regulation
Article 5 – paragraph 1 – point 2

2. assisting Member States to implement consistently the Union policy and law regarding cybersecurity notably in relation to Directive (EU) 2016/1148, Directive establishing the European Electronic Communications Code, Regulation (EU) 2016/679 and Directive 2002/58/EC, including by means of opinions, guidelines, advice and best practices on topics such as risk management, incident reporting and information sharing, as well as facilitating the exchange of best practices between competent authorities in this regard;

Amendment 275 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 5 – paragraph 1 – point 2 a (new)

2 a. assisting the European Data Protection Board established by Regulation (EU) 2016/679 in developing guidelines to specify at the technical level the conditions allowing the licit use of personal data by data controllers for IT security purposes with the objective of protecting their infrastructure by detecting and blocking attacks against their information systems in the context of: (i) Regulation (EU) 2016/6791a; (ii) Directive (EU) 2016/11481b; and (iii) Directive 2002/58/EC1c; (1a Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). 1b Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1). 1c Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ L 201 , 31.7.2002, p. 37)).

Amendment 276 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Martina WERNER, Eva KAILI, Kathleen VAN BREMPT, Dan NICA, Clare MOODY

Proposal for a regulation
Article 5 – paragraph 1 – point 2 a (new)

2 a. assisting Member States to implement consistently the Union policy and law regarding data protection notably in relation to Regulation (EU) 2016/679, as well as assisting the European Data Protection Board (EDPB) in the development of guidelines related to the implementation of Regulation (EU) 2016/679 for cybersecurity purposes. The EDPB should be required to consult ENISA every time it issues an opinion or adopts a decision concerning the implementation of the GDPR and cybersecurity, in particular on, but not limited to, issues related to privacy impact assessments, data breach notification, security processing, security requirements, and privacy by design.

Amendment 277 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2 a (new)

2 a. proposing a blueprint which establishes the roles, responsibilities and legal obligations of vendors, manufacturers, CERTs and CSIRTs, and which further clarifies the legal rights and protections of information security researchers in the context of a coordinated vulnerability disclosure programme, in particular in cases of multi-party vulnerability disclosures that affect multiple vulnerability finders and vendors in different Member States

Amendment 278 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2 a (new)

2 a. assisting and advising Member States and the Union institutions in establishing policies and practices for the responsible management and coordinated disclosure of vulnerabilities in ICT products, processes, services and systems that are not publicly known, including in particular the establishment of government vulnerability disclosure review processes and coordinated vulnerability disclosure policies.

Amendment 279 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 5 – paragraph 1 – point 2 b (new)

2 b. proposing policies aimed at ensuring ICT manufacturers, service providers, importers and distributors act with due diligence regarding the timely fixing of IT security vulnerabilities in their products, processes and services in order to avoid unduly exposing their users to cybercrime;

Amendment 280 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2 b (new)

2 b. proposing policies with the objective of ensuring that ICT manufacturers act with due diligence regarding the timely fixing of IT security vulnerabilities in their products and services in order to avoid unduly exposing their users to cybercrime;

Amendment 281 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2 c (new)

2 c. proposing policies establishing a strong responsibility and liability framework for all stakeholders taking part in ICT eco- systems;

Amendment 282 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2 d (new)

2 d. proposing policies strengthening regulation regarding the responsibilities of operators of critical network infrastructures in the case of an attack against their information systems affecting their users due to a lack of due diligence by some of the users of by the operator itself, where the operator has failed to take reasonable action to prevent the incident or to mitigate its effects on all users;

Amendment 283 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2 e (new)

2 e. proposing policies to limit the purchase and use of “Zero days” by public authorities with the purpose of attacking information systems; promoting software audits and financing expert staff;

Amendment 284 #

Proposal for a regulation
Article 5 – paragraph 1 – point 2 f (new)

2 f. proposing policies for public authorities, private companies, researchers, universities and other stakeholders to publish all critical security vulnerabilities that are not yet publicly known within the framework of a responsible disclosure;

Amendment 285 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 5 – paragraph 1 – point 2 g (new)

2 g. proposing policies for the extension of the use of “verifiable open- source code” for IT solutions in the public sector as well as for the related use of automated tools to ease review of source code and to easily verify absence of backdoors and other possible security vulnerabilities;

Amendment 286 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Gerben-Jan GERBRANDY, Jan Philipp ALBRECHT, Felix REDA, Urmas PAET, Kaja KALLAS, Pavel TELIČKA, Fredrick FEDERLEY, Dita CHARANZOVÁ, Neena GILL

Proposal for a regulation
Article 5 – paragraph 1 – point 4 – point 2 a (new)

(2 a) the development and promotion of policies that would sustain the general availability or integrity of the public core of the open internet, which provide the essential functionality to the Internet as a whole and which underpin its normal operation, including, but not limited to, the security and stability of key protocols (in particular DNS, BGP, and IPv6), the operation of the Domain Name System (including those of all Top Level Domains), and the operation of the Root Zone

Amendment 287 #

Proposal for a regulation
Article 5 – paragraph 1 – point 5 – point c a (new)

(c a) the state of the implementation of coordinated vulnerability disclosure review process by Member States and Union Institutions.

Amendment 288 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Gerben-Jan GERBRANDY, Jan Philipp ALBRECHT, Felix REDA, Urmas PAET, Kaja KALLAS, Pavel TELIČKA, Dita CHARANZOVÁ, Neena GILL, Morten LØKKEGAARD

Proposal for a regulation
Article 6 – paragraph 1 – point a a (new)

(a a) Members States and Union institutions in establishing and implementing coordinated vulnerability disclosure policies and government vulnerability disclosure review processes, whose practices and determinations should be transparent and subject to independent oversight.

Amendment 289 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 6 – paragraph 1 – point g

(g) the Member States by organising ~~year~~biannually large-scale cybersecurity exercises at the Union level referred to in Article 7(6) and by making policy recommendations and exchanging best practices based on the evaluation process of the exercises and lessons learned from them;

Amendment 290 #

Proposal for a regulation
Article 6 – paragraph 1 – point g

(g) the Member States by organising regularly and at least a yearly large-scale cybersecurity exercises at the Union level referred to in Article 7(6) and by making policy recommendations based on the evaluation process of the exercises and lessons learned from them;

Amendment 291 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 6 – paragraph 1 – point i a (new)

(i a) Member States and Union institutions in establishing coordinated vulnerability disclosure policies and government vulnerability disclosure review processes which are transparent and subject to independent assessment.

Amendment 292 #

Proposal for a regulation
Article 6 – paragraph 2

2. The Agency shall facilitate the establishment of and continuously support sectoral Information Sharing and Analysis Centres (ISACs), in particular in the sectors listed in Annex II of Directive (EU) 2016/1148, by providing best practices and guidance on available tools, procedure, cyber hygiene principles, as well as on how to address regulatory issues related to information sharing.

Amendment 293 #

Michał BONI, Henna VIRKKUNEN, Massimiliano SALINI, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Article 6 – paragraph 2

2. The Agency shall facilitate the establishment of and continuously support sectoral Information Sharing and Analysis Centres (ISACs), in particular in the sectors listed in Annex II of Directive (EU) 2016/1148, by providing best practices and guidance on available tools, procedure, cyber hygiene principles, as well as on how to address regulatory issues related to information sharing.

Amendment 294 #

Proposal for a regulation
Article 6 – paragraph 2

2. The Agency shall facilitate the establishment of and continuously support sectoral Information Sharing and Analysis Centres (ISACs), in particular in the sectors listed in Annex II of Directive (EU) 2016/1148, by providing best practices and guidance on available tools, procedure, cyber hygiene principles, as well as on how to address regulatory issues related to information sharing.

Amendment 295 #

Proposal for a regulation
Article 6 – paragraph 2 a (new)

2 a. The Agency shall facilitate the establishment and launch of a long-term European IT security project to support the growth of an independent EU IT security industry, and to mainstream IT security into all EU IT developments.

Amendment 296 #

Proposal for a regulation
Article 7 – title

Tasks relating to support for operational cooperation at Union level

Amendment 297 #

Proposal for a regulation
Article 7 – paragraph 4 – subparagraph 1 – introductory part

The Agency shall ~~contribute to~~support the operational cooperation within the CSIRTs Network in accordance with the provisions of Article 12(2) of Directive (EU)2016/1148 providing support to Member States by:

Amendment 298 #

Proposal for a regulation
Article 7 – paragraph 4 – subparagraph 1 – point b

(b) ~~provid~~supporting, at their request, ~~technical assistance~~Member States in case of incidents having a significant or substantial impact;

Amendment 299 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Kathleen VAN BREMPT, Dan NICA, Clare MOODY

Proposal for a regulation
Article 7 – paragraph 5 – subparagraph 1

Upon a request by ~~two~~one or more Member States concerned, and with the sole purpose of providing assistance either in the form of advice for the prevention of future incidents , or in the form of assisting in the response to a current large scale incidents, the Agency shall provide support to or carry out an ex-post technical enquiry following notifications by affected undertakings of incidents having a significant or substantial impact pursuant to Directive (EU) 2016/1148. The Agency shall perform the above activities by receiving relevant information from the affected Member States and by utilising its own resources on threat analysis as well as resources on incident response made available from CERT EU for that purpose. The Agency shall also carry out such an enquiry upon a duly justified request from the Commission in agreement with the concerned Member States in case of such incidents affecting more than ~~two~~one Member States.

Amendment 300 #

Proposal for a regulation
Article 7 – paragraph 5 – subparagraph 1

Upon a request by ~~two or more~~a Member States concerned, and with the sole purpose of providing assistance either in the form of advice for the prevention of future incidents, or in the form of assisting in the response to a current large scale incident, the Agency shall provide support to or carry out an ex- post technical enquiry following notifications by affected undertakings of incidents having a significant or substantial impact pursuant to Directive (EU) 2016/1148. The Agency shall also carry out such an enquiry upon a duly justified request from the Commission in agreement with the concerned Member States in case of such incidents affecting more than ~~two~~one Member States.

Amendment 301 #

Proposal for a regulation
Article 7 – paragraph 5 – subparagraph 1

Upon a request by two or more Member States concerned, and with the sole purpose of providing advice for the prevention of future incidents, the Agency shall provide support ~~to or carry out an ex-post technical enquiry following notifications by affected undertaking~~for the analysis of incidents having a significant or substantial impact pursuant to Directive (EU) 2016/1148. The Agency shall also carry out ~~such an enquiry~~this analysis upon a duly justified request from the Commission in agreement with the concerned Member States in case of such incidents affecting more than two Member States.

Amendment 302 #

Proposal for a regulation
Article 7 – paragraph 5 – subparagraph 2

The scope of the enquiry and the procedure to be followed in conducting such enquiry shall be agreed by the concerned Member States and the Agency and is without prejudice to any on-going criminal investigation concerning the same incident. The enquiryanalysis shall be agreed by the concerned Member States and the Agency. The analysis shall be concluded by a final technical report compiled by the Agency in particular on the basis of information and comments provided by the concerned Member States and undertaking(s) and agreed with the concerned Member States. A summary of the report focussing on the recommendations for the prevention of future incidents will be shared with the CSIRTs network.

Amendment 303 #

Clare MOODY, Theresa GRIFFIN, Peter KOUROUMBASHEV, Arne LIETZ

Proposal for a regulation
Article 7 – paragraph 6

6. The Agency shall organise biannual cybersecurity exercises at Union level, and support Member States and EU institutions, agencies and bodies in organising exercises following their request(s). Annual exercises at Union level shall include technical, operational and strategic elements and help to prepare the cooperative response at the Union level to large-scale cross-border cybersecurity incidents. The Agency shall also contribute to and help organise, where appropriate, sectoral cybersecurity exercises together with relevant ISACs and permit ISACs to participate also to Union level cybersecurity exercises.

Amendment 304 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Eva KAILI, Kathleen VAN BREMPT, Dan NICA, Clare MOODY

Proposal for a regulation
Article 7 – paragraph 7

7. The Agency shall prepare a regular and in-depth EU Cybersecurity Technical Situation Report on incidents and threats based on open source information, its own analysis, and reports shared by, among others: Member States' CSIRTs (on a voluntary basis) or NIS Directive Single Points of Contact (in accordance with NIS Directive Article 14 (5)); European Cybercrime Centre (EC3) at Europol, CERT-EU. The Executive Director shall present the public findings to the European Parliament.

Amendment 305 #

Proposal for a regulation
Article 7 – paragraph 7 – subparagraph 1 (new)

The Agency shall, where appropriate and subject to prior approval by the Commission, contribute to cross-border cyber cooperation with the NATO Cooperative Cyber Defence Centre of Excellence and the NATO Communications and Information (NCI) Academy.

Amendment 306 #

Proposal for a regulation
Article 7 – paragraph 7 a (new)

7 a. The Agency shall prepare, together with the EEAS, a regular global Cybersecurity Situational Report on incidents and threats towards individuals, including towards vulnerable users outside the EU such as lawyers, journalists, or human rights defenders, in order to help the Union institutions respond to external needs and uphold its human rights responsibilities abroad

Amendment 307 #

Proposal for a regulation
Article 7 – paragraph 8 – point a

(a) analyzing and aggregating reports from national sources with a view to contribute to establishing common situational awareness;

Amendment 308 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Edouard MARTIN, Eva KAILI, Kathleen VAN BREMPT, Dan NICA, Clare MOODY

Proposal for a regulation
Article 7 – paragraph 8 – point c

(c) supporting the technical handling of an incident or crisis, based on its own independent expertise and resources including facilitating the sharing of technical solutions between Member States;

Amendment 309 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 7 – paragraph 8 – point c a (new)

(c a) put in place certification schemes deterring the implementation by ICT manufacturers and service providers of secret backdoors intentionally weakening the IT security of commercial products and services and having a detrimental impact on the global security of the internet.

Amendment 310 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Kathleen VAN BREMPT, Dan NICA, Clare MOODY

Proposal for a regulation
Article 7 – paragraph 8 – point e a (new)

(e a) assisting Member States and Union institutions in establishing and developing an EU Cybersecurity Crisis Response Framework integrating the objectives and modalities of cooperation suggested in the [Commission Recommendation on Coordinated Response to Large Scale Cybersecurity Incidents and Crisis from 13.9.2017].

Amendment 311 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Gerben-Jan GERBRANDY, Jan Philipp ALBRECHT, Felix REDA, Urmas PAET, Kaja KALLAS, Pavel TELIČKA, Dita CHARANZOVÁ, Neena GILL, Morten LØKKEGAARD

Proposal for a regulation
Article 7 – paragraph 8 – point e a (new)

(e a) assisting and advising Member States on establishing and implementing coordinated vulnerability disclosure policies and government vulnerability disclosure review processes.

Amendment 312 #

Proposal for a regulation
Article 7 – paragraph 8 – point e a (new)

(e a) assisting Member States on establishing and implementing coordinated vulnerability disclosure policies and government vulnerability disclosure review processes.

Amendment 313 #

Proposal for a regulation
Article 7 – paragraph 8 – point e b (new)

(e b) assisting Member States and Union Institutions in developing and adopting a common taxonomy and template for situational reports to describe technical causes and impacts of cybersecurity incidents to further enhance their technical and operational cooperation during crisis.

Amendment 314 #

Proposal for a regulation
Article 7 – paragraph 8 a (new)

8 a. Convening the Member States' authorities and assisting in the coordination of their response, in compliance with the principles of subsidiarity and proportionality.

Amendment 315 #

Proposal for a regulation
Article 7 – paragraph 8 a (new)

8 a. The Agency shall support and foster the cooperation between the Member States in conducting IT security audits of critical cross-border infrastructures.

Amendment 316 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY, Kathleen VAN BREMPT

Proposal for a regulation
Article 7 a (new)

Article 7 a Technical capabilities of the Agency For meeting the objectives described in Articles 5, 6 and 7 the Agency shall develop among others the following technical capabilities and skills: 1. The ability to analyse threat information data at large scale 2. The ability to conduct forensic analysis on devices and terminal equipment 3. The ability to analyse malware, indicators of compromise and other information related to a cybersecurity threat or incident 4. The ability to collect information on cybersecurity threats from open source as well as commercial sources 5. The ability to deploy technical equipment, tools and expertise remotely and on-site at the request of a Member State in case of Article 7 paragraph 5 and paragraph 8 To meet the technical capabilities described in this Article the Agency shall ensure that its recruitment processes reflect the diverse technical skills required. To meet the technical capabilities described in this Article and develop the relevant skills, the Agency shall cooperate with CERT EU and Europol in accordance to Article 7 paragraph 2.

Amendment 317 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – introductory part

(a) support and promote the development and implementation of the Union policy on cybersecurity certification of ICT development procedures, products and services, as established in Title III of this Regulation, by:

Amendment 318 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – introductory part

(a) support and promote the development and implementation of the Union policy on cybersecurity certification of ICT products ~~and servic~~, services and processes, as established in Title III of this Regulation, by:

Amendment 319 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 1

~~(1) preparing candidate European cybersecurity certification schemes for ICT products and services in accordance with Article 44 of this Regulation;~~deleted

Amendment 320 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 1

(1) in cooperation with industry, SMEs, relevant research and academic stakeholders as well as consumer protection organisations in a clear and transparent process, preparing candidate European cybersecurity certification schemes for ICT products and services in accordance with Article 44 of this Regulation;

Amendment 321 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 1

(1) in consultation with stakeholders and standardisation organisations in a formal, standardised and transparent process, preparing candidate European cybersecurity certification schemes for ICT products and services in accordance with Article 44 of this Regulation;

Amendment 322 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 1

(1) In cooperation with industry stakeholders in a formal, standardised and transparent process, identifying and preparing candidate European cybersecurity certification schemes for ICT products and services in accordance with Article 44 of this Regulation;

Amendment 323 #

Michał BONI, Massimiliano SALINI, Krišjānis KARIŅŠ, Gunnar HÖKMARK

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 1

(1) preparing candidate European cybersecurity certification schemes for ICT products and services in cooperation with the Permanent Stakeholder Group and the Certification Stakeholder Expert Group in accordance with Article 44 of this Regulation;

Amendment 324 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 1

(1) preparing candidate European cybersecurity certification schemes for ICT products, processes and services in cooperation with the certification stakeholder working group is accordance with Article 44.2 of this Regulation;

Amendment 325 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY, Kathleen VAN BREMPT

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 1

(1) preparing candidate European cybersecurity certification schemes for ICT products ~~and servic~~, services and processes in accordance with Article 44 of this Regulation;

Amendment 326 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 1 a (new)

(1 a) carrying out, in cooperation with the European Cybersecurity Certification Group, assessments of the procedures for issuing European cybersecurity certificates put in place by conformity assessment bodies referred to in Article 51, with a view to ensuring the uniform application of this Regulation by conformity assessment bodies when issuing certificates;

Amendment 327 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 1 b (new)

(1 b) carrying out independent periodic ex-post checks on the compliance of certified ICT products and services with European cybersecurity certification schemes;

Amendment 328 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 2

~~(2) assisting the Commission in providing the secretariat to the European Cybersecurity Certification Group pursuant to Article 53 of this Regulation;~~deleted

Amendment 329 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 3

(3) compiling and publishing guidelines and developing good practices concerning the cybersecurity requirements of ICT products and services, in cooperation with national certification supervisory authorities ~~and the industry;~~ , industry, SMEs, relevant research and academic stakeholders and consumer protection organisations;

Amendment 330 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 3

(3) compiling and publishing guidelines and developing good practices concerning the cybersecurity requirements of ICT products and services, in cooperation with national certification supervisory authorities and the industry in a formal, standardised and transparent process;

Amendment 331 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 3

(3) assisting small and medium sized enterprises by compiling and publishing guidelines and developing good practices concerning the cybersecurity requirements of ICT products and services, in cooperation with national certification supervisory authorities and the industry;

Amendment 332 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 3

(3) compiling and publishing guidelines and developing good practices, including on cyber hygiene principles, concerning the cybersecurity requirements of ICT products and services, in cooperation with national certification supervisory authorities and the industry;

Amendment 333 #

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 3

Amendment 334 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY, Kathleen VAN BREMPT

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 3

(3) compiling and publishing guidelines and developing good practices and cyber hygiene principles concerning the cybersecurity requirements of ICT products ~~and~~, services, and processes in cooperation with national certification supervisory authorities and the industry;

Amendment 335 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 8 – paragraph 1 – point a – point 3

(3) compiling and publishing guidelines and developing good practices concerning the cybersecurity requirements of ICT development procedures, products and services, in cooperation with national certification supervisory authorities and the industry;

Amendment 336 #

Proposal for a regulation
Article 8 – paragraph 1 – point a a (new)

(a a) support and promote the development and the implementation of coordinated vulnerability disclosure policies and government vulnerability disclosure review processes, including regard the vulnerabilities of ICT products, processes, services and systems certified under Title II of this regulation;

Amendment 337 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Article 8 – paragraph 1 – point b

(b) consult the ISO/IEC international standardisation bodies and European standardisation organisations on the development of standards, to ensure the appropriateness of standards used in European Cybersecurity certification schemes and facilitate the establishment and take-up of European and ~~international~~ISO/IEC standards for risk management and for the security of ICT products and services, as well as draw up, in collaboration with Member States, advice and guidelines regarding the technical areas related to the security requirements for operators of essential services and digital service providers, as well as regarding already existing standards, including Member States' national standards, pursuant to Article 19(2) of Directive (EU) 2016/1148;

Amendment 338 #

Proposal for a regulation
Article 8 – paragraph 1 – point b

(b) facilitate the establishment and take-up of European and international standards for risk management and for the security of ICT products and services, as well as draw up, in collaboration with Member States, industry, SMEs, research and academic stakeholders and consumer protection organisations, advice and guidelines regarding the technical areas related to the security requirements for operators of essential services and digital service providers, as well as regarding already existing standards, including Member States' national standards, pursuant to Article 19(2) of Directive (EU) 2016/1148;

Amendment 339 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Gesine MEISSNER, Morten PETERSEN

Proposal for a regulation
Article 8 – paragraph 1 – point b

(b) facilitate the establishment and take-up of European and international standards for risk management and for the security of ICT development procedures, products and services, as well as draw up, in collaboration with Member States, advice and guidelines regarding the technical areas related to the security requirements for operators of essential services and digital service providers, as well as regarding already existing standards, international standards and informal international agreements, including Member States' national standards, pursuant to Article 19(2) of Directive (EU) 2016/1148;

Amendment 340 #

Proposal for a regulation
Article 8 – paragraph 1 – point b

(b) facilitate the establishment and take-up of European and/ or international standards for risk management and for the security of ICT products and services, as well as draw up, in collaboration with Member States, advice and guidelines regarding the technical areas related to the security requirements for operators of essential services and digital service providers, as well as regarding already existing standards, including Member States' national standards, pursuant to Article 19(2) of Directive (EU) 2016/1148 and share this information among Member States;

Amendment 341 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Article 8 – paragraph 1 – point b – point i (new)

i) b) promote, depending on the level of risk, the use of additional means to certification of conformance to cybersecurity standards

Amendment 342 #

Proposal for a regulation
Article 8 – paragraph 1 – point c

(c) perform and disseminate regular analyses of the main trends and vulnerabilities in the cybersecurity market both on the demand and supply side, with a view of fostering the cybersecurity ~~mark~~safety in the Union.

Amendment 343 #

Proposal for a regulation
Article 8 – paragraph 1 – point c a (new)

(c a) put in place certification schemes deterring the implementation by ICT manufacturers and service providers of secret backdoors intentionally weakening the IT security of commercial products and services and having a detrimental impact on the global security of the internet.

Amendment 344 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Gerben-Jan GERBRANDY, Jan Philipp ALBRECHT, Felix REDA, Urmas PAET, Kaja KALLAS, Pavel TELIČKA, Dita CHARANZOVÁ, Neena GILL, Morten LØKKEGAARD

Proposal for a regulation
Article 8 – paragraph 1 – point c a (new)

(c a) support and promote the development and implementation of coordinated vulnerability disclosure policies and government vulnerability disclosure review processes

Amendment 345 #

Proposal for a regulation
Article 8 – paragraph 1 – point c b (new)

(c b) draw up guidelines concerning how and when Member States are to inform each other when they acquire knowledge of a vulnerability that is not publicly known in an ICT product or service that is certified in accordance with Title III of this Regulation, including guidelines on the coordination of vulnerability disclosure policies;

Amendment 346 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Article 8 – paragraph 1 – point c c (new)

(c c) draw up guides and recommendations on minimum security requirements for IT devices placed on the market in the Union or exported from the Union, thus supporting the fast legislative process needed for this particular case;

Amendment 347 #

Proposal for a regulation
Article 9 – paragraph 1 – point b

(b) perform long-term strategic analyses of cybersecurity threats, vulnerabilities and incidents in order to identify emerging trends and help prevent problems related to cybersecurity;

Amendment 348 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Article 9 – paragraph 1 – point c

(c) provide, in cooperation with experts from Member States authorities, industry, SMEs, relevant research and academic stakeholders, and consumer protection organisations, advice, guidance and best practices for the security of network and information systems, in particular for the security of the internet infrastructure and those infrastructures supporting the sectors listed in Annex II of Directive (EU) 2016/1148;

Amendment 349 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Article 9 – paragraph 1 – point e

(e) raise awareness of the public about cybersecurity risks, and provide guidance on good practices for ~~individual~~ users aimed at citizens and organisations and promote the adoption of preventive strong IT security measures and reliable data protection and privacy;

Amendment 350 #

Proposal for a regulation
Article 9 – paragraph 1 – point e

(e) develop strategic and wide spread campaigns with the aim to raise awareness of the public about cybersecurity risks and vulnerabilities, and provide guidance and training on good practices for individual users aimed at citizens and organisations;

Amendment 351 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 9 – paragraph 1 – point e

(e) raise awareness of the public about cybersecurity risks and cyber hygiene practices, and provide guidance on good practices for ~~individual~~ users aimed at citizens and organisations with the aim of improving their cyber resilience;

Amendment 352 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Article 9 – paragraph 1 – point e

(e) raise awareness of the public about cybersecurity risks, and provide trainings and guidance on good practices for individual users aimed at citizens and organisations;

Amendment 353 #

Proposal for a regulation
Article 9 – paragraph 1 – point g

(g) organise, in cooperation with the Member States and Union institutions, bodies, offices and agencies regular outreach campaigns to increase cybersecurity awareness of its potential risks and threats to citizens life and its visibility in the Union.

Amendment 354 #

Proposal for a regulation
Article 9 – paragraph 1 – point g a (new)

(g a) support closer coordination and exchange of best practices among Member States on cybersecurity education, cyber hygiene and awareness by facilitating the creation and maintenance of a network of national education points of contact.

Amendment 355 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 9 – paragraph 1 – point g a (new)

(g a) promote the widespread adoption by all actors on the Digital Single Market of preventive strong IT security measures and reliable data protection and privacy enhancing technologies as the first line of defence against attacks against information systems.

Amendment 356 #

Proposal for a regulation
Article 9 – paragraph 1 – point g a (new)

(g a) promote the adoption by all actors on the Digital Single Market of preventive strong IT security measures and reliable data protection and privacy according to the Regulation (EU) 2016/679 and [Regulation 2017/0003/COD].

Amendment 357 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Martina WERNER, Eva KAILI, Dan NICA, Clare MOODY, Kathleen VAN BREMPT

Proposal for a regulation
Article 9 – paragraph 1 – point g a (new)

(g a) support closer coordination and exchange of best practices among Member States on cybersecurity education, training and skills development, cyber hygiene and awareness.

Amendment 358 #

Michał BONI, Henna VIRKKUNEN, Massimiliano SALINI, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Article 9 – paragraph 1 – point g a (new)

(g a) support closer coordination and exchange of best practices among Member States on cybersecurity literacy, cyber hygiene and raising awareness;

Amendment 359 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Article 9 – paragraph 1 – point g a (new)

(g a) facilitate creation and maintenance of a network of national education points of contact.

Amendment 360 #

Proposal for a regulation
Article 10 – paragraph 1 – point a

(a) advise the Union and the Member States on research needs and priorities in the area of cybersecurity, with a view to enabling effective responses to current and emerging risks ~~and threat~~, threats and vulnerabilities, including with respect to new and emerging information and communications technologies, and to using the most advanced risk-prevention technologies effectively without putting at risks citizens' privacy and liberty rights;

Amendment 361 #

Proposal for a regulation
Article 10 – paragraph 1 – point a

(a) advise the Union and the Member States on research needs and priorities in the areas of cybersecurity, data protection and privacy, with a view to enabling effective responses to current and emerging risks and threats, including with respect to new and emerging information and communications technologies, and to using risk-prevention technologies effectively;

Amendment 362 #

Proposal for a regulation
Article 10 – paragraph 1 – point a

(a) advise the Union and the Member States on research needs and priorities in the areas of cybersecurity and data protection, with a view to enabling effective responses to current and emerging risks and threats, including with respect to new and emerging information and communications technologies, and to using risk-prevention technologies effectively;

Amendment 363 #

Clare MOODY, Theresa GRIFFIN, Peter KOUROUMBASHEV

Proposal for a regulation
Article 11 – paragraph 1 – point c a (new)

(c a) In collaboration with European Cybersecurity Certification Group (the 'Group') established under Article 53 provide advice and support to the Commission in matters regarding cyber security certification and agreements for mutual recognition of cyber security certificates with foreign markets and third countries.

Amendment 364 #

Proposal for a regulation
Article 11 – paragraph 1 – point c a (new)

(c a) providing, where appropriate, data collected by the Agency in carrying out its mandate, to international organisations provided that doing so does not violate the Union's data protection legislation.

Amendment 365 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 13 – paragraph 1

1. The Management Board shall be composed of one representative of each Member State, ~~and~~ two representatives appointed by the Commission and the European Parliament and, after its establishment following article 20, three representatives of the Permanent Stakeholder group one of which shall represent consumers’ interests. All representatives shall have voting rights.

Amendment 366 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Article 13 – paragraph 1

Amendment 367 #

Proposal for a regulation
Article 13 – paragraph 1

1. The Management Board shall be composed of one representative of each Member State, and two representatives appointed by the Commission. All representatives shall have equal voting rights.

Amendment 368 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Article 13 – paragraph 3

3. Members of the Management Board and their alternates shall be appointed in light of their knowledge in the field of cybersecurity, taking into account relevant managerial, administrative and budgetary skills. The Commission and Member States shall make efforts to limit the turnover of their representatives in the Management Board, in order to ensure continuity of that Board’s work. The Commission and Member States shall aim to achieve a balanced representation ~~between men and women~~of genders on the Management Board.

Amendment 369 #

Proposal for a regulation
Article 13 – paragraph 3

3. Members of the Management Board and their alternates shall be appointed in light of their knowledge in the field of cybersecurity, taking into account relevant managerial, administrative and budgetary skills. The Commission and Member States shall make efforts to limit the turnover of their representatives in the Management Board, in order to ensure continuity of that Board’s work. The Commission and Member States shall aim to achieve a gender balanced representation ~~between men and women~~ on the Management Board.

Amendment 370 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY, Kathleen VAN BREMPT

Proposal for a regulation
Article 13 – paragraph 4

4. The term of office of members of the Management Board and of their alternates shall be f~~our~~ive years. That term shall be renewable.

Amendment 371 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY, Kathleen VAN BREMPT

Proposal for a regulation
Article 15 – paragraph 1

The Management Board shall elect by a majority of two-thirds of members its Chairperson and a Deputy Chairperson from among its members for a period of f~~our~~ive years, which shall be renewable once. If, however, their membership of the Management Board ends at any time during their term of office, their term of office shall automatically expire on that date. The Deputy Chairperson shall ex officio replace the Chairperson if the latter is unable to attend to his or her duties.

Amendment 372 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 18 – paragraph 3

3. The Executive Board shall be composed of five members appointed from among the members of the Management Board amongst whom the Chairperson of the Management Board, who may also chair the Executive Board, and one of the representatives of the Commission. The Executive Director shall take part in the meetings of the Executive Board, but shall not have the right to vote. The appointments shall aim to achieve a balanced representation of genders on the Executive Board.

Amendment 373 #

Proposal for a regulation
Article 18 – paragraph 3

3. The Executive Board shall be composed of five members appointed from among the members of the Management Board amongst whom the Chairperson of the Management Board, who may also chair the Executive Board, and one of the representatives of the Commission. The Executive Director shall take part in the meetings of the Executive Board, but shall not have the right to vote. The composition of the Executive Board should aim at a balanced representation of genders.

Amendment 374 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY, Kathleen VAN BREMPT

Proposal for a regulation
Article 18 – paragraph 3

3. The Executive Board shall be composed of five members appointed from among the members of the Management Board amongst whom the Chairperson of the Management Board, who ~~may~~shall not also chair the Executive Board, and one of the representatives of the Commission. The Executive Director shall take part in the meetings of the Executive Board, but shall not have the right to vote.

Amendment 375 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY, Kathleen VAN BREMPT

Proposal for a regulation
Article 18 – paragraph 4

4. The term of office of the members of the Executive Board shall be f~~our~~ive years. That term shall be renewable.

Amendment 376 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY, Kathleen VAN BREMPT

Proposal for a regulation
Article 19 – paragraph 5 a (new)

5 a. The Executive Director shall be required to provide the relevant European Parliament Committees twice a year with a report on the state of cybersecurity in Europe. The Executive Director should also be invited by the Parliament to provide ENISA’s input on any EU legislative instrument imposing cybersecurity obligations.

Amendment 377 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY, Kathleen VAN BREMPT

Proposal for a regulation
Article 19 – paragraph 5 b (new)

5 b. The Executive Director shall also be entitled to act as an institutional special adviser on cybersecurity policy to the President of the European Commission, with a mandate defined in Commission Decision C(2014) 541 of 06 February 2014.

Amendment 378 #

Proposal for a regulation
Article 20 – paragraph 1

1. The Management Board~~, acting on a proposal by the Executive Director,~~ shall set up a Permanent Stakeholders’ Group per scheme that is composed of recognised experts representing ~~the~~ relevant stakeholders,. such as the ICT ~~industry, provid~~users and providers, associations of small and medium-sized enterprises, providers and users of electronic communications networks or services available to the public, consumer groups and associations, academic experts in the cybersecurity, the European standardisation organisations, as defined in point (8) of Article 2 of Regulation (EU) No 1025/2012, the relevant sectoral Union agencies and bodies, and representatives of competent authorities notified under [Directive establishing the European Electronic Communications Code] as well as of law enforcement and data protection supervisory authorities.

Amendment 379 #

Michał BONI, Seán KELLY, Henna VIRKKUNEN, Massimiliano SALINI, Krišjānis KARIŅŠ, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Article 20 – paragraph 1

1. The Management Board, acting on a proposal by the Executive Director, shall set up a Permanent Stakeholders’ Group composed of recognised experts representing the relevant stakeholders, such as the ICT industry, including SME groups, providers of electronic communications networks or services available to the public, consumer groups, academic experts in the cybersecurity, European Standards Organisations and conformity assessment bodies and representatives of competent authorities notified under [Directive establishing the European Electronic Communications Code] as well as of law enforcement and data protection supervisory authorities. The Management Board shall ensure an appropriate balance between different stakeholder groups.

Amendment 380 #

Proposal for a regulation
Article 20 – paragraph 1

1. The Management Board, acting on a proposal by the Executive Director, shall, in a transparent manner, set up a Permanent Stakeholders’ Group composed of recognised experts representing the relevant stakeholders, such as the ICT industry, providers of electronic communications networks or services available to the public, consumer groups, standardisation organisations, academic experts in the cybersecurity, and representatives of competent authorities notified under [Directive establishing the European Electronic Communications Code] as well as of law enforcement and data protection supervisory authorities.

Amendment 381 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Article 20 – paragraph 1

1. The Management Board, acting on a proposal by the Executive Director, shall set up a Permanent Stakeholders’ Group composed of recognised experts representing the relevant stakeholders, such as ~~the~~European and international ICT industryies, providers of electronic communications networks or services available to the public, and corresponding associations, consumer groups, academic experts in the cybersecurity, and representatives of competent authorities notified under [Directive establishing the European Electronic Communications Code] as well as of law enforcement and data protection supervisory authorities.

Amendment 382 #

Proposal for a regulation
Article 20 – paragraph 1

1. The Management Board, acting on a proposal by the Executive Director, shall set up a Permanent Stakeholders’ Group composed of recognised experts representing the relevant stakeholders, such as the ICT industry, SMEs, providers of electronic communications networks or services available to the public, consumer protection groups, academic and academic experts in the cybersecurity and data protection, and representatives of competent authorities notified under [Directive establishing the European Electronic Communications Code] as well as of law enforcement and data protection supervisory authorities.

Amendment 383 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 20 – paragraph 1

1. The Management Board, acting on a proposal by the Executive Director, shall set up a Permanent Stakeholders’ Group composed of recognised experts representing the relevant stakeholders, such as the ICT industry, providers of electronic communications networks or services available to the public, consumer groups and other relevant civil society organisations, academic experts in the cybersecurity, and representatives of competent authorities notified under [Directive establishing the European Electronic Communications Code] as well as of law enforcement and data protection supervisory authorities.

Amendment 384 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 20 – paragraph 2

2. Procedures for the Permanent Stakeholders’ Group, in particular regarding the number, composition, and the appointment of its members by the Management Board, the proposal by the Executive Director and the operation of the Group, shall be specified in the Agency’s internal rules of operation and shall be made public. The procedures shall follow best practices in ensuring a fair representation and equal rights for all stakeholders and shall aim to ensure a balanced representation of genders.

Amendment 385 #

Proposal for a regulation
Article 20 – paragraph 2

2. Procedures for the Permanent Stakeholders’ Group, in particular regarding the number, composition, and the appointment of its members by the Management Board, the proposal by the Executive Director and the operation of the Group, shall be specified in the Agency’s internal rules of operation and shall be made public. The procedures shall follow best practice for fair representation and equal rights for all stakeholders and shall pursue a gender balanced approach.

Amendment 386 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 20 – paragraph 2 a (new)

2 a. The composition of the Permanent Stakeholders’ Group shall include a minimum of five consumer organisations and civil society organisations.

Amendment 387 #

Proposal for a regulation
Article 20 – paragraph 2 a (new)

2 a. The composition of the Permanent Stakeholders’ Group shall include a minimum of five organisations representing consumer and/or civil society.

Amendment 388 #

Michał BONI, Massimiliano SALINI, Krišjānis KARIŅŠ, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Article 20 – paragraph 4 a (new)

4 a. The Permanent Stakeholders' Group will provide regular updates on its planning throughout the year and set out the objectives in its work programme which shall be published every six months to ensure transparency;

Amendment 389 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Clare MOODY

Proposal for a regulation
Article 20 a (new)

Article 20 a Stakeholder Certification Group 1. The Executive Director shall set up a Stakeholder Certification Group, composed of recognised experts representing consumer groups, academics, standardisation bodies, operators of essential services as defined in Annex II of Directive (EU) 2016/1148 and the ICT industry, including SMEs. 2. Procedures for the Stakeholder Certification Group, in particular regarding the number, composition, and the appointment of its members by the Executive Director and the operation of the Group, shall be specified in the Agency’s internal rules of operation and shall be made public. 3. The term of office of the Stakeholder Certification Group members shall be two-and-a-half years. Their mandate shall be renewable. Members of the Management Board may not be members of the Stakeholder Certification Group. Members of the Permanent Stakeholder Group can be also Members of the Stakeholder Certification Group. Experts from the Commission and the Member States shall be entitled, upon invitation, to be present at the meetings of the Stakeholder Certification Group. Representatives of other bodies deemed relevantly the Executive Director, who are not members of the Stakeholder Certification Group, may be invited to attend the meetings of the Stakeholder Certification Group and to participate in its work. 4. The Stakeholder Certification Group shall advise the Agency in respect of the performance of its activities with regards Title III of the present Regulation. It shall in particular be entitled to propose to ENISA, to the Member States and to the Commission the preparation of a candidate European cybersecurity certification scheme, as conferred to in Article 44 of the present Regulation, as well as to participate in the procedures described in Articles 43 to 48 and Article 53 of the Present Regulation for the approval of such schemes. 5. For the purpose of ensuring that the Stakeholder Certification Group possesses the necessary expertise, the Executive Director or the members of the Stakeholder Certification Group shall nominate ad-hoc members for the proposal, development or adoption of any new candidate scheme. These ad-hoc members shall have the same rights and obligations as the appointed members, and shall be entitled to provide their expertise at any stage of the development and/ or the approval of the respective candidate scheme. An ad-hoc member may contribute to the work of the Stakeholder Certification Group for more than one candidate scheme.

Amendment 390 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Gesine MEISSNER, Morten PETERSEN

Proposal for a regulation
Article 20 a (new)

Article 20 a Consultation Forum The Commission, together with the Agency ,shall ensure that, in the conduct of its activities, it observes, in respect of each implementing measure, a balanced participation of Member States’ representatives and all interested parties concerned with the product or product group in question, such as industry, including SMEs, trade unions, traders, retailers, importers, environmental protection groups and consumer and end- user organisations. These parties shall meet in a Consultation Forum. The outcome of this forum may lead to an impetus for proposal of a candidate scheme. The rules of procedure of the Forum shall be established by the Commission.

Amendment 391 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Gesine MEISSNER, Morten PETERSEN

Proposal for a regulation
Article 21 a (new)

Article 21 a Request to the Agency 1. The Agency should establish and manage a single entry point through which requests for advice and assistance falling within the Agency’s objectives and tasks shall be addressed. These requests should be accompanied by background information explaining the issue to be addressed. Agency should draw up the potential resource implications, and, in due course, follow-up to the requests. If the Agency refuses a request, it shall give a justification. 2. Requests referred to in paragraph 1 may be made by: a) the European Parliament b) the Council c) the Commission d) any competent body appointed by a Member State, such as a national regulatory authority defined in Article 2 of Directive 2002/21/EC. 3. The practical arrangements for applying paragraphs 1 and 2, regarding in particular submission, prioritisation, follow-up and information, shall be laid down by the Management Board in the Agency’s internal rules of operation.

Amendment 392 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 23 – paragraph 2

2. The Agency shall ensure that the public and any interested parties are given appropriate, objective, reliable and easily accessible information, in particular with regard to its work plan and relative progress and the results of its work. It shall also make public the declarations of interest made in accordance with Article 22.

Amendment 393 #

Proposal for a regulation
Article 23 – paragraph 2

Amendment 394 #

Clare MOODY, Theresa GRIFFIN

Proposal for a regulation
Article 34 – paragraph 2

2. The Management Board shall adopt a decision laying down rules on the secondment to the agency of national experts, amongst others disallowing no- cost practices and promoting fair remuneration.

Amendment 395 #

Proposal for a regulation
Article 39 – paragraph 1

1. In so far as is necessary in order to achieve the objectives set out in this Regulation, the Agency may cooperate with the competent authorities of third countries or with international organisations or both. To this end, the Agency may, subject to prior approval by the Commission, establish working arrangements with the authorities of third countries and international organisations. Cooperation with NATO, where it takes place, may include joint cybersecurity exercises and joint cyber incident response coordination. These arrangements shall not create legal obligations incumbent on the Union and its Member States.

Amendment 396 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 41 – paragraph 2

Amendment 397 #

Proposal for a regulation
Title 2 a (new)

SECURITY BY DESIGN AND BY DEFAULT FRAMEWORK

Amendment 398 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article –43 (new)

Article -43 Security by design and by default 1. Taking into account the state of the art, manufacturers and service providers shall ensure the security by design and by default of their ICT products, processes, services and systems sold in or exported from the Union. They must ensure that the software running on their ICT product, processes, service or system is secure and does not have any known security vulnerability considering the state of the art of technology at the time. ICT products, processes, services and systems must implement the following technical measures: (a) ICT products, processes, services and systems must be provided with up to date software and must include mechanisms to receive secure, properly authenticated and trusted software updates on a regular basis; (b) remote access capabilities of the ICT product, processes, services or systems must be documented and secured against unauthorised access during the installation at the latest; (c) ICT products shall not have the same default hardcoded standard passwords for all devices; (d) Data stored by ICT products, processes, services and systems must be securely protected by state of the art methods such as encryption; (e) ICT products, processes, services and systems shall only accept high- security methods for authentication. 2. Manufacturers and service providers must notify the competent authority of any known security vulnerabilities as soon as they are discovered. In addition, they must provide a timely free of charge repair and/or replacement to overcome any new security vulnerability discovered. 3. ICT products, processes, services and systems placed on the market shall comply with the obligations in paragraph 1 during their foreseeable and normal period of use. 4. While manufacturers are responsible for ensuring product compliance of an ICT product, process, service or system, importers must make sure that what they place on the market comply with the applicable requirements and do not present a risk to the European public. The importer has to verify that the manufacturer outside the EU has taken the necessary steps and that the product, process, service or system complies with the provisions of the previous paragraphs. Distributors of ICT products, processes, services and systems must have a basic knowledge of the legal requirements and the accompanying documentation. Distributors should be able to identify non-compliance. They must also be able to demonstrate to national authorities that they have acted with due care and have confirmation from the manufacturer or the importer that the necessary measures have been taken. Furthermore, a distributor must be able to assist national authorities in their efforts to receive the required documentation; 5. The Commission shall by means of an implementing act, and in cooperation with ENISA, adopt detailed rules on the specificities of the security requirements provided in paragraph 1. 6. Where the market surveillance authorities have reasons to believe that the ICT product, process, service or system does not comply with the requirements laid down in this Regulation, they shall without delay require the relevant manufacturer or service provider to take appropriate corrective action to bring the product into compliance with those requirements, to withdraw the product from the market, or to recall it within a reasonable period, commensurate with the nature of the risk, as they may prescribe. 7. Where the manufacturer or service provider does not take adequate corrective action within the period referred to in paragraph 5, the market surveillance authorities shall take appropriate provisional measures to prohibit or restrict the product being made available on their national markets, to withdraw the product from that market or to recall it. 8. Market surveillance authorities shall organise appropriate checks on product compliance and oblige the manufacturers or service providers to recall non-compliant products from the market. When identifying the products that will be subject to compliance check, national certification authorities shall prioritise high risk products for consumers, products embedded with new technologies and/or products with high selling rates.

Amendment 399 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article –43 a (new)

Article -43 a Directive (EU)2014/53/EU is amended by adding the following point in Article 3, paragraph 3: (fa) (new) radio equipment is cybersecure by design, by default and by implementation;

Amendment 400 #

Michał BONI, Henna VIRKKUNEN, Massimiliano SALINI, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Article 43 – paragraph 1

With a view to ensuring the proper functioning of the internal market while aiming at a high level of cybersecurity, cyber resilience and trust within the Union, a voluntary European cybersecurity certification framework shall be introduced. The Framework shall provide fair and equal opportunities for all companies in Europe. A European cybersecurity certificat~~ion schem~~e shall attest that the ICT development procedures, products and/or services tha~~t have been certified~~ s been evaluated, using a~~ccordance with such scheme comply with specified requirements as regards their ability to resist at a given level of assurance, actions that aim to compromise the availability, authentic~~ standardised methodology for conformity assessment, against specified security standards laid down in a European cybersecurity certification scheme, that have been defined with the aim to protect the availability, integrity or confidentiality of stored or transmitted or processed data or the functions or services offered by, or accessible via, those products, processes, services and systems.

Amendment 401 #

Dan NICA, Miroslav POCHE

Proposal for a regulation
Article 43 – paragraph 1

A European cybersecurity certification scheme shall attest that the ICT products and services that have been certified in accordance with such scheme comply with specified requirements as regards their ability to resist at a given level of assurance, actions that aim to compromise the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the functions or services offered by, or accessible via, those products, processes, services and systems. A European cybersecurity certification scheme shall establish liability criteria and propose levels of insurance for ICT products and services and where feasible for data recovery.

Amendment 402 #

Proposal for a regulation
Article 43 – paragraph 1

A European cybersecurity certification scheme shall attest that the ICT products, processes and services that have been certified in accordance with such scheme comply with specified requirements as regards their ability to resist at a given level of assurance, actions that aim to compromise the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the functions or services offered by, or accessible via, those products, processes, services and systems.ccording to standards as regards their ability to meet security objectives;

Amendment 403 #

Proposal for a regulation
Article 43 – paragraph 1

A European cybersecurity certification scheme shall attest that the ICT products, processes and services that have been certified in accordance with such scheme comply with specified requirements according to standards, as regards their ability to resist ~~at a given level of assurance, actions that aim to compromise the availability, authenticity, integrity or confidentiality of stored or transmitted or processed d~~at a ~~or the functions or services offered by, or accessible via, those products, processes, services and systems~~given level of assurance.

Amendment 404 #

Proposal for a regulation
Article 43 – paragraph 1

A European cybersecurity certification scheme shall attest that the ICT products and services that have been certified in accordance with such scheme have no known vulnerabilities at the time of the certification, and comply with specified requirements as regards their ability to resist dynamically at a given level of assurance, actions that aim to compromise the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the functions or services offered by, or accessible via, those products, processes, services and systems.

Amendment 405 #

Proposal for a regulation
Article 43 – paragraph 1

A European cybersecurity certification scheme shall attest that the ICT products, processes and services that have been certified in accordance with such scheme comply with specified requirements set out by European or international standards as regards their ability to resist at a given level of assurance, actions that aim to compromise the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the functions or services offered by, or accessible via, those products, processes, and services ~~and systems~~throughout their life cycle.

Amendment 406 #

Proposal for a regulation
Article 43 – paragraph 1

A European cybersecurity certification scheme shall attest that the ICT products and services that have been certified in accordance with such scheme comply with specified requirements set out by European or international standards as regards their ability to resist at a given level of assurance, actions that aim to compromise the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the functions or services offered by, or accessible via, those products, processes, services and systems.

Amendment 407 #

Proposal for a regulation
Article 43 – paragraph 1

A European cybersecurity certification scheme shall attest that the ICT development procedures, products and services that have been certified in accordance with such scheme comply with specified requirements as regards their ability to resist at a given level of assurance, actions that aim to compromise the availability, authentics been evaluated, using a standardised methodology for conformity assessment, against specified security standards laid down in a European cyber security certification scheme, that have been defined with the aim to protect the availability, integrity or confidentiality of stored or transmitted or processed data or the functions or services offered by, or accessible via, those products, processes, services and systems.

Amendment 408 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Martina WERNER, Eva KAILI, Clare MOODY

Proposal for a regulation
Article 43 – paragraph 1

A European cybersecurity certification scheme shall attest that the ICT products ~~and servic~~, services and processes that have been certified in accordance with such scheme comply with specified requirements as regards their ability to resist at a given level of assurance, actions that aim to compromise the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the functions or services offered by, or accessible via, those products, processes, services and systems.

Amendment 409 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Article 43a Security by design and by default 1. Taking into account the state of the art, producers and service providers shall ensure the security by design and by default of their ICT products and services. Manufacturers and service providers must ensure that the software running on their ICT product or service is secure and does not have any known security vulnerability considering the state of the art technology at the time. ICT products and services must implement the following technical measures: (a) ICT products and services must be provided with up to date software and must include mechanisms to receive secure, properly authenticated and trusted software updates on a regular basis; (b) remote access capabilities of the ICT product or service must be documented and secured against unauthorized access during the installation at the latest; (c) ICT products shall not have the same default hardcoded standard passwords for all devices; (d) Data stored by ICT products and services must be securely protected by state of the art methods such as encryption; (e) ICT products and services shall only accept high-security methods for authentication. 2. Manufacturers and service providers must notify the competent authority of any known security vulnerabilities as soon as they are discovered. In addition, they must provide a timely repair and/or replacement to overcome any new security vulnerability discovered. 3. ICT products and services placed on the market shall comply with the obligations in paragraph 1 during their foreseeable and normal period of use. 4. The Commission shall by means of implementing act, and in cooperation with ENISA, adopt detailed rules on the specificities of the security requirements provided in paragraph 1. 5. Where the market surveillance authorities have reasons to believe that the ICT product or service does not comply with the requirements laid down in this Regulation, they shall without delay require the relevant manufacturer or service provider to take appropriate corrective action to bring the product into compliance with those requirements, to withdraw the product from the market, or to recall it within a reasonable period, commensurate with the nature of the risk, as they may prescribe. 6. Where the manufacturer or service provider does not take adequate corrective action within the period referred to in paragraph 5, the market surveillance authorities shall take appropriate provisional measures to prohibit or restrict the product being made available on their national markets, to withdraw the product from that market or to recall it. 7. Market surveillance authorities shall organise appropriate checks on product compliance and oblige the manufacturers or service providers to recall non-compliant products from the market. When identifying the products that will be subject to compliance check, national certification authorities shall prioritise high risk products for consumers, products embedded with new technologies and/or products with high selling rates.

Amendment 410 #

Proposal for a regulation
Article 44 – paragraph 1

1. Following a request from the Commission, ENISA shall prepare a candidate European cybersecurity certification scheme which meets the requirements set out in Articles 45, 46 and 47 of this Regulation. ~~Member States or the European Cybersecurity Certification Group (the 'Group') established under Article 53 may propose~~The request from the Commission to prepare a candidate European cybersecurity certification scheme should be justified with one or more of the following reasons: (a) existing cybersecurity certification schemes are fragmenting the internal market; (b) there is a current or foreseen need to support Union’s legislation; (c) there is a consensual request from Member States, the European Cybersecurity Certification Group (the 'Group') established under Article 53 or the Permanent stakeholder group established under article 20; the European Commission shall make sure that the pre~~paration of a candidate Europe~~quest coming from a Member State is reflective of a balanced participation of the interested parties concerned, such as industries, including SMEs, trade unions, civil society and c~~ybersecurity certification scheme to the Commission.~~ onsumers organisation. In this light, Member States shall ensure appropriate measures to enable the parties to be consulted at national level on the process of preparing and monitoring certification schemes

Amendment 411 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Clare MOODY

Proposal for a regulation
Article 44 – paragraph 1

1. Following a request from the Commission or the European Cybersecurity Certification Group, ENISA shall prepare a candidate European cybersecurity certification scheme which meets the requirements set out in Articles 45, 46 and 47 of this Regulation. Member States or the European Cybersecurity Certification Group (the 'Group') established under Article 53 may propose the preparation of a candidate European cybersecurity certification scheme to the Commission. The Commission and European Cybersecurity Certification Groups hall consider proposals for a European cybersecurity certification scheme proposed by the Stakeholders Consultation Platforms

Amendment 412 #

Proposal for a regulation
Article 44 – paragraph 1

1. ~~Following a request from the Commission,~~ ENISA shall prepare a candidate European cybersecurity certification scheme which meets the requirements set out in Articles 45, 46 and 47 of this Regulation. Member States or the European Cybersecurity Certification Group (the 'Group') established under Article 53 ~~may~~, shall propose the preparation of a candidate scheme that falls under the scope of Article 45 (1) (c), while the Stakeholder Certification Group, established under Article [20b], shall propose the preparation of a candidate European cybersecurity certification scheme tohat falls under the scope of Article 45 (1) (a) or (b), to ENISA and the Commission.

Amendment 413 #

Michał BONI, Henna VIRKKUNEN, Massimiliano SALINI, Krišjānis KARIŅŠ, Gunnar HÖKMARK, Marian-Jean MARINESCU

Proposal for a regulation
Article 44 – paragraph 1

1. Following a request from the Commission, ENISA shall prepare a candidate European ~~cyber~~IT security certification scheme which meets the requirements set out in Articles 45, 46 and 47 of this Regulation. Member States or, the European Cybersecurity Certification Group (the 'Group') established under Article 53 or the Permanent Stakeholders Group established under Article 20, may propose the preparation of a candidate European ~~cyber~~IT security certification scheme to the Commission.

Amendment 414 #

Proposal for a regulation
Article 44 – paragraph 1

Amendment 415 #

Proposal for a regulation
Article 44 – paragraph 1

Amendment 416 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Article 44 – paragraph 1

1. Following a request from the Commission, ~~ENISA~~the European Standardisation Organisations (ESO) shall prepare a candidate European cybersecurity certification scheme ~~which meets the requirements set out in Articles 45, 46 and 47 of this Regulation~~. Member States or the European Cybersecurity Certification Group (the 'Group') established under Article 53 may propose the preparation of a candidate European cybersecurity certification scheme to the Commission.

Amendment 417 #

Proposal for a regulation
Article 44 – paragraph 1 a (new)

1a. The Commission shall, after having conduced an open and transparent consultation with relevant stakeholders, adopt and publish a multiannual Union work programme for European cybersecurity certification schemes, which shall identify common actions to be undertaken at Union level and strategic priorities. The work programme shall in particular include a priority list of identified ICT products, processes and services subject to a European cybersecurity certification scheme. Prior to adopting the work programme, the Commission shall consult ENISA and have the utmost regard of its opinion.

Amendment 418 #

Michał BONI, Massimiliano SALINI, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult all relevant stakeholders and closely cooperate with the Group. The Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary. define the security objectives, security requirements and elements of the candidate scheme. All aspects regarding the procedures of the conformity assessment will be defined by the Commission, based on ENISA’s findings. In doing so, ENISA shall cooperate closely with the industry interested stakeholders and consult all relevant stakeholders and closely cooperate with the Group. The Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary. Where relevant, ENISA may in addition set up a certification stakeholder working group, composed of members of the Permanent Stakeholders’ Group, industry stakeholders to ensure industry- led approach and any other relevant stakeholders, to provide expert advice on areas covered by a specific candidate scheme;

Amendment 419 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult all relevant stakeholders, including consumers' associations, and closely cooperate with the Group~~. The G~~ and the Permanent stakeholder group. The Group and the permanent stakeholder group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary. When preparing each candidate scheme ENISA shall define a checklist of risks and cybersecurity features to effectively counter those risks;

Amendment 420 #

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult all relevant stakeholders and closely cooperate with the Group, and take into consideration national and international standards already in place, including informal agreements within industry associations, in order to avoid duplications. The Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary.

Amendment 421 #

Nadine MORANO

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult in a transparent manner all relevant stakeholders and closely cooperate with the Group~~. The Group~~, the Permanent Stakeholders' Group and, for each candidate scheme, an ad hoc consultation platform. They shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary.

Amendment 422 #

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult all relevant stakeholders, as well as the consumer organisations, Article 29 Working Party and the European Data Protection Board as appropriate and closely cooperate with the Group. The Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary.

Amendment 423 #

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult all relevant stakeholders in a formal, standardised and transparent process, and closely cooperate with the Group. The Group and all relevant stakeholders shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary.

Amendment 424 #

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult all relevant stakeholders and closely cooperate with the Group and the Stakeholders Consultation Platforms. The Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary.

Amendment 425 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Gesine MEISSNER

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult all relevant stakeholders by transparent consultation processes and closely cooperate with the Group. The Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary.

Amendment 426 #

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult all relevant stakeholders as requested under Article 20 a and closely cooperate with the Group. The Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessary.

Amendment 427 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Clare MOODY

Proposal for a regulation
Article 44 – paragraph 2

2. When preparing ~~candidate schemes~~the first draft referred to in paragraph 1 of this Article, E~~NISA~~SO shall consult all relevant stakeholders and closely cooperate with the Group. The Group shall provide E~~NISA~~SO with the assistance and expert advice required by E~~NISA~~SO in relation to the preparation of the candidate scheme, including by providing opinions where necessary.

Amendment 428 #

Proposal for a regulation
Article 44 – paragraph 2

2. ~~When~~Before preparing candidate schemes referred to in paragraph 1 of this Article, ENISA shall consult all relevant stakeholders and closely cooperate with the Group. The Group shall provide ENISA with the assistance and expert advice required by ENISA in relation to the preparation of the candidate scheme, including by providing opinions where necessarythe Commission shall conduct an open public consultation for all relevant stakeholders. In preparing the consultation the Commission shall closely cooperate with the European Cybersecurity Certification Group, ENISA and the Stakeholder Certification Group.

Amendment 429 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Clare MOODY

Proposal for a regulation
Article 44 – paragraph 2 a (new)

2a. The European Cybersecurity Certification Group and the Stakeholder Certification Group shall provide the assistance and expert advice required by ENISA in relation to the preparation of the candidate European cybersecurity scheme, including by providing opinions where necessary.

Amendment 430 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Clare MOODY

Proposal for a regulation
Article 44 – paragraph 2 b (new)

2b. Apart of in relation to the proposal of a scheme that falls under the scope of Article 45 (1) (a) and (b), the Stakeholder Certification Group shall be consulted by the Commission and asked for approval before the final adoption of a European cybersecurity certification scheme. The same shall apply for the proposal of a scheme that falls under the scope of Article 45 (1) (c) vis-à-vis the European Cybersecurity Certification Group.

Amendment 431 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Clare MOODY

Proposal for a regulation
Article 44 – paragraph 2 c (new)

2c. When preparing a candidate scheme, ENISA, with the advice of the European Cybersecurity Certification Group and the Stakeholder Certification Group for their respective candidate schemes, shall define a timeline by when the specific candidate scheme shall become effective. Failure to meet this deadline shall result in the candidate scheme being considered void and revoked.

Amendment 432 #

Michał BONI, Henna VIRKKUNEN, Massimiliano SALINI, Krišjānis KARIŅŠ, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Article 44 – paragraph 3

3. ENISA shall transmit the candidate European cybersecurity certification scheme prepared in accordance with paragraph 2 of this Article to the Commission. ENISA shall include in the information to the Commission any remarks or reservations made by members of the Group.

Amendment 433 #

Proposal for a regulation
Article 44 – paragraph 3

3. ENISA shall transmit without delay the candidate European cybersecurity certification scheme prepared in accordance with paragraph 2 of this Article to the Commission.

Amendment 434 #

Proposal for a regulation
Article 44 – paragraph 4

4. The Commission, based on the candidate scheme proposed by ENISA, may adopt implementing acts, in accordance with Article 55(1), providing for European cybersecurity certification schemes for ICT products and services meeting the requirements of Articles 45, 46 and 47 of this Regulation. The Commission may consult the European Data Protection Board and take account of its view before adopting such implementing acts.

Amendment 435 #

Proposal for a regulation
Article 44 – paragraph 4

Amendment 436 #

Michał BONI, Seán KELLY, Henna VIRKKUNEN, Massimiliano SALINI, Krišjānis KARIŅŠ, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Article 44 – paragraph 4

Amendment 437 #

Proposal for a regulation
Article 44 – paragraph 4

Amendment 438 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 44 – paragraph 4

4. The Commission, based on the candidate scheme proposed by ENISA, may adopt ~~implementing~~delegated acts, in accordance with Article 55(1), providing for European cybersecurity certification schemes for ICT products ~~and servic~~, services and processes meeting the requirements of Articles 45, 46 and 47 of this Regulation.

Amendment 439 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 44 – paragraph 5

5. ENISA shall maintain a dedicated website providing information on, and publicity of, European cybersecurity certification schemes. ENISA shall also strive to provide consumers with relevant information on applicable certification schemes, for example by providing guidelines and recommendations to online and offline marketplaces.

Amendment 440 #

Proposal for a regulation
Article 44 – paragraph 5

5. ENISA shall maintain a dedicated website, complying with the Directive (EU) 2016/2102, providing information on, and publicity of, European cybersecurity certification schemes, the withdrawn and the expiration of any certification scheme and certified ICT products, processes, services and systems.

Amendment 441 #

Proposal for a regulation
Article 44 – paragraph 5 a (new)

5a. The Commission may on behalf of the European Union enter mutual recognition agreements of certificates with foreign markets or third countries. Such agreements for mutual recognition shall be established according to the same procedure for preparation and adoption as otherwise laid out for schemes in this Article.

Amendment 442 #

Pavel TELIČKA, Carolina PUNSET, Caroline NAGTEGAAL, Gesine MEISSNER, Morten PETERSEN

5a. ENISA, taking utmost attention of the opinion of the Group, shall make sure that any proposals for European cybersecurity schemes do not prevent effective competition by creating barriers for market entry by new companies and products.

Amendment 443 #

Proposal for a regulation
Article 44 – paragraph 5 a (new)

5a. Adopted schemes shall be reviewed and if necessary updated on regular basis in cooperation with relevant stakeholders and the Group within the structure established under this regulation.

Amendment 444 #

Proposal for a regulation
Article 44 – paragraph 5 a (new)

5a. The Agency shall review adopted schemes upon request from the Group, the Commission or at least every five years taking into account feedback received from relevant stakeholders.

Amendment 445 #

Michał BONI, Seán KELLY, Henna VIRKKUNEN, Massimiliano SALINI, Krišjānis KARIŅŠ, Gunnar HÖKMARK

Proposal for a regulation
Article 44 – paragraph 5 b (new)

5b. ENISA shall provide the necessary mechanisms, guidelines and procedures for adaptation and updates of the European cybersecurity schemes in order to accommodate new developments in cybersecurity technology.

Amendment 446 #

Proposal for a regulation
Article 45 – paragraph 1 – introductory part

A European cybersecurity certification scheme shall be so designed to take into account, as applicable, the following security objectives to ensure the availability, integrity and confidentiality of services:

Amendment 447 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 45 – paragraph 1 – introductory part

A European cybersecurity certification scheme shall be so designed to take into account, as applicable, ~~the following security objectiv~~objectives linked to the following categories:

Amendment 448 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 45 – paragraph 1 – point a

(a) ~~protect data stored, transmitted or otherwise processed against accidental or unauthorised storage, processing, access or disclosure;~~For products corresponding to assurance level basic or the self- declaratory level of certification, consumer electronic devices as defined in Article 2 [(11) a (new)]. The European cybersecurity certification schemes for this category shall support the adoption and commercialisation of international standards from and to the Single Market.

Amendment 449 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 45 – paragraph 1 – point b

(b) ~~protect data stored, transmit~~For products corresponding to assurance level substantial, ICT products, services and processes performing an industrial control systedm or ~~otherwise processed against accid~~used in robotics and autonomous vehicles, or software and hardware terminal equipment used for the provision of essential ~~or unauthorised destruction, accidental los~~services for operators as defined in Directive (EU)2016/1148. The European cybersecurity certification schemes for althis category shall be based on internation;al standards.

Amendment 450 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Clare MOODY

Proposal for a regulation
Article 45 – paragraph 1 – point c

(c) ~~ensure that authorised persons, programmes or machin~~For products corresponding to level of certification high, ICT products, services can ~~access exclusively the data, services or functions to which their access rights refer;~~d processes used by public administration of a Member State. The European cybersecurity certification schemes for this category shall be based on international standards, existing national or multilateral standards in use by Member States.

Amendment 451 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Clare MOODY

Proposal for a regulation
Article 45 – paragraph 1 – point c

(c) ensure that authorised persons, programmes or machines can access exclusively the data, services or functions to which their access rights refer and a process is in place to identify and document all dependencies and vulnerabilities in ICT products, processes and services;

Amendment 452 #

Proposal for a regulation
Article 45 – paragraph 1 – point d

~~(d) record which data, functions or services have been communicated, at what times and by whom;~~deleted

Amendment 453 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Clare MOODY

Proposal for a regulation
Article 45 – paragraph 1 – point d

(d) ~~record which data, functions or services have been communicated, at what times and by whom~~ensure that ICT products, processes and services do not contain known exploitable vulnerabilities and resist to a defined level of attack;

Amendment 454 #

Proposal for a regulation
Article 45 – paragraph 1 – point e

~~(e) ensure that it is possible to check which data, services or functions have been accessed or used, at what times and by whom;~~deleted

Amendment 455 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Clare MOODY

Proposal for a regulation
Article 45 – paragraph 1 – point f

~~(f) restore the availability and access to data, services and functions in a timely manner in the event of physical or technical incident;~~deleted

Amendment 456 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Clare MOODY

Proposal for a regulation
Article 45 – paragraph 1 – point g

~~(g) ensure that ICT products and services are provided with up to date software that does not contain known vulnerabilities, and are provided mechanisms for secure software updates.~~deleted

Amendment 457 #

Proposal for a regulation
Article 45 – paragraph 1 – point g

(g) ensure that ICT products and services are provided with up -to -date software and hardware that does not contain known vulnerabilities~~, and~~; ensure that they have been designed and implemented in such a way as to effectively limit their susceptibility to vulnerabilities, and ensure that they are provided with mechanisms for secure software updates., including automatic security updates and the possibility of hardware upgrades;

Amendment 458 #

Proposal for a regulation
Article 45 – paragraph 1 – point g

(g) ~~ensur~~facilitate that ICT products and services are provided with up to date software ~~that does not conta~~and hardware, that there are adequate and timely updates fixing known vulnerabilities, and are provided mechanisms for secure software and hardware updates.

Amendment 459 #

Proposal for a regulation
Article 45 – paragraph 1 – point g – point i (new)

(i) (h) ensure that ICT products and services are developed according to the security requirements of the particular scheme

Amendment 460 #

Proposal for a regulation
Article 45 – paragraph 1 – point g a (new)

(ga) ensure that the environment for ICT products and services is divided into smaller sub-systems and sub-networks to make it more manageable to protect and to contain the damage in the event of an incident.

Amendment 461 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 45 – paragraph 1 – point g a (new)

Amendment 462 #

Proposal for a regulation
Article 45 – paragraph 1 – point g a (new)

(ga) ensure that ICT product, process, services and systems are developed and operated in accordance with the principle of security by design and by default complying and the obligations defined in art -43.

Amendment 463 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 46 – paragraph 1

1. AWithout prejudice to the security obligations defined in art -43, a European cybersecurity certification scheme may specify one or more of the following risk- based assurance levels: ~~basic~~functionally secure, substantially and/or highly secure, for ICT products ~~and services issued under that scheme~~, processes, services and systems issued under that scheme. The assurance level shall be based on the checklist of risks and the corresponding cybersecurity features, identified by ENISA according to art 44(2), which are available in the ICT product, process, service or system to which the certification scheme applies.

Amendment 464 #

Nadine MORANO

Proposal for a regulation
Article 46 – paragraph 1

1. A European cybersecurity certification scheme may specify one or more of the following risk-based assurance levels~~: basic, substantial and/or high, for ICT products and services issued under that scheme.~~ according to the context and intended purpose of the ICT products, processes and services: basic, substantial and/or high. The conformity assessment methods that may be used must be specified in the elements of each European cybersecurity certification scheme, on the basis of a risk analysis.

Amendment 465 #

Clare MOODY, Theresa GRIFFIN, Peter KOUROUMBASHEV, Arne LIETZ

Proposal for a regulation
Article 46 – paragraph 1

1. A European cybersecurity certification scheme may specify one or more of the following assurance levels: basic, substantial and/or high, for ICT products and services issued under that scheme. A certification scheme with varying assurance levels shall be accompanied by information explaining the risk that remains at each assurance level and the need for consumers to be continually vigilant and aware of cyber threats.

Amendment 466 #

Proposal for a regulation
Article 46 – paragraph 1

Amendment 467 #

Michał BONI, Massimiliano SALINI, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Article 46 – paragraph 1

1. A European cybersecurity certification scheme may specify one or more of the following ~~assurance levels: basic, substantial and/or high, for~~risk-based levels according to the context and intended use of the ICT products, processes and service~~s issued under that scheme~~: basic, substantial and/or high.

Amendment 468 #

Dan NICA, Miroslav POCHE

Proposal for a regulation
Article 46 – paragraph 1

1. A European cybersecurity certification scheme ~~may~~shall specify liability criteria for one or more of the following assurance levels: basic, substantial and/or high, for ICT products and services issued under that scheme.

Amendment 469 #

Proposal for a regulation
Article 46 – paragraph 1

1. A European cybersecurity certification scheme may specify one or more ~~of the following assurance levels: basic, substantial and/or high, for ICT products and~~assurance requirements based on the risks and threats determined by the context in which the product, process or services is~~sued under that schem~~ to operate.

Amendment 470 #

Proposal for a regulation
Article 46 – paragraph 1

1. A European cybersecurity certification scheme may specify one or more ~~of the following assurance levels: basic, substantial and/or high, for ICT products and~~assurance requirements based on the risks and threats determined by the context in which the product, process or services is~~sued under that schem~~ to operate.

Amendment 471 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Martina WERNER, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 46 – paragraph 1

1. A European cybersecurity certification scheme may specify one or more of the following assurance levels: basic, substantial and/or high, for ICT products ~~and servic~~, services and processes issued under that scheme.

Amendment 472 #

Proposal for a regulation
Article 46 – paragraph 1

1. A European cybersecurity certification scheme may specify one or more of the following assurance levels: basic, ~~substantial~~intermediate and/or high, for ICT products and services issued under that scheme.

Amendment 473 #

Proposal for a regulation
Article 46 – paragraph 1 – subparagraph 1 (new)

2. ENISA shall identify or develop assurance levels to be specified in European cybersecurity certification schemes in consultation with interested stakeholders.

Amendment 474 #

Proposal for a regulation
Article 46 – paragraph 1 a (new)

1a. The conformity assessment methods that may be used must be specified in the elements of each European cybersecurity certification scheme, pursuant to Article 47 and on the basis of a risk analysis.

Amendment 475 #

Proposal for a regulation
Article 46 – paragraph 2

2. The assurance levels basic, substantial and high shall meet the following criteria respectively: (a) a certificate issued in the context of a European cybersecurity certification scheme, which provides a limited degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of cybersecurity incidents; (b) refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a substantial degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of cybersecurity incidents; (c) a certificate issued in the context of a European cybersecurity certification scheme, which provides a higher degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service than certificates with the assurance level substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent cybersecurity incidents.deleted assurance level basic shall refer to assurance level substantial shall assurance level high shall refer to

Amendment 476 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 46 – paragraph 2 – introductory part

2. The assurance levels ~~basic, substantial and high shall meet the following criteria respectively:~~ refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a corresponding degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product, processes and service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of cybersecurity incidents; the assurance level shall be defined on a case by case basis.

Amendment 477 #

Proposal for a regulation
Article 46 – paragraph 2 – introductory part

2. The assurance levels ~~basic~~functionally secure, substantially secure and/or highly secure shall meet the following criteria respectively:

Amendment 478 #

Proposal for a regulation
Article 46 – paragraph 2 – introductory part

2. The assurance levels basic, substantial and high shall meet the following criteria and evaluation methods, respectively:

Amendment 479 #

Proposal for a regulation
Article 46 – paragraph 2 – introductory part

2. The assurance levels basic, substantial and high shall meet the following criteria and evaluation method, respectively:

Amendment 480 #

Proposal for a regulation
Article 46 – paragraph 2 – introductory part

2. The assurance levels basic, ~~substantial~~intermediate and high shall meet the following criteria respectively:

Amendment 481 #

Proposal for a regulation
Article 46 – paragraph 2 – point a

Amendment 482 #

Proposal for a regulation
Article 46 – paragraph 2 – point a

(a) assurance level basic shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a limited degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of cybersecurity incidents; an assurance level basic certificate shall certify that known basic cyber risks are covered. The evaluation method shall be based on the technical review by a conformity assessment body of the technical documentation associated with an information and communication technology product or service;

Amendment 483 #

Pavel TELIČKA, Morten LØKKEGAARD, Caroline NAGTEGAAL, Gesine MEISSNER

Proposal for a regulation
Article 46 – paragraph 2 – point a

Amendment 484 #

Proposal for a regulation
Article 46 – paragraph 2 – point a

(a) certificate assurance level basic shall ~~refer to a certificat~~correspond to the iassued in the context of a European cybersecurity certification scheme, which provides a limited degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of cybersecurity incidentsessment by a third party that the basic risks of cyber incidents for ICT processes, products or services are covered;

Amendment 485 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 46 – paragraph 2 – point a

(a) assurance level basic shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a limited degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of cybersecurity incidents; the evaluation method must be based on the technical review by an assessment body of the conformity of the technical documentation associated with an information and communication technology product or service;

Amendment 486 #

Proposal for a regulation
Article 46 – paragraph 2 – point a

(a) assurance level ~~basic~~"functionally secure" shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a ~~limi~~n adequated degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service as it corresponds to the compliance of the security obligations defined in art [-43] according to the principle of security by design and by default , and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of cybersecurity incidents;

Amendment 487 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 46 – paragraph 2 – point a

Amendment 488 #

Proposal for a regulation
Article 46 – paragraph 2 – point a

(a) ~~assurance~~The risk level basic shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a limited degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of whichcorrespond to a low risk related to an ICT product, process and service. A low level of risk exists when an attack on the ICT product, process and service does not compromise significantly the availability, authenticity, integrity, confidentiality or other important objectives such as the health of users or third parties, the environment, privacy, other important legal interests or critical infrastructures and its ~~to decrease the risk of cybersecurity inciden~~supporting systems or products;.

Amendment 489 #

Pavel TELIČKA, Morten LØKKEGAARD, Caroline NAGTEGAAL, Gesine MEISSNER

Proposal for a regulation
Article 46 – paragraph 2 – point a

Amendment 490 #

Proposal for a regulation
Article 46 – paragraph 2 – point a a (new)

(aa) This assessment shall include the review of the technical documentation of the ICT product, service or process;

Amendment 491 #

Proposal for a regulation
Article 46 – paragraph 2 – point b

Amendment 492 #

Proposal for a regulation
Article 46 – paragraph 2 – point b

(b) assurance level substantial shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a substantial degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of cybersecurity incidents; an assurance level substantial certificate shall certify that the known risks of cyber incidents are covered and that the product, service or system can withstand attacks with limited resources. The evaluation method shall be based on the verification, by a conformity assessment body, of the conformity of the security features of the product or service;

Amendment 493 #

Pavel TELIČKA, Morten LØKKEGAARD, Caroline NAGTEGAAL, Gesine MEISSNER

Proposal for a regulation
Article 46 – paragraph 2 – point b

(b) assurance level ~~substantial~~intermediate shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a substantial degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of cybersecurity incidentsn intermediate degree of confidence ;

Amendment 494 #

Proposal for a regulation
Article 46 – paragraph 2 – point b

(b) certificate assurance level substantial shall ~~refer to a certificat~~correspond to the iassued in the context of a European cybersecurity certification scheme, which provides a substantial degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of cybersecurity incidentsessment by a third party that the substantial risks of cyber incidents for ICT processes, products or services are covered;

Amendment 495 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 46 – paragraph 2 – point b

(b) assurance level substantial shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a substantial degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of cybersecurity incidents; the evaluation method must be based on the verification, by a conformity assessment body, of the conformity of the security features of the product or service.

Amendment 496 #

Proposal for a regulation
Article 46 – paragraph 2 – point b

Amendment 497 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 46 – paragraph 2 – point b

(b) assurance level "substantially secure" shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a substantial degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of cybersecurity incidents;

Amendment 498 #

Pavel TELIČKA, Morten LØKKEGAARD, Caroline NAGTEGAAL, Gesine MEISSNER

Proposal for a regulation
Article 46 – paragraph 2 – point b

(b) ~~assurance~~The risk level substantial shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a substantial degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of cybersecurity incidencorrespond to a higher risk related to an ICT product, process and service. A higher level of risk exists when an attack on the ICT product, process and service compromises the availability, authenticity, integrity, confidentiality or other important objectives such as the health of users or third parties, the environment, privacy, other important legal interests or critical infrastructures and its supporting systems or products;.

Amendment 499 #

Proposal for a regulation
Article 46 – paragraph 2 – point b a (new)

(ba) This assessment shall include the review of the technical documentation and the testing of the security functionalities implemented, in accordance with the requirements set out in the technical documentation;

Amendment 500 #

Proposal for a regulation
Article 46 – paragraph 2 – point c

Amendment 501 #

Proposal for a regulation
Article 46 – paragraph 2 – point c

(c) assurance level high shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a higher degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service than certificates with the assurance level substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent cybersecurity incidents. An assurance level high certificate shall certify that the known risks of cyber incidents are covered and that the product, service or system can withstand sophisticated attacks with significant resources. The evaluation method shall be based on effectiveness tests to evaluate the ability of security features to withstand a high-level attacker;

Amendment 502 #

Pavel TELIČKA, Morten LØKKEGAARD, Caroline NAGTEGAAL, Gesine MEISSNER

Proposal for a regulation
Article 46 – paragraph 2 – point c

Amendment 503 #

Proposal for a regulation
Article 46 – paragraph 2 – point c

(c) ~~assurance level high shall refer to a certificate issued in the context of a European cybersecurity certification scheme, w~~certification assurance hicgh provides a higher degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service than certificates with the assurance level substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent cybersecurity incidents.shall correspond to the assessment by a third party that high risks of cyber incidents for ICT processes, products or services are covered;

Amendment 504 #

Proposal for a regulation
Article 46 – paragraph 2 – point c

(c) assurance level high shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a higher degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service than certificates with the assurance level substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent cybersecurity incidents. The evaluation methodology should be guided at least by an efficiency testing which assesses the resistance of the security functionalities against attackers having significant to unlimited resources.

Amendment 505 #

Proposal for a regulation
Article 46 – paragraph 2 – point c

(c) assurance level high shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a higher degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service than certificates with the assurance level substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent cybersecurity incidents. The evaluation method must be based on effectiveness tests to assess the ability of the security features to withstand a high-level attacker.

Amendment 506 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 46 – paragraph 2 – point c

(c) ~~assurance~~The risk level high shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a higher degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service than certificates with the assurance level substantial, and is characcorrespond to a high risk related to an ICT product, process and service. A high level of risk exists when an attack on the ICT product, process and service compromises the availability, authenticity, integri~~sed with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent cyber~~ty, confidentiality or other important objectives and reasonably endangers the national sovereignty or public security ~~incident~~of states.

Amendment 507 #

Proposal for a regulation
Article 46 – paragraph 2 – point c

(c) assurance level high shall refer to a certificate issued in the context of a European cybersecurity certification scheme that is based on a national or multilateral standard in use, which provides a higher degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service than certificates with the assurance level substantial, and is characterised with reference to technical specifications, national and multilateral existing international standards and procedures related thereto, including technical controls, the purpose of which is to prevent cybersecurity incidents.

Amendment 508 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 46 – paragraph 2 – point c

(c) assurance "level highly secure" shall refer to a certificate issued in the context of a European cybersecurity certification scheme, which provides a higher degree of confidence in the claimed or asserted cybersecurity qualities of an ICT product or service than certificates with the assurance level substantially secure, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent cybersecurity incidents.

Amendment 509 #

Pavel TELIČKA, Morten LØKKEGAARD, Caroline NAGTEGAAL, Gesine MEISSNER

Proposal for a regulation
Article 46 – paragraph 2 – point c a (new)

(ca) This assessment shall include the review of the technical documentation, the testing of the security functionalities implemented, in accordance with the requirements set out in the technical documentation and the assessment of the resistance of the ICT processes, products or services to skilled attackers having significant to unlimited resources, through penetration testing.

Amendment 510 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 46 – paragraph 2 a (new)

2a. Where necessary, the Commission may adopt implementing acts, in accordance with Article 55(2), taking into account the opinion by ENISA, European Cybersecurity Certification Group, and Stakeholder Consultation Platforms, providing for detailed framework requirements for each assurance level.

Amendment 511 #

Marietje SCHAAKE, Matthijs van MILTENBURG, Gerben-Jan GERBRANDY, Jan Philipp ALBRECHT, Felix REDA, Urmas PAET, Kaja KALLAS, Pavel TELIČKA, Dita CHARANZOVÁ, Neena GILL

Proposal for a regulation
Article 46 – paragraph 2 a (new)

2a. The methodology to distinguish between the different assurance levels should be guided by a test which assesses the resistance of the security functionalities against attackers that have significant to unlimited resources.

Amendment 512 #

Proposal for a regulation
Article 46 a (new)

Article 46a According to the analysis of the specific risk, the appropriate conformity assessment method, including self- assessment, shall be identified as laid down in Article 4 and Annex II of Decision No 768/2008/EC.

Amendment 513 #

Nadine MORANO

Proposal for a regulation
Article 46 a (new)

Article 46a On the basis of a risk analysis, the appropriate conformity assessment method must be identified in accordance with Article 47 and in accordance with Article 4 and Annex II of Decision No 768/2008/EC.

Amendment 514 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Clare MOODY

Proposal for a regulation
Article 46 b (new)

Article 46b Without prejudice to paragraphs 1 and 2, ENISA may replace the requirements for the basic assurance level by introducing a functionality information scheme instead, as defined in Article 2. The criteria for such functionality information scheme shall be defined in advance with the participation of the Stakeholder Certification Group.

Amendment 515 #

Proposal for a regulation
Article 47 – paragraph 1 – point a

(a) subject-matter and scope of the certification, including the type or categories of ICT products, processes and services covered;

Amendment 516 #

Michał BONI, Massimiliano SALINI, Gunnar HÖKMARK

Proposal for a regulation
Article 47 – paragraph 1 – point a

(a) subject-matter and scope of the certification, including the type or categories of ICT products, processes and services covered;

Amendment 517 #

Proposal for a regulation
Article 47 – paragraph 1 – point a a (new)

(aa) the conformity assessment and auditing bodies;

Amendment 518 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Caroline NAGTEGAAL, Gesine MEISSNER, Morten PETERSEN

Proposal for a regulation
Article 47 – paragraph 1 – point b

(b) detailed specification of the cybersecurity requirements against which the specific ICT products and services are evaluated, for example by reference to Union or international standards or technical specifications; certification requirements should be defined in such a way that certification can be built into or based on the producer's systematic security processes followed during the development and lifecycle of the product or service in question;

Amendment 519 #

Proposal for a regulation
Article 47 – paragraph 1 – point b

(b) detailed specification of the cybersecurity requirements against which the specific ICT products and services are evaluated, for example by reference to Union and / or international standards or technical specifications. Already existing international standards should be taken into account;

Amendment 520 #

Proposal for a regulation
Article 47 – paragraph 1 – point b

(b) detailed specification of the cybersecurity requirements against which the specific ICT products and services are evaluated~~, for example~~ by reference to ~~Union or international~~ standards or technical specifications in accordance with point (1) of Article 2 of Regulation (EU) No 1025/2012;

Amendment 521 #

Proposal for a regulation
Article 47 – paragraph 1 – point b

(b) detailed specification of the cybersecurity requirements against which the specific ICT products, processes and services are evaluated, for example by reference to Union or international standards or technical specifications;

Amendment 522 #

Proposal for a regulation
Article 47 – paragraph 1 – point b

(b) detailed specification of the cybersecurity requirements against which the specific ICT products and services are evaluated, for example by reference to ~~Unio~~European or international standards or technical specifications;

Amendment 523 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Caroline NAGTEGAAL, Gesine MEISSNER, Morten PETERSEN

Proposal for a regulation
Article 47 – paragraph 1 – point b – point i (new)

(i) (c) where appropriate promoting "security by design"

Amendment 524 #

Dan NICA, Miroslav POCHE

Proposal for a regulation
Article 47 – paragraph 1 – point c

(c) ~~where app~~one or more assurance levels of licab~~le, one or more assurance level~~ility of the conformity assessment body in case of a breach of a certified ICT products or services;

Amendment 525 #

Proposal for a regulation
Article 47 – paragraph 1 – point c

Amendment 526 #

Proposal for a regulation
Article 47 – paragraph 1 – point d

(d) specific evaluation criteria and methods used, including types of evaluation, in order to demonstrate that the specific objectives referred to in Article 45 are achieved by reference to standards or technical specifications in accordance with point (1) of Article 2 of Regulation (EU) No 1025/2012;

Amendment 527 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 47 – paragraph 1 – point d

(d) Types of conformity assessment, specific evaluation criteria and methods used, ~~including types of evaluation~~as laid down in Article 4 and Annex II of Decision 768/2008/EC, in order to demonstrate that the specific objectives referred to in Article 45 are achieved;

Amendment 528 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 47 – paragraph 1 – point f

(f) where the scheme provides for ~~marks or labels, the conditions under which such marks or label~~technical feature information schemes, the conditions under which such technical feature information schemes may be used;

Amendment 529 #

Proposal for a regulation
Article 47 – paragraph 1 – point g

(g) ~~where surveillance is part of the scheme,~~ the rules for monitoring compliance with the requirements of the certificates, including mechanisms to demonstrate the continued compliance with the specified cybersecurity requirements;

Amendment 530 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 47 – paragraph 1 – point g a (new)

(ga) conditions for granting, maintaining, continuing, extending and reducing the scope of certification;

Amendment 531 #

Proposal for a regulation
Article 47 – paragraph 1 – point h

(h) conditions for granting, maintaining, continuing, renewing, extending and reducing the scope of certification;

Amendment 532 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 47 – paragraph 1 – point h a (new)

(ha) Rules aiming at treating vulnerabilities that may arise after the certification is issued, through the setting up of a dynamic and continuous organizational process, involving both providers and users;

Amendment 533 #

Proposal for a regulation
Article 47 – paragraph 1 – point i a (new)

(ia) rules requiring how and when vulnerabilities in ICT products, processes, services and systems that are not publicly known to be reported by the appropriate authorities to relevant vendors and manufacturers using a coordinated vulnerability disclosure process.

Amendment 534 #

Proposal for a regulation
Article 47 – paragraph 1 – point j

(j) rules ~~concerning how previously undetected cybersecurity vulnerabilities in ICT products and services are to be reported and dealt with;~~ requiring vulnerabilities in ICT products and services that are not publicly known to be reported expeditiously by the appropriate authorities to relevant vendors and manufacturers using a coordinated vulnerability disclosure process.

Amendment 535 #

Michał BONI, Massimiliano SALINI, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Article 47 – paragraph 1 – point l

(l) where applicable, identification of national cybersecurity certification schemes, pursuant to Article 49, or industry-led initiatives covering the same type or categories of ICT products, processes and services;

Amendment 536 #

Proposal for a regulation
Article 47 – paragraph 1 – point l

(l) identification of national or international cybersecurity certification schemes covering the same type or categories of ICT products and services, security requirements and evaluation criteria and methods;

Amendment 537 #

Proposal for a regulation
Article 47 – paragraph 1 – point l

(l) identification of national or international cybersecurity certification schemes or industry-led initiatives covering the same type or categories of ICT products, processes and services;

Amendment 538 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 47 – paragraph 1 – point l a (new)

(la) (ma) where applicable, the validity period of the certificate.

Amendment 539 #

Proposal for a regulation
Article 47 – paragraph 1 – point m a (new)

(ma) rules concerning how and when Member states must inform each other and affected vendors and manufacturers when they acquire knowledge of a vulnerability that is not publicly known in an ICT product or service that is certified under this certification scheme.

Amendment 540 #

Proposal for a regulation
Article 47 – paragraph 1 – point m a (new)

(ma) rules concerning how and when Member States must inform each other when they acquire knowledge of a vulnerability that is not publicly known in an ICT product or service that is certified under this certification scheme.

Amendment 541 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 47 – paragraph 1 – point m a (new)

(ma) types of conformity assessment, evaluation criteria and methods pursuant to Article 4 and Annex II of Decision 768/2008/EC.

Amendment 542 #

Clare MOODY, Theresa GRIFFIN, Peter KOUROUMBASHEV, Arne LIETZ

Proposal for a regulation
Article 47 – paragraph 1 – point m a (new)

(ma) Further guidance on best practice in cyber safety and information on the cyber threat that remains despite certification.

Amendment 543 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Clare MOODY

Proposal for a regulation
Article 47 – paragraph 1 a (new)

1a. For their relevant schemes, the Stakeholder Certification Group or the European Cybersecurity Certification Group must approve, following a duly motivated request from ENISA, any proposed addition to, deviation from, or non-reliance on, international or Union standards referred to in paragraph 1(b), at least two weeks prior to the candidate scheme’s transmission to the Commission pursuant to Article 44(3)

Amendment 544 #

Proposal for a regulation
Article 47 – paragraph 3

3. ~~Where a~~A specific Union act ~~so provides,~~may suggest when certification under a European cybersecurity certification scheme may be used ~~to demonstrate the presumption of conformity with requirements of that act.~~

Amendment 545 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Gesine MEISSNER

Proposal for a regulation
Article 47 – paragraph 4

4. In the absence of harmonised Union legislation, Member State law may also ~~provid~~encourage that a European cybersecurity certification scheme may be used ~~for establishing the presumption of conformity with legal requirements~~.

Amendment 546 #

Proposal for a regulation
Article 47 – paragraph 4 a (new)

4a. Certification schemes may be in particular created for those product groups mentioned in Annex I of this regulation.

Amendment 547 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 47 a (new)

Article 47a Schemes created pursuant to this Regulation shall not require notification of changes, amendments of certifications, or re-certification, unless such changes have a substantial adverse effect on the security of ICT products, services and processes as well as consumer electronic devices.

Amendment 548 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 48 – paragraph 1

Amendment 549 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 48 – paragraph 1

1. ICT products, processes and services that have been certified under a European cybersecurity certification scheme adopted pursuant to Article 44 shall be presumed to be compliant with the requirements of such scheme.

Amendment 550 #

Proposal for a regulation
Article 48 – paragraph 2

2. The certification shall be ~~voluntary~~mandatory at least for: (a) ICT products, processes, services and systems employed by operators of essential services as defined in the Directive 2016/1148/EU; (b) ICT products, processes, services and systems intended for children and homes; (c) ICT products, processes, services and systems intended for medical application; (d) ICT products, processes, services used for security purposes; (e) self-driving vehicles The Commission may by way of implementing acts and in cooperation with ENISA, review the categories of products provided in paragraph 1. The certification shall be voluntary for all other products, unless otherwise specified in Union law.

Amendment 551 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Clare MOODY

Proposal for a regulation
Article 48 – paragraph 2

2. The certification shall be voluntary~~, unless otherwise specified in Union law~~ for ICT products, services and processes that fall under the scope of Article 45 (1) (a) and Article 45 (1) (b), unless otherwise specified in Union law, and mandatory for the ICT products, services and processes that fall under the scope of Article 45 (1) (c), unless otherwise specified in Union law or by the European Cybersecurity Certification Group.

Amendment 552 #

Marisa MATIAS, Xabier BENITO ZILUAGA, Sofia SAKORAFA

Proposal for a regulation
Article 48 – paragraph 2

2. The certification ~~shall be voluntary~~for the assurance level medium and high shall be mandatory. For the assurance levels basic and substantial it shall be voluntary, but the manufacturer must be obliged to comply with the minimum security standards, unless otherwise specified in Union law.

Amendment 553 #

Proposal for a regulation
Article 48 – paragraph 2

2. The certification shall be ~~voluntary, unless otherwise specified in Union law.~~strictly voluntary and shall be without prejudice to the voluntary self-assessment/self- declaration of conformity

Amendment 554 #

Rolandas PAKSAS

Proposal for a regulation
Article 48 – paragraph 2

2. The certification shall be ~~voluntary, unless otherwise specified in Union law~~mandatory.

Amendment 555 #

Proposal for a regulation
Article 48 – paragraph 2

2. The certification shall be voluntary, unless otherwise specified in Unational law.

Amendment 556 #

Proposal for a regulation
Article 48 – paragraph 2 a (new)

2a. For the assurance level basic, it shall be possible to perform a conformity self-assessment under the sole responsibility of the manufacturer or provider of ICT products, processes and services as laid down in Article 4 and Annex II of Decision No 768/2008/EC.

Amendment 557 #

Proposal for a regulation
Article 48 – paragraph 3

3. A European cybersecurity certificate assurance level basic or substantial pursuant to this Article shall be issued by the conformity assessment bodies referred to in Article 51 on the basis of criteria included in the European cybersecurity certification scheme, adopted pursuant to Article 44.

Amendment 558 #

Proposal for a regulation
Article 48 – paragraph 3

3. A European cybersecurity certificate pursuant to this Article shall be issued either by self-assessment or by the conformity assessment bodies referred to in Article 51 on the basis of criteria included in the European cybersecurity certification scheme, adopted pursuant to Article 44.

Amendment 559 #

Proposal for a regulation
Article 48 – paragraph 3 a (new)

3a. A European cybersecurity certificate assurance level high shall be issued by the national certification supervisory bodies referred to in Article 50 on the basis of the criteria included in the European cybersecurity certification scheme, adopted pursuant to Article 44.

Amendment 560 #

Proposal for a regulation
Article 48 – paragraph 4 – introductory part

4. By the way of derogation from paragraph 3, and only in duly justified cases, a particular European cybersecurity scheme may provide that a European cybersecurity certificate resulting from that scheme can only be issued by a public body. Such public body shall be ~~one of the following:~~a body that is accredited as conformity assessment body pursuant to Article 51(1). The natural or legal person which submits its ICT products or services to the certification mechanism shall make available to the conformity assessment body referred to in Article 51 with all information necessary to conduct the certification procedure.

Amendment 561 #

Proposal for a regulation
Article 48 – paragraph 4 – introductory part

4. By the way of derogation from paragraph 3, in duly justified cases, such as the assurance level high described in Article 46(c), a particular European cybersecurity scheme mayust provide that a European cybersecurity certificate resulting from that scheme can only be issued by a competent public body following an assessment conducted by an independent, notified conformity assessment body. Such public body shall be one of the following:

Amendment 562 #

Proposal for a regulation
Article 48 – paragraph 4 – introductory part

Amendment 563 #

Proposal for a regulation
Article 48 – paragraph 4 – point a

~~(a) a national certification supervisory authority referred to in Article 50(1);~~deleted

Amendment 564 #

Proposal for a regulation
Article 48 – paragraph 4 – point a

~~(a) a national certification supervisory authority referred to in Article 50(1);~~deleted

Amendment 565 #

Proposal for a regulation
Article 48 – paragraph 4 – point b

~~(b) a body that is accredited as conformity assessment body pursuant to Article 51(1) or~~deleted

Amendment 566 #

Proposal for a regulation
Article 48 – paragraph 4 – point c

(c) a body established under laws, statutory instruments, or other official administrative procedures of a Member State concerned and meeting the requirements for bodies certifying products, processes and services further to ISO/IEC 17065:2012.deleted

Amendment 567 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Martina WERNER, Eva KAILI, Clare MOODY

Proposal for a regulation
Article 48 – paragraph 5

5. The natural or legal person which submits its ICT products or, services or processes to the certification mechanism shall provide the conformity assessment body referred to in Article 51 with all information necessary to conduct the certification procedure. The submission can be made with any conformity assessment body referred to in Article 51.

Amendment 568 #

Michał BONI, Seán KELLY, Massimiliano SALINI, Krišjānis KARIŅŠ, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Article 48 – paragraph 5

5. The natural or legal person which submits its ICT products, processes or services to the certification mechanism shall provide the conformity assessment body referred to in Article 51 with all information necessary to conduct the certification procedure.

Amendment 569 #

Proposal for a regulation
Article 48 – paragraph 5

Amendment 570 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Martina WERNER, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 48 – paragraph 6

6. Certificates shall be issued for a maxinimum period of three years ~~and may~~. They may then be renewed, under the same conditions, provided ~~that the relevant requirements continue to be met.~~ extended without cost for further periods, upon attestation by the certificate-holder that the relevant requirements continue to be met. Such attestation must be provided no sooner than six months and no later than 15 days before the expiry of the relevant period. Extensions of the certificates shall be allowed for the duration of the entire lifespan of the certified product.

Amendment 571 #

Proposal for a regulation
Article 48 – paragraph 6

6. Certificates shall be issued for ~~a maximum period of three years~~the period defined in each certification scheme and highly relate to processes and the ability of how entities organise themselves to react to an attack and may be renewed, under the same conditions, provided that the relevant requirements continue to be met.

Amendment 572 #

Michał BONI, Massimiliano SALINI, Gunnar HÖKMARK

Proposal for a regulation
Article 48 – paragraph 6

6. Certificates shall be issued for a maximum period of three years the period defined by the particular certification scheme and may be renewed, under the same conditions, provided that the relevant requirements continue to be met.

Amendment 573 #

Proposal for a regulation
Article 48 – paragraph 6

6. Certificates shall be issued for a maximum period ~~of three years~~determined on a case by case basis for each scheme and may be renewed, under the same conditions, provided that the relevant requirements continue to be met.

Amendment 574 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 48 – paragraph 7

7. A European cybersecurity certificate issued pursuant to this Article shall be recognised in all Member States. as satisfying local cybersecurity requirements relating to ICT products and processes and consumer electronic devices covered by that certificate, taking into account the specified assurance level referred to in Article 46, and there shall be no discrimination between such certificates based either on the Member State of origin or the issuing conformity assessment body referred to in Article 51.

Amendment 575 #

Proposal for a regulation
Article 48 – paragraph 7

7. A European cybersecurity certificate issued pursuant to this Article shall be recognised in all Member States. For the assurance level high, certificates may only be mutually recognised if they are issued by a public body as described in paragraph 4 (a) of Article 48.

Amendment 576 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 48 – paragraph 7 a (new)

7a. An application for certification must be completed by 12 months from its date of submission, failing to which the conformity assessment body will lose its accreditation.

Amendment 577 #

Michał BONI, Massimiliano SALINI, Krišjānis KARIŅŠ, Gunnar HÖKMARK

Proposal for a regulation
Article 48 a (new)

Article 48a Baseline IT security requirements 1. The agency shall, by ... [two years after the date of entry into force of this regulation], propose to the Commission clear and mandatory baseline IT security requirements for all IT devices sold in or exported from the Union such as: (a) the manufacturer providing a written certification that the device does not contain any hardware, software or firmware component with any known security vulnerabilities; (b) the device relies on software or firmware components capable of accepting properly authenticated and trusted updates from the vendor; (c) documented remote access capabilities of the device that are secured against unauthorized access during the installation at the latest; no default hardcoded standard passwords for all devices, a documented possibility for updates which clearly points out responsibilities in case the user does not update the device; (d) an obligation of the manufacturer of the internet-connected device, software, or firmware component to notify the competent authority of any known security vulnerabilities; (e) an obligation of the manufacturer of the internet-connected device, software, or firmware component to provide a repair in respect to any new security vulnerability discovered; (f) an obligation of the manufacturer of the internet-connected device, software, or firmware component to provide information on how the device receives updates, the anticipated timeline for ending security support and a notification when such security support has ended. (g) an obligation of the manufacturer to release the source code and documentation after the end of support date; 2. The Agency shall review and, where necessary, amend the requirements referred to in paragraph 1 every two years, and submit any amendments as proposals to the Commission. 3. The Commission may, by way of implementing acts, decide that the proposed or amended requirements referred to in paragraphs 1 and 2 have general validity within the Union. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 55(2). 4. The Commission shall ensure appropriate publicity for the requirements which have been decided as having general validity in accordance with paragraph 3. 5. The Agency shall collate all proposed requirements and their amendments in a register and shall make them publicly available by way of appropriate means. 6. While manufacturers are responsible for ensuring product compliance of an ICT product or service, importers must make sure that the products they place on the market comply with the applicable requirements and do not present a risk to the European public. The importer has to verify that the manufacturer outside the EU has taken the necessary steps and that the product or service complies with the provisions of paragraph 1. Distributors of ICT products or services must have a basic knowledge of the legal requirements and the accompanying documentation. Distributors shall be able to identify products that are clearly not in compliance and they must be able to demonstrate to national authorities that they have acted with due care and have affirmation from the manufacturer or the importer that the necessary measures have been taken. Furthermore, a distributor must be able to assist national authorities in their efforts to receive the required documentation. 7. In the cases determined in the scheme, based on the nature, lifecycle or cost of the product, as an alternative to the full certification process, compliance with the mandatory baseline IT security requirements could be ensured through self-declaration of conformity following the applicable procedure for conformity assessment.

Amendment 578 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 48 a (new)

Article 48a Compatibility with international mutual recognition schemes 1. In the preparatory phase of a candidate European cybersecurity certification scheme, ENISA and, as appropriate, the Stakeholder Certification Group or the European Cybersecurity Certification Group, shall evaluate the relevance of existing international mutual recognition agreements and certifications. 2. This shall include an evaluation of whether any national cybersecurity certification schemes covered by the candidate scheme are subject to an international mutual recognition agreement. 3. Where relevant international mutual recognition agreements and certifications are determined to exist, ENISA shall aim to ensure compatibility by: (a) predicating the certification on the same standards; (b) aligning the scope, security objectives, evaluation methodology and assurance levels; (c) opening a dialogue with the equivalent governance body for objective of points (a) and (b).

Amendment 579 #

Proposal for a regulation
Article 49 – paragraph 1

1. Without prejudice to paragraph 3, national cybersecurity certification schemes and the related procedures for the ICT products, processes and services covered by a European cybersecurity certification scheme shall cease to produce effects from the date established in the implementing act adopted pursuant Article 44(4). Existing national cybersecurity certification schemes and the related procedures for the ICT products, processes and services not covered by a European cybersecurity certification scheme shall continue to exist. Maintenance processes with minor updates shall not invalidate the certification.

Amendment 580 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Clare MOODY

Proposal for a regulation
Article 49 – paragraph 1

Amendment 581 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 49 – paragraph 1

1. Without prejudice to paragraph 3, national cybersecurity certification schemes and the related procedures for the ICT products ~~and servic~~, services and processes covered by a European cybersecurity certification scheme shall cease to produce effects from the date established in the ~~implementing~~delegated act adopted pursuant Article 44(4). Existing national cybersecurity certification schemes and the related procedures for the ICT products and services not covered by a European cybersecurity certification scheme shall continue to exist.

Amendment 582 #

Proposal for a regulation
Article 49 – paragraph 1 a (new)

1a. Without prejudice to paragraph 3, references in applicable laws, rules, regulations or guidance to a national cybersecurity certification scheme that has ceased to produce legal effects pursuant to paragraph 1, shall be deemed to refer instead to the covering European cybersecurity certification scheme (mutatis mutandis).

Amendment 583 #

Proposal for a regulation
Article 49 – paragraph 2

2. Member States shall not introduce new national cybersecurity certification schemes for ICT products, processes and services covered by a European cybersecurity certification scheme in force.

Amendment 584 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 49 a (new)

Article 49a Upon request by any natural or legal person ENISA shall determine whether, for the purposes of this Article, a specified national cybersecurity scheme is covered by a European cybersecurity scheme, ENISA shall reach its decision and render it public within four weeks of its receipt of the request.

Amendment 585 #

Proposal for a regulation
Article 50 – paragraph 3

3. Each national certification supervisory authority shall, in its organisation, funding decisions, legal structure and decision-making, be independent of the entities they supervise. The national certification supervisory authority may not be a certificate body or certificate issuer.

Amendment 586 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 50 – paragraph 3

3. Each national certification supervisory authority shall, in its organisation, funding decisions, legal structure and decision-making, be independent of the entities they supervise. The national certification supervisory authority may not be a certificate body or certificate issuer.

Amendment 587 #

Proposal for a regulation
Article 50 – paragraph 6 – point –a (new)

(-a) organise market checks on certified and non-certified products, in a coordinated manner across Member States in order to avoid check duplication and to maximise the market check, for at least 30% of products certified in the previous year and oblige the certificate holder to recall non-compliant products from the market in accordance with paragraph 6(e). When identifying the 30% of products that will be subject to a compliance check, national certification authorities shall prioritise high risk products for consumers, especially children, products embedded with new technologies and/or products with high selling rates;

Amendment 588 #

Proposal for a regulation
Article 50 – paragraph 6 – point a

(a) monitor and enforce the application of the provisions under this Title at national level and supervise compliance ~~of the certificates that have been issued by conformity assessment bodies established in their respective territories with the requirements set out in this Title and in the corresponding~~in accordance with the rules adopted by the European cCybersecurity cCertification ~~scheme~~Group pursuant to point (da) of Article 53(3);

Amendment 589 #

Proposal for a regulation
Article 50 – paragraph 6 – point a

(a) monitor and enforce the application of the provisions under this Title at national level and ~~supervise~~verify compliance of the certificates that have been issued by conformity assessment bodies established in their respective territories with the requirements set out in this Title and in the corresponding European cybersecurity certification scheme;

Amendment 590 #

Proposal for a regulation
Article 50 – paragraph 6 – point b

(b) monitor and supervise the activities of conformity assessment bodies for the purpose of this Regulation, including in relation to the notification of conformity assessment bodies and the related tasks set out in Article 52 of this Regulation;deleted

Amendment 591 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 50 – paragraph 6 – point b

(b) monitor and supervise and, at least every two years, assess the activities of conformity assessment bodies for the purpose of this Regulation, including in relation to the notification of conformity assessment bodies and the related tasks set out in Article 52 of this Regulation;

Amendment 592 #

Proposal for a regulation
Article 50 – paragraph 6 – point b

(b) monitor ~~and~~, supervise and, at least every year, the activities of conformity assessment bodies for the purpose of this Regulation, including in relation to the notification of conformity assessment bodies and the related tasks set out in Article 52 of this Regulation;

Amendment 593 #

Proposal for a regulation
Article 50 – paragraph 6 – point c

(c) handle complaints lodged by natural or legal persons in relation to certificates issued by conformity assessment bodies established in their territories or to self-assessment of conformity made, investigate, to the extent appropriate, the subject matter of the complaint, and inform the complainant of the progress and the outcome of the investigation within a reasonable time period;

Amendment 594 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 50 – paragraph 6 – point c a (new)

(ca) report the results of verifications under point (a) and the assessments under point (b) to ENISA and the European Cybersecurity Certification Group;

Amendment 595 #

Proposal for a regulation
Article 50 – paragraph 6 – point c a (new)

(ca) report the results of verifications under point (a) and assessment under point (b) to ENISA and the European Cybersecurity Certification group;

Amendment 596 #

Proposal for a regulation
Article 50 – paragraph 6 – point d

(d) cooperate with other national certification supervisory authorities or other public authorities, including by sharing information on possible non- compliance of ICT products, processes and services with the requirements of this Regulation or specific European cybersecurity certification schemes;

Amendment 597 #

Proposal for a regulation
Article 50 – paragraph 7 – point b

(b) to carry out investigations, in the form of audits, of ~~conformity assessment bodies and~~ European cybersecurity certificates' holders, for the purpose of verifying compliance with the provisions under Title III;

Amendment 598 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 50 – paragraph 7 – point c

(c) to take appropriate measures, in accordance with national law, in order to ensure that ~~conformity assessment bodies or~~ certificate holders comply with this Regulation or with a European cybersecurity certification scheme;

Amendment 599 #

Proposal for a regulation
Article 50 – paragraph 7 – point e

(e) to withdraw, in accordance with national law, certificates and ICT consumers products, that are not compliant with this Regulation or a European cybersecurity certification scheme;

Amendment 600 #

Proposal for a regulation
Article 50 – paragraph 8

Amendment 601 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 50 – paragraph 8

Amendment 602 #

Proposal for a regulation
Article 50 – paragraph 8 – point a (new)

(a) Each national certification supervisory authority, and each member and staff of each national certification supervisory authority, shall in accordance with Union or Member State law be subject to a duty of professional secrecy both during and after their term of office, with regard to any confidential information which has come to their knowledge in the course of the performance of their tasks or exercise of their powers.

Amendment 603 #

Proposal for a regulation
Article 50 a (new)

Article 50a Peer review 1. National certification supervisory authorities shall be subject to peer review in respect of any activity which they carry out pursuant to Article 50 of this Regulation. 2. Peer review shall cover the assessments of the procedures put in place by national certification supervisory authorities, in particular the procedures for checking the compliance of the products that are subject to cybersecurity certification, the competence of the personnel, the correctness of the checks and the inspection methodology as well as the correctness of the results. Peer review shall also assess whether the national certification supervisory authorities in question have sufficient recourses for the proper performance of their duties as required by paragraph 4 of Article 50. 3. Peer review of a national certification supervisory authority shall be carried out by two national certification supervisory authorities of other Member States and the Commission and shall be carried out at least once every five years. ENISA may participate in the peer review and shall decide on its participation on the basis of a risk assessment analysis. 4. The Commission is empowered, in accordance with Article 55a, to adopt delegated acts, in order to establish a plan for the peer review covering a period of at least five years, laying down criteria concerning the composition of the peer review team, the methodology used for the peer review, the schedule, periodicity and the other tasks related to the peer review. When adopting those delegated acts, the Commission shall take due account of the considerations of the Group. 5. The outcome of the peer review shall be examined by the Group. ENISA shall draw up a summary of the outcome and make it public.

Amendment 604 #

Proposal for a regulation
Article 51 – paragraph 1 a (new)

1a. For the assurance level high, the conformity assessment body must, in addition to its accreditation, be notified by the national certification supervisory authority with regard to its competence and expertise in the assessment of cybersecurity. The national certification supervisory authority shall carry out regular audits of the expertise and competences of the notified conformity assessment bodies.

Amendment 605 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 51 – paragraph 1 a (new)

1a. For the assurance level high, the conformity assessment bodies shall be authorised by the national certification supervisory authorities only where they meet the stated competence and expertise requirements demonstrated in regular audits of the said bodies.

Amendment 606 #

Proposal for a regulation
Article 51 – paragraph 2

2. Accreditation shall be issued for a maximum of five years and may be renewed on the same conditions provided that the conformity assessment body meets the requirements set out in this Article. Accreditation bodies shall revoke an accreditation of a conformity assessment body pursuant to paragraph 1 of this Article where the conditions for the accreditation are not, or are no longer, met or where actions taken by a conformity assessment body infringe this Regulation. Conformity assessment bodies shall not accept direct payments for their services from the certificate holders.

Amendment 607 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 51 – paragraph 2

2. Accreditation shall be issued for a maximum of ~~five~~ten years and may be renewed on the same conditions provided that the conformity assessment body meets the requirements set out in this Article. Accreditation bodies shall revoke an accreditation of a conformity assessment body pursuant to paragraph 1 of this Article where the conditions for the accreditation are not, or are no longer, met or where actions taken by a conformity assessment body infringe this Regulation.

Amendment 608 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, José BLANCO LÓPEZ, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 52 – paragraph 5

5. The Commission may, by means of ~~implementing~~delegated acts, define the circumstances, formats and procedures of notifications referred to in paragraph 1 of this Article. Those ~~implementing~~delegated acts shall be adopted in accordance with the examination procedure referred to in Article 55(2).

Amendment 609 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miroslav POCHE, Miapetra KUMPULA-NATRI, Eva KAILI, Clare MOODY

Proposal for a regulation
Article 53 – paragraph 2

2. The Group shall be composed of national certification supervisory authorities. The authorities shall be represented by the heads or by other high level representatives of national certification supervisory authorities. Upon invitation, members of the Stakeholder Certification Group shall be entitled to be present at the meetings of the European Cybersecurity Certification Group and to participate in its work.

Amendment 610 #

Proposal for a regulation
Article 53 – paragraph 2

2. The Group shall be composed of national ~~certification supervisory authorities. The authorities shall be represented by the heads or by other high level representatives of national certification supervisory authoritie~~experts.

Amendment 611 #

Proposal for a regulation
Article 53 – paragraph 3 – point d a (new)

(da) to adopt binding rules determining the intervals at which national certification supervisory authorities are to carry out verifications of certificates and self-assessment of conformity, and the criteria, scale and scope of those verifications and to adopt common rules and standards for reporting, in accordance with Article50(6).

Amendment 612 #

Proposal for a regulation
Article 53 – paragraph 3 – point f – point i (new)

(i) (g) to facilitate alignment of European cybersecurity schemes with internationally recognised standards, including by: reviewing existing European cybersecurity schemes and, where appropriate, making recommendations to ENISA to engage with relevant international standardisation organisations to address insufficiencies or gaps in available internationally recognised standards.

Amendment 613 #

(fa) determine a peer review mechanism to assess compliance with the requirements set out in this Regulation by each national certification supervisory authority, in particular the ability to perform for each level of assurance the tasks described in this Regulation with the required technical expertise. If necessary, the peer review may determine the appropriate measures to be adopted.

Amendment 614 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Gesine MEISSNER

Proposal for a regulation
Article 53 – paragraph 3 – point f a (new)

(fa) In collaboration with European Cybersecurity Certification Group (the 'Group') established under Article 53 of this Regulation, provide advice and support to the Commission in matters regarding cyber security certification and agreements for mutual recognition of cyber security certificates with foreign markets and third countries.

Amendment 615 #

Proposal for a regulation
Article 53 – paragraph 3 a (new)

3a. (g) to establish a peer review process. This process shall have regard in particular to the required technical expertise of NCSAS in the fulfilment of their tasks, as described in article 48 and 50, and include when necessary the development of guidance and best practice documents to improve compliance of the NCSAs with this Regulation.

Amendment 616 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Eva KAILI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 53 – paragraph 3 a (new)

3a. to take into account the results of stakeholder consultation conducted in preparation of a candidate scheme, in accordance of Article 44 of this Regulation;

Amendment 617 #

Pavel TELIČKA, Carolina PUNSET, Gesine MEISSNER

Proposal for a regulation
Article 53 – paragraph 3 b (new)

3b. (h) to supervise the surveillance and maintenance of a certificate.

Amendment 618 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 54 – paragraph 1

Member States shall lay down the rules on penalties applicable to infringements of ~~this~~Title IIa, Title III and European cybersecurity certification schemes, and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive. Member States shall [by …/without delay] notify the Commission of those rules and of those measures and shall notify it of any subsequent amendment affecting them.

Amendment 619 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 54 – paragraph 1 – point a (new)

(a) Right to an effective judicial remedy against a supervisory authority or conformity assessment body 1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy: (a) against a decision of a conformity assessment body or national certification supervisory authority concerning them, including (where applicable) in relation to the (non-) issuing or recognition of a European cybersecurity certificate which such person holds; and (b) where a national certification supervisory authority does not handle a complaint for which it is competent. 2. Proceedings against a conformity assessment body or national certification supervisory authority shall be brought before the courts of the Member State where the conformity assessment body or national certification supervisory authority is established.

Amendment 620 #

Proposal for a regulation
Article 54 a (new)

Article 54a Right to an effective judicial redress against a supervisory authority 1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial redress: (a) against a decision of a conformity assessment body or national certification supervisory authority concerning them, including in relation to the recognition of a European cybersecurity certificate which such person or entity holds; and (b) where a national certification supervisory authority does not handle a complaint for which it is competent. 2. Proceedings against a conformity assessment body or national certification supervisory authority shall be brought before the courts of the Member State where the conformity assessment body or national certification supervisory authority is established.

Amendment 621 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 56 – paragraph 1

1. Not later than f~~ive~~our years after the date referred to in Article 58, and every f~~ive~~our years thereafter, the Commission shall assess the impact, effectiveness and efficiency of the Agency and its working practices and the possible need to modify the mandate of the Agency and the financial implications of any such modification. The evaluation shall take into account any feedback made to the Agency in response to its activities. Where the Commission considers that the continuation of the Agency is no longer justified with regard to its assigned objectives, mandate and tasks, it may propose that this Regulation be amended with regard to the provisions related to the Agency.

Amendment 622 #

Peter KOUROUMBASHEV, Zigmantas BALČYTIS, Edouard MARTIN, Carlos ZORRINHO, José BLANCO LÓPEZ, Theresa GRIFFIN, Miapetra KUMPULA-NATRI, Dan NICA, Clare MOODY

Proposal for a regulation
Article 56 – paragraph 2

2. The evaluation shall also assess the impact, effectiveness and efficiency of the provisions of Title III with regard to the objectives of ensuring an adequate level of cybersecurity of ICT products ~~and servic~~, services and processes in the Union and improving the functioning of the internal market. The Commission shall assess, five years after the adoption of the Regulation, a potential extension of the scope of Title III.

Amendment 623 #

Dario TAMBURRANO, Marco ZULLO, Fabio Massimo CASTALDO

Proposal for a regulation
Article 56 – paragraph 2

2. ~~The evaluat~~Not later than four years after the date referred to in article 58, and every four years thereafter, the Commission shall also assess the impact, effectiveness and efficiency of the provisions of Title IIa and III with regard to the objectives of ensuring an adequate level of cybersecurity of ICT products, processes and services in the Union and improving the functioning of the internal market.

Amendment 624 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Gesine MEISSNER

Proposal for a regulation
Article 56 – paragraph 2 a (new)

2a. The evaluation shall assess the gradual move to mandatory certification, provided that the market assessment and relative stakeholders’ consultation show findings that support such action;

Amendment 625 #

Proposal for a regulation
Title 4 a (new)

ANNEX 1 new Upon launching the EU cybersecurity certification framework it is likely that attention focuses on areas of imminent interest to rise to the challenge posed by emerging technologies. The area of the Internet of Things is of particular interest as it cuts across consumer as well as industry requirements. The following priority list for adoption into the certification framework is proposed: (1) Certification of cloud service provision. (2) Certification of IoT devices including: a. devices at individual level, such as smart wearables; b. devices at community level, such as smart cars, smart homes, health devices; c. devices at society level such as smart cities and smart grids. (3) Industry 4.0 involving intelligent, interconnected cyber-physical systems that automate all phases of industrial operations, spanning from design and manufacturing to operation, supply chain and service maintenance. (4) Certification of technologies and products exploited in every-day life. Such an example could be networking devices, such as home internet routers.

Amendment 626 #

Proposal for a regulation
Annex I – paragraph 1 – point 5 a (new)

5a. If a conformity assessment body is owned or operated by a public entity or institution, independence and absence of any conflict of interest shall be ensured and documented between, on the one hand, the certification supervisory authority and, on the other hand, the conformity assessment body.

Amendment 627 #

Proposal for a regulation
Annex I – paragraph 1 – point 8

8. A conformity assessment body shall be capable of carrying out all the conformity assessment tasks assigned to it under this Regulation, whether those tasks are carried out by the conformity assessment body itself or on its behalf and under its responsibility. Any subcontracting or consultation of external personnel shall be properly documented, shall not involve any intermediaries and shall be subject to a written agreement covering, among other things, confidentiality and conflicts of interest. The conformity assessment body in question shall take full responsibility for the tasks performed.

Amendment 628 #

Proposal for a regulation
Annex I – paragraph 1 – point 12

12. The impartiality of the conformity assessment bodies, of their top-level management and of the assessment personnel and subcontractors shall be guaranteed.

Amendment 629 #

Proposal for a regulation
Annex I – paragraph 1 – point 15

15. The ~~personnel~~conformity assessment body and its personnel, committees, subsidiaries, subcontractors, and any associated body or personnel of external bodies of a conformity assessment body shall maintain confidentiality and observe professional secrecy with regard to all information obtained in carrying out their tasks under this Regulation or pursuant to any provision of national law giving effect to it, except where disclosure is required by Union or Member Stat law to which such persons are subject except in relation to the competent authorities of the Member States in which its activities are carried out. Proprietary rights shall be protected. The conformity assessment body shall have documented procedures in place in respect of the requirements of this Section 15.

Amendment 630 #

Proposal for a regulation
Annex I – paragraph 1 – point 15 a (new)

15a. With the exception of Section 15, the requirements of this Annex in no way preclude exchanges of technical information and regulatory guidance between a conformity assessment body and a person applying, or considering whether to apply, for certification.

Amendment 631 #

Michał BONI, Henna VIRKKUNEN, Massimiliano SALINI, Krišjānis KARIŅŠ, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Annex I – paragraph 1 – point 15 b (new)

15b. Conformity assessment bodies shall operate in accordance with a set of consistent, fair and reasonable terms and conditions, taking into account the interests of small and medium-sized enterprises as defined in Recommendation 2003/361/EC in relation to fees.

Amendment 93 #

Proposal for a regulation
Recital 2

(2) The use of network and information systems by citizens, businesses and governments across the Union is now pervasive. Digitisation and connectivity are becoming core features in an ever growing number of products and services and with the advent of the Internet of Things (IoT) millions, if not billions, of connected digital devices are expected to be deployed across the EU during the next decade. While an increasing number of devices are connected to the Internet, security and resilience are not sufficiently built in by design, leading to insufficient cybersecurity. In this context, the limited use of certification leads to insufficient information for organisational and individual users about the cybersecurity features of ICT products, processes and services, undermining trust in digital solutions. This ambition is at the heart of the European Commission’s reform agenda to achieve a digital single market as ICT networks provide the backbone for digital products and services which have the potential to support all aspects of our lives and drive Europe’s economic growth. To ensure that the objectives of the digital single market are fully achieved the essential technology building blocks on which important areas such as eHealth, IoT, Artificial Intelligence, Quantum technology as well as intelligent transport system and advanced manufacturing rely must be in place.

Amendment 94 #

Pavel TELIČKA, Carolina PUNSET, Morten LØKKEGAARD, Gesine MEISSNER, Morten PETERSEN

Proposal for a regulation
Recital 3

(3) Increased digitisation and connectivity lead to increased cybersecurity risks, thus making society at large more vulnerable to cyber threats and exacerbating dangers faced by individuals, including vulnerable persons such as children. In order to mitigate this risk to society, all necessary actions need to be taken to improve cybersecurity in the EU to better protect network and information systems, telecommunication networks, digital products, services and devices used by citizens, governments and business – from SMEs to operators of critical infrastructures – from cyber threats. In this respect the Digital Education Action Plan published by the European Commission on 17 January 2018 is a step in the right direction, in particular the EU-wide awareness-raising campaign targeting educators, parents and learners to foster online safety, cyber hygiene and media literacy as well as the cyber-security teaching initiative building on the Digital Competence Framework for Citizens, to empower people to use technology confidently and responsibly.

Amendment 95 #

Michał BONI, Seán KELLY, Henna VIRKKUNEN, Massimiliano SALINI, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Recital 3

Amendment 96 #

Proposal for a regulation
Recital 3 a (new)

(3 a) Believes that the objectives and tasks of ENISA should be further aligned with the Joint Communication with regards to its reference to the promotion of cyber hygiene and awareness; notes that cyber resilience can be achieved by implementing basic cyber hygiene principles;

Amendment 97 #

Michał BONI, Seán KELLY, Henna VIRKKUNEN, Massimiliano SALINI, Marian-Jean MARINESCU, Gunnar HÖKMARK

Proposal for a regulation
Recital 5

(5) In light of the increased cybersecurity challenges faced by the Union, there is a need for a comprehensive set of measures that would build on previous Union action and foster mutually reinforcing objectives. These include the need to further increase capabilities and preparedness of Member States and businesses, as well as to improve cooperation and coordination across Member States and EU institutions, agencies and bodies. Furthermore, given the borderless nature of cyber threats, there is a need to increase capabilities at Union level that could complement the action of Member States, in particular in the case of large scale cross-border cyber incidents and crises. Additional efforts are also needed to increase awareness of citizens and businesses on cybersecurity issues. Moreover, ~~the trust in the digital single marke~~given that cyber incidents undermine trust in digital service providers and in the digital single market itself, especially among consumers, trust should be further improved by offering transparent information on the level of security of ICT products ~~and servic~~, services and processes. This can be facilitated by EU- wide certification providing common cybersecurity requirements and evaluation criteria across national markets and sectors. Alongside EU-wide certification and given the growing availability of IoT devices, there are a range of voluntary measures that the private sector should take to reinforce trust in the security of ICT products, services and processes, such as encryption and blockchain technologies.

Amendment 98 #

Proposal for a regulation
Recital 5

(5) In light of the increased cybersecurity challenges faced by the Union, there is a need for a comprehensive set of measures that would build on previous Union action and foster mutually reinforcing objectives. These include the need to further increase capabilities and preparedness of Member States and businesses, as well as to improve cooperation and coordination across Member States and EU institutions, agencies and bodies. Furthermore, given the borderless nature of cyber threats, there is a need to increase capabilities at Union level that could complement the action of Member States, in particular in the case of large scale cross-border cyber incidents and crises. Additional efforts are also needed to deliver a coordinated EU response and increase awareness of citizens and businesses on cybersecurity issues. Moreover, the trust in the digital single market should be further improved by offering transparent information on the level of security of ICT products and services. This can be facilitated by EU- wide certification providing common cybersecurity requirements and evaluation criteria across national markets and sectors. Alongside EU-wide certification, there is a range of voluntary measures widely accepted in the market place, depending on the product, service, use or standard; these measures as well as the industry bottom up approach, including the use of security-by-design, leveraging and contributing to international standards, should be encouraged.

Amendment 99 #