The European Commission, together with the High Representative of the Union for Foreign Affairs and Security Policy, has today published a CyberSecurity Strategy alongside a Commission proposed Directive on Network and Information Security (“NIS”).

While much of the Strategy and Directive is aimed at Member State governments (e.g., to improve capabilities and cooperation to prevent and respond to cyber-attacks), several proposals target private companies in the energy, transport, financial services and health sectors, as well as “enablers of key internet services” such as providers of cloud computing services, app stores, e-commerce platforms, internet payment gateways, search engines and social networks. 

These companies would be required, under the Directive, to implement security measures to “guarantee a level of security appropriate to the risk presented . . . having regard to the state of the art”.  

Further, they would have to notify competent national authorities of any security incident that has a significant impact on the continuity of core services they provide — effectively extending current EU incident reporting requirements, which only apply to communication network and service providers, to a broad universe of private sector companies.  To be clear, this incident reporting obligation is separate from and additional to the proposal for all companies to report breaches of personal data to national supervisory authorities under the Commission 2012 proposal for a General Data Protection Regulation.

The Commission also intends to launch “a platform on NIS solutions” to develop “incentives for the adoption of secure ICT solutions” — considering technical norms, standards and possibly EU-wide certification schemes — to be applied to ICT products used in Europe, and to make recommendations to ensure cybersecurity across the ICT value chain.  The Commission also will examine how major providers of ICT hardware and software could inform national competent authorities on detected vulnerabilities that could have significant security-implications.

The EU institutions will now start to review the Strategy and proposed Directive.  The process to adopt the Directive could take two years, at which point Member States will be required to implement the legislation into national laws, which could take another 18 months or more.

The Strategy comprises two documents:

• A Joint Strategy Communication by Vice-President Kroes, Commissioner Malmström and High Representative Ashton, which aims to:

–        Achieve “cyber resilience” in the public and private sectors and at national and EU level;

–        Drastically reduce cybercrime in the EU;

–        Develop an EU cyber defence policy related to the Common Security and Defence Policy;

–        Develop European industrial and technological resources for cybersecurity; and

–        Enhance the EU’s international cyberspace policy to promote the respect of EU core values.

• A proposed Directive on Network and Information Security, which aims to:

–        Increase cyber preparedness and capabilities at national level.  Member States will be required to designate a competent authority responsible for NIS; set up a well-functioning Computer Emergency Response Team (CERT); and adopt a national cyber incident contingency/cooperation plan and a national NIS strategy.

–        Ensure cooperation among the competent authorities at EU level.  Among other things, national authorities will be required to exchange information and best practices between themselves and the Commission within a new “cooperation network”, and circulate early warnings on security risks and incidents affecting network and information systems.

–        Impose new security and incident reporting obligations.  Public administrations and entities in specific sectors — energy, transport, financial services and health, and “enablers of key internet services” — will be required to adopt NIS risk management practices and notify competent national authorities of any security incident that has a significant impact on the continuity of core services they provide.

The incident reporting obligations may be the biggest cause for concern for private sector companies, at least initially (the platform on NIS solutions also bears watching).  A key question remains over what the Commission perceives the benefit to be of extending the obligation to report so broadly, well beyond the providers of critical services.  It is questionable whether national authorities will have the capability to react to reports and take appropriate mitigating measures.  There is a real possibility that this requirement could become an exercise in collecting statistics that does nothing to improve security.  Equally concerning, as drafted, the proposed NIS Directive would allow Member States to adopt diverging reporting rules, which could lead to a patchwork of requirements across the EU. 

In addition to monitoring the incident reporting requirements, companies may want to consider calling for a seat at the table of any new “cooperation network” where national authorities will share information about new threats.  A duty to report incidents without gaining access to information that could help companies protect their networks sounds like a tax with no return.