Skip to content
REPORT (COM(2023)0209 – C90136/2023 – 2023/0109(COD))

On the proposal for a regulation of the European Parliament and of the Council laying down measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cybersecurity threats and incidents

A-9-2023-0426

Committee on Industry, Research and Energy · Rapporteur: Lina Gálvez Muñoz

Official HTML ↗ PDF DOCX
✦ In shortFull textProcedure & committee votes
✦ In short · AI summary of this text, generated 25 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of the Commission proposal for a regulation on EU cybersecurity solidarity measures. It sets up a European Cyber Shield of national and cross-border Security Operations Centres, a Cybersecurity Emergency Mechanism with an EU Cybersecurity Reserve, and an incident review mechanism. It amends Regulation (EU) 2021/694 to fund these actions under Specific Objective 3 of the Digital Europe Programme, caps the Reserve at EUR 27 million, and allows unused funds to be carried over. It lays down rules on information sharing, security, trusted providers, support to third countries, skills, evaluation and delegated powers.

Committee position. The committee proposes to adopt the amended Commission proposal, reinforcing solidarity, governance, budget continuity beyond 2027, ENISA's role, skills and the external dimension.

Key points

  1. A European Cyber Shield of National SOCs and Cross-border SOCs is established to detect, analyse and process data on cyber threats and prevent incidents.
  2. Each Member State must designate at least one National SOC in a public body; the ECCC may fund up to 50% of acquisition and operation costs of jointly procured tools.
  3. Cross-border SOCs need a Hosting Consortium of at least three Member States; the ECCC may fund up to 75% of acquisition costs and up to 50% of operation costs.
  4. Cross-border SOCs must share information on cyber threats and conclude cooperation agreements; the Commission may adopt delegated acts on interoperability and information-sharing procedures.
  5. A Cybersecurity Emergency Mechanism is set up to support preparedness, response and mutual assistance for significant and large-scale cybersecurity incidents.
  6. The Commission, after consulting the NIS Cooperation Group and ENISA, identifies sectors from Annex I to Directive (EU) 2022/2555 for coordinated preparedness testing.
  7. An EU Cybersecurity Reserve of trusted managed security service providers is established; users include Member State authorities, CSIRTs, Union institutions and CERT-EU.
  8. Requests for Reserve support are assessed by the Commission with ENISA, with a response within 24 hours; priority criteria include incident severity and cross-border nature.
  9. Procurement for the Reserve must follow selection criteria on integrity, security clearance, transparency, technical equipment, experience and certification.
  10. Third countries associated to the Digital Europe Programme may request Reserve support under their association agreements and must designate a single point of contact.
  11. ENISA reviews and assesses specific significant or large-scale incidents at the request of the Commission, EU-CyCLONe or the CSIRTs network, and delivers a report.
  12. The Commission must evaluate the regulation every two years and may propose amendments; ENISA receives additional resources for its new tasks.

Who is affected

  • Member States, which must designate National SOCs and may receive funding and support.
  • Entities in critical and highly critical sectors, which may undergo coordinated preparedness testing and receive Reserve support.
  • Managed security service providers, which may be selected as trusted providers for the EU Cybersecurity Reserve.
  • Third countries associated to the Digital Europe Programme, which may request Reserve support.
  • ENISA, which receives additional tasks and resources.

Figures and deadlines

  • EUR 1 776 956 000 for Specific Objective 2 – Artificial Intelligence
  • EUR 1 620 566 000 for Specific Objective 3 – Cybersecurity and Trust
  • EUR 500 347 000 for Specific Objective 4 – Advanced Digital Skills
  • EUR 27 million maximum for the EU Cybersecurity Reserve
  • up to 50% of acquisition and operation costs for National SOCs
  • up to 75% of acquisition costs and up to 50% of operation costs for Cross-border SOCs
  • response to Reserve support requests within 24 hours
  • women comprising 20 % of the average worldwide presence in cybersecurity

Legal basis: Article 173(3) and Article 322(1), point (a) of the Treaty on the Functioning of the European Union