The European Commission, together with the High Representative of the Union for Foreign Affairs and Security Policy, has today published a CyberSecurity Strategy alongside a Commission proposed Directive on Network and Information Security (“NIS”).

While much of the Strategy and Directive is aimed at Member State governments (e.g., to improve capabilities and cooperation to prevent and respond to cyber-attacks), several proposals target private companies in the energy, transport, financial services and health sectors, as well as “enablers of key internet services” such as providers of cloud computing services, app stores, e-commerce platforms, internet payment gateways, search engines and social networks. 

These companies would be required, under the Directive, to implement security measures to “guarantee a level of security appropriate to the risk presented . . . having regard to the state of the art”.  

Further, they would have to notify competent national authorities of any security incident that has a significant impact on the continuity of core services they provide — effectively extending current EU incident reporting requirements, which only apply to communication network and service providers, to a broad universe of private sector companies.  To be clear, this incident reporting obligation is separate from and additional to the proposal for all companies to report breaches of personal data to national supervisory authorities under the Commission 2012 proposal for a General Data Protection Regulation.

The Commission also intends to launch “a platform on NIS solutions” to develop “incentives for the adoption of secure ICT solutions” — considering technical norms, standards and possibly EU-wide certification schemes — to be applied to ICT products used in Europe, and to make recommendations to ensure cybersecurity across the ICT value chain.  The Commission also will examine how major providers of ICT hardware and software could inform national competent authorities on detected vulnerabilities that could have significant security-implications.

The EU institutions will now start to review the Strategy and proposed Directive.  The process to adopt the Directive could take two years, at which point Member States will be required to implement the legislation into national laws, which could take another 18 months or more.

The Strategy comprises two documents:

  • A Joint Strategy Communication by Vice-President Kroes, Commissioner Malmström and High Representative Ashton, which aims to:

–        Achieve “cyber resilience” in the public and private sectors and at national and EU level;

–        Drastically reduce cybercrime in the EU;

–        Develop an EU cyber defence policy related to the Common Security and Defence Policy;

–        Develop European industrial and technological resources for cybersecurity; and

–        Enhance the EU’s international cyberspace policy to promote the respect of EU core values.

  • A proposed Directive on Network and Information Security, which aims to:

–        Increase cyber preparedness and capabilities at national level.  Member States will be required to designate a competent authority responsible for NIS; set up a well-functioning Computer Emergency Response Team (CERT); and adopt a national cyber incident contingency/cooperation plan and a national NIS strategy.

–        Ensure cooperation among the competent authorities at EU level.  Among other things, national authorities will be required to exchange information and best practices between themselves and the Commission within a new “cooperation network”, and circulate early warnings on security risks and incidents affecting network and information systems.

–        Impose new security and incident reporting obligations.  Public administrations and entities in specific sectors — energy, transport, financial services and health, and “enablers of key internet services” — will be required to adopt NIS risk management practices and notify competent national authorities of any security incident that has a significant impact on the continuity of core services they provide.

The incident reporting obligations may be the biggest cause for concern for private sector companies, at least initially (the platform on NIS solutions also bears watching).  A key question remains over what the Commission perceives the benefit to be of extending the obligation to report so broadly, well beyond the providers of critical services.  It is questionable whether national authorities will have the capability to react to reports and take appropriate mitigating measures.  There is a real possibility that this requirement could become an exercise in collecting statistics that does nothing to improve security.  Equally concerning, as drafted, the proposed NIS Directive would allow Member States to adopt diverging reporting rules, which could lead to a patchwork of requirements across the EU. 

In addition to monitoring the incident reporting requirements, companies may want to consider calling for a seat at the table of any new “cooperation network” where national authorities will share information about new threats.  A duty to report incidents without gaining access to information that could help companies protect their networks sounds like a tax with no return.

Print:
EmailTweetLikeLinkedIn
Photo of Mark Young Mark Young

Mark Young advises clients on data protection, cybersecurity and other tech regulatory matters. He has particular expertise in product counselling, GDPR regulatory investigations, and legislative advocacy. Mr. Young leads on EU cybersecurity regulatory matters, and helps to oversee our internet enforcement team.

He…

Mark Young advises clients on data protection, cybersecurity and other tech regulatory matters. He has particular expertise in product counselling, GDPR regulatory investigations, and legislative advocacy. Mr. Young leads on EU cybersecurity regulatory matters, and helps to oversee our internet enforcement team.

He has been recognized in Chambers UK as “a trusted adviser – practical, results-oriented and an expert in the field.” Recent editions note that he is “deeply knowledgeable in the area of privacy and data protection,” “fast, thorough and responsive,” and has “great insight into the regulators.”

Mr. Young has over 15 years of experience advising global companies, particularly in the technology, health and pharmaceutical sectors, on all aspects of data protection and security. This includes providing practical guidance on analyzing and using personal data, transferring personal data across borders, and potential liability exposure. He specializes in advising in relation to new products and services, and providing strategic advice and advocacy on a range of EU law reform issues and references to the EU Court of Justice.

For cybersecurity matters, he counsels clients on practices to protect business-critical information and comply with national and sector-specific regulation, and on preparing for and responding to cyber-based attacks and internal threats to their networks and information. He has helped a range of organizations respond to cyber and data security incidents – including external data breaches and insider theft of trade secrets – through the stages of initial detection, containment, notification, recovery and remediation.

In the IP enforcement space, Mr. Young represents right owners in the sport, media, publishing, fashion and luxury goods industries, and helps coordinate a team of internet investigators that has nearly two decades of experience conducting global notice and takedown programs to combat internet piracy.