On the proposal for a regulation of the European Parliament and of the Council laying down measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cybersecurity threats and incidents
AFET-AD-750145
Committee on Foreign Affairs · Rapporteur: Dragoş Tudorache
Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.
The Committee on Foreign Affairs proposes amendments to the proposed regulation on EU cybersecurity solidarity and capacities. It adds military and defence actors, a 'defence pillar' in the European Cyber Shield, and civil-military coordination to the rules.¶¶¶ It requires excluding high-risk suppliers from critical products and infrastructure, and reducing dependencies on countries that would contravene EU security and defence interests.¶¶¶ It extends support from the EU Cybersecurity Reserve and the Cyber Emergency Mechanism to third countries, particularly Ukraine and Moldova, and to candidate countries aligned with the Common Foreign and Security Policy.¶¶¶ It sets funding rates for joint procurement of tools and infrastructure, and provides for carry-over of unused funds and longer-term financial support.¶¶¶
Committee position. The Committee on Foreign Affairs proposes amendments to the Commission proposal to add military and defence actors, a defence pillar in the European Cyber Shield, civil-military coordination, exclusion of high-risk suppliers, and support for third countries including Ukraine and Moldova.¶¶¶
Key points
- Adds military and defence actors to the recital on dependence on information and communication technologies, alongside public administrations, companies and citizens.¶
- States that the gravity of cyber threats became more relevant due to the return of war on the continent, going beyond Russia's military aggression on Ukraine, and can undermine local or national security installations.¶
- Calls for a Union body acting as a coordination platform for all existing and future cybersecurity instruments, funds and mechanisms.¶
- Requires enhanced civil-military coordination and cooperation, and crisis management structures linking the Union's external security and military crisis management structures, including for Common Security and Defence Policy operations and missions.¶¶¶
- Provides for a 'defence pillar' in National and Cross-border SOCs, allowing defence entities to participate and share military information when necessary and feasible.¶¶
- Requires that entities participating in the European Cyber Shield be equipped with state-of-the-art tools excluding high-risk suppliers of critical products with digital elements, with human oversight when using artificial intelligence.¶¶
- Requires de-risking and measures to restrict or exclude high-risk suppliers, and limits information sharing with high-risk providers.¶¶
- Adds a new objective to reduce systemic cybersecurity risks from dependencies on critical equipment from countries that would contravene EU security and defence interests.¶
- Allows support from the EU Cybersecurity Reserve and the Cyber Emergency Mechanism for third countries, particularly Ukraine and Moldova, and for candidate countries aligned with the Common Foreign and Security Policy.¶¶¶
- Sets the Union financial contribution at up to 50% of acquisition and operation costs for National SOCs, and up to 75% of acquisition costs and 50% of operation costs for a Hosting Consortium.¶¶
- Provides for carry-over of unused commitment and payment appropriations beyond the Financial Regulation, and longer-term financial support for joint procurement of next-generation ultra-secure tools and infrastructure.¶
- Requires the Commission to submit an evaluation report three years after the date of application and every two years after, instead of four years after.¶
Who is affected
- Member States' defence authorities and the EU cyber defence community, which gain a role in the European Cyber Shield and information sharing.¶¶¶
- Providers from high-risk third countries, which are excluded from infrastructure and from the EU Cybersecurity Reserve.¶¶
- Third countries, particularly Ukraine and Moldova, and candidate countries aligned with the Common Foreign and Security Policy, which may receive support.¶¶¶
- National SOCs and Hosting Consortia, which may receive grants for tools and infrastructure under conditions.¶¶
- Entities in critical and highly critical sectors, such as public infrastructure, election infrastructure, transport, healthcare, financial, telecommunication, food supply and security.¶¶
Figures and deadlines
- up to 50% of the acquisition costs of the tools and infrastructures, and up to 50% of the operation costs, for National SOCs¶
- up to 75% of the acquisition costs of the tools and infrastructures, and up to 50% of the operation costs, for the Hosting Consortium¶
- three years after the date of application of this Regulation and every two years after, for the Commission's evaluation report¶