Standards, Regulations & Compliance
Revised Cybersecurity Act Would Also Boost ENISA
Countries across the European Union could be forced to kick Chinese telecom manufacturers such as Huawei and ZTE out of their critical infrastructure supply chains, under a far-reaching proposal published by the European Commission on Tuesday.
See Also: On-Demand | NYDFS MFA Compliance: Real-World Solutions for Financial Institutions
The proposal includes a hefty revision of the 2019 Cybersecurity Act. Apart from tightening the rules around critical supply chains, the new regulation – to be applied equally in all EU member states – would expand the role of the European Union Agency for Cybersecurity to oversee cybersecurity certification schemes, while also making significant changes to the still-not-fully-implemented Network and Information Security 2 Directive (see: European States Spin Wheels on Cybersecurity Directive).
“With the new Cybersecurity Package, we will have the means in place to better protect our critical ICT supply chains but also to combat cyberattacks decisively,” said Henna Virkkunen, the commission’s executive vice-president for tech sovereignty, in a statement.
The proposed CSA revision doesn’t mention China by name, but the implications are clear.
Article 100, which covers the designation of high-risk third countries, talks about laws that require companies in those countries to give their own authorities a heads-up about vulnerabilities before known exploitations – as has been the case in China since September 2021 (see: China Likely Amasses 0-Days Via Vulnerability Disclosure Law).
It also refers to a lack of effective judicial remedies and “independent and democratic control mechanisms,” as well as “substantiated information about one or more incidents of threat actors controlled from that country and operating out of the territory of that country carrying out malicious cyber activities or campaigns.”
Once the EU has designated a country as posing cybersecurity concerns, the commission would be able to identify high-risk suppliers from that country and order communications network operators to phase out those suppliers’ components within three years.
Although this mandatory exclusion is only spelled out in relation to communications networks, other parts of the proposal suggest that a long list of other supply chains could be targeted, from connected vehicles and drones to solar energy systems and security scanners.
“With the Cybersecurity Act, the EU can now exclude high-risk vendors from its critical value chains (e.g., Huawei for 5G networks),” said Stéphane Séjourné, the commission’s executive vice-president for industrial strategy, in a post on X that made the Huawei link explicit. “In this period, cybersecurity is not a luxury, it is a matter of survival.
A framework called the “5G cybersecurity toolbox” already encourages member countries to exclude high-risk suppliers from their 5G networks. It has been used to restrict or exclude Huawei and ZTE from networks in around 10 member states, but the majority have implemented no restrictions at all. “Now we will have stricter rules on this,” Virkkunen told Politico ahead of the new proposal’s unveiling.
If this element of the proposal survives the tortuous continental legislative process – the commission will now need to negotiate with the European Parliament and the member states – then it would arguably represent a belated acceptance of American demands for an outright ban on Huawei and ZTE telecoms equipment. The Obama and first Trump administrations both lobbied hard for such a ban in Europe, but the voluntary approach of the “5G cybersecurity toolbox” served as a rejection of those calls.
“Turning trade into security and political issues will hinder technological progress and economic growth and to no one’s good,” China’s foreign ministry told Reuters in response to reports ahead of the proposal’s unveiling. The ministry characterized the proposal as “naked protectionism.”
Apart from the high-risk supplier issue, the proposed package would also introduce a supposedly simpler cybersecurity certification framework for products and services. Such certifications would be developed within a year by default, with European Union Agency for Cybersecurity – better known as ENISA – being in charge of the process.
Since the introduction of the first framework in the original Cybersecurity Act, only one such scheme – the EU Cybersecurity Certification or EUCC, covering hardware, software and components – has been published, while schemes covering cloud services, 5G and digital identity wallets remain merely under development. The Commission’s own Tuesday proposal described the framework’s implementation as “stalled.”
Under the revised framework, certification schemes would remain voluntary, but the Commission is pitching the framework as a “competitive asset for EU businesses” that should find it easier to pitch their secure wares to European citizens and other businesses.
The Computer and Communications Industry Association, the largest Brussels lobbying outfit for the U.S. tech industry, expressed cautious relief that the proposal didn’t introduce European “sovereignty” restrictions to the framework in a way that could have excluded non-EU companies from achieving high-level certifications.
“We call on the EU institutions to continue to resist the protectionist urge to reinstate discriminatory restrictions that would harm the security of Europe’s digital ecosystem,” said CCIA Europe tech policy manager Mitchell Rutledge in an emailed statement.
Meanwhile, the proposal would theoretically make it easier for companies to comply with the NIS2 Directive, which is supposed to boost the cybersecurity of organizations operating critical infrastructure.
15 months after the deadline for implementing the directive nationally, fewer than two-thirds of member states have actually done so, meaning affected companies in places like France and Ireland can’t even take the initial mandatory step of registering with their national authority. With the introduction of legislation meant to revise the Cybersecurity Act, there are now two separate commission proposals that would change the nature of NIS2 compliance.
The first was the Digital Omnibus draft proposed in November, which would allow organizations to notify incidents to ENISA in a way that satisfies a few separate laws, including NIS2, in one streamlined notification. The CSA revision would similarly try to ease compliance, this time by introducing a new “small mid-cap enterprise” category that the commission says will lower compliance costs for 22,500 companies.
The new proposal would also make substantive changes to NIS2 by giving the directive more scope over submarine data cable infrastructure, and by introducing “more precise legal drafting” regarding “sectors such as electricity or chemicals,” the commission said in a Q&A document. The revised NIS2 would then need to be transposed into national law by all the member states, including those that still haven’t transposed the first version.
In line with its expanded remit, ENISA would see a boost of over 75% to its funding under the proposal, along with greater staffing.