Skip to content
REPORT (COM(2023)0208 – C90137/2023 – 2023/0108(COD))

On the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) 2019/881 as regards managed security services

A-9-2023-0307

Committee on Industry, Research and Energy · Rapporteur: Josianne Cutajar

Official HTML ↗ PDF DOCX
✦ In shortFull textProcedure & committee votes
✦ In short · AI summary of this text, generated 25 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of the Commission proposal amending Regulation (EU) 2019/881 adds managed security services to the EU cybersecurity certification framework. It defines managed security services, sets security objectives for their certification schemes, and allows certificates at basic, substantial or high assurance levels. The amended text lets the Commission adopt certification schemes by delegated acts after an impact assessment and public consultation, and requires it to assess whether a scheme should be made mandatory. It requires ENISA to support certification of managed security services, and calls for funding for ENISA's extra tasks, financial support for microenterprises and SMEs, and action on the cybersecurity skills gap. The Commission must evaluate ENISA and the certification framework by 28 June 2024 and every three years thereafter.

Committee position. The rapporteur supports the proposal and seeks to consolidate and clarify the amendment, notably by clarifying the definition of managed security services, recognising international standards, addressing the skills gap and supporting micro, small and medium enterprises.

Key points

  1. The amended regulation adds managed security services to the scope of the European cybersecurity certification framework alongside ICT products, services and processes.
  2. It defines a managed security service as a service provided to a third party consisting of carrying out, assisting with or advising on cybersecurity risk management, including incident handling, penetration testing, security audits and consulting.
  3. Certification schemes for managed security services must ensure staff have a very high level of technical knowledge, competence, experience and professional integrity, and that providers have internal procedures for very high quality at all times.
  4. The schemes must protect data against unauthorised access, loss or alteration, restore availability after incidents, limit access to authorised persons, record access, and require secure-by-default ICT products with up-to-date software and no known vulnerabilities.
  5. Schemes may set assurance levels 'basic', 'substantial' or 'high', with evaluation activities such as documentation review, vulnerability review, testing and penetration testing.
  6. Conformity self-assessment is allowed only for low-risk services at assurance level 'basic', with the provider issuing an EU statement of conformity and assuming responsibility for compliance.
  7. The Commission may adopt certification schemes by delegated acts, after publishing an impact assessment and consulting the SCCG and ECCG.
  8. The Commission must assess by 31 December 2023, and at least every two years thereafter, whether a certification scheme should be made mandatory, taking account of costs and the needs of microenterprises and SMEs.
  9. The Commission must ensure financial support under existing Union programmes to ease the burden on microenterprises and SMEs, including start-ups in managed security services.
  10. National certification schemes covered by a European scheme cease to produce effects from the date in the delegated act, and member states may not introduce new national schemes for services already covered.
  11. ENISA must support and promote certification of managed security services, prepare candidate schemes, publish guidelines and good practices, and facilitate European and international standards.
  12. The Commission must evaluate ENISA and the certification framework by 28 June 2024 and every three years thereafter, reporting to Parliament, the Council and the Management Board.

Who is affected

  • Providers of managed security services, who may seek certification under European schemes.
  • Microenterprises and SMEs, including start-ups, which should receive financial support and face limited burdens.
  • National cybersecurity certification authorities, which supervise compliance and enforce obligations.
  • ENISA, which gains tasks to support certification of managed security services and must receive appropriate funding.
  • Member states, which must not introduce new national schemes for services already covered by a European scheme.

Figures and deadlines

  • Assurance levels 'basic', 'substantial' and 'high' for certification schemes.
  • First assessment of whether a scheme should be mandatory by 31 December 2023, then at least every two years.
  • Evaluation of ENISA and the certification framework by 28 June 2024, and every three years thereafter.
  • Delegated power conferred for five years from the date of entry into force of the amended regulation.
  • Objection period for delegated acts of two months, extendable by two months.

Legal basis: Article 114 of the Treaty on the Functioning of the European Union.