Skip to content
OPINION (COM(2022)0119 – C90121/2022 – 2022/0084(COD))

On the proposal for a regulation of the European Parliament and of the Council on information security in the institutions, bodies, offices and agencies of the Union

ITRE-AD-768157

Committee on Industry, Research and Energy · Rapporteur: Borys Budka

Official HTML ↗ PDF DOCX
✦ In shortFull textProcedure & committee votes
✦ In short · AI summary of this text, generated 25 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

The Committee on Industry, Research and Energy proposes amendments to the proposed regulation on information security in the Union's institutions, bodies, offices and agencies. It replaces 'institutions and bodies' with 'Union entities' throughout, adds common minimum standards and interoperability, and strengthens access to information for Members of the Union institutions. The amendments add rules on personal data protection, transparency, whistle-blower protection, vetting of contractors, and a personal data breach procedure. They also set deadlines for training and for ENISA to establish a list of approved cryptographic products for RESTREINT UE/EU RESTRICTED information.

Committee position. The Committee on Industry, Research and Energy proposes amendments to the proposed regulation, including replacing 'institutions and bodies' with 'Union entities', adding common minimum standards, strengthening access to information for Members, and introducing rules on personal data protection, transparency, contractor vetting, training deadlines, and cryptographic product lists.

Key points

  1. Replaces 'institutions and bodies' with 'Union entities' throughout the text, except in Article 3(e) and Articles 42 and 4(a).
  2. Adds that Members of the Union institutions should have access to all necessary information on the basis of the need-to-know principle to exercise their mandate.
  3. Requires that any limitation of the right to personal data protection and privacy be necessary and proportionate under Article 52(1) of the Charter, and that information security measures comply with Union data protection law.
  4. Calls for enhanced transparency, minimisation and time-limiting of confidential documents, safeguards against misuse of classification, and adequate protection of whistle-blowers.
  5. Requires contractors' personnel to undergo a vetting procedure as part of the tender procedure, taking into account the full supply chain and operational environment.
  6. Requires Union entities to apply Regulation (EU) 2018/1725 when handling personal data breaches and to adopt a personal data breach handling procedure.
  7. Requires mandatory training at least once every 5 years for all individuals authorised to access EUCI, with specific training for information security functions, and effective training not later than six months after entry into force.
  8. Adds end-to-end encryption, in particular when exchanging sensitive non-classified information, and requires information security incidents to be formally recorded and handled under the cybersecurity regulation.
  9. Requires the Coordination Group to adopt guidance documents on EUCI creation and classification, implementing minimisation and time-limiting, with rules on assessment and justification to increase transparency.
  10. Requires notification of the originator and competent authorities without undue delay and not later than one week after the Security Authority is informed of a breach.
  11. Requires a process for identifying and reporting vulnerabilities, including internal and external rewards, complemented by regular audits and penetration tests where appropriate.
  12. Requires the Council to maintain a list of approved cryptographic products for EUCI, and ENISA to establish and update yearly a list of additional approved products for RESTREINT UE/EU RESTRICTED by 18 months after entry into force.

Who is affected

  • Union institutions, bodies, offices and agencies, which would have to apply common information security rules and minimum standards.
  • Members of the Union institutions, who would have access to all necessary information under the need-to-know principle.
  • Contractors and outsourcing personnel, who would undergo vetting as part of tender procedures.
  • The European Union Agency for Cybersecurity (ENISA), which would establish and update a list of approved cryptographic products for RESTREINT UE/EU RESTRICTED.
  • The Council, which would maintain a list of approved cryptographic products for EUCI.

Figures and deadlines

  • at least once every 5 years for mandatory training for all individuals authorised to access EUCI
  • not later than six months after the date of entry into force of this Regulation for effective and appropriate trainings
  • not later than one week after the Security Authority has been informed of the breach for informing the originator
  • not later than one week after the Security Authority has been informed of the breach for notifying competent authorities
  • 18 months after the date of entry into force of this Regulation for ENISA to establish the list of approved cryptographic products
  • on a yearly basis for ENISA to update the list of additional approved cryptographic products
  • on a yearly basis for the Coordination Group to inform the Council of recommended cryptographic products