On the proposal for a regulation of the European Parliament and of the Council Proposal for a regulation of the European Parliament and of the Council on information security in the institutions, bodies, offices and agencies of the Union
ITRE-PA-738558
Committee on Industry, Research and Energy · Rapporteur: Henna Virkkunen
Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.
The Committee on Industry, Research and Energy gives its draft opinion on the proposed regulation on information security in the Union's institutions, bodies, offices and agencies.¶¶¶ The rapporteur welcomes the proposal and proposes amendments to streamline information security rules across all Union entities.¶¶ The amendments add a need-to-know principle giving Members of Union institutions access to all necessary information for their mandate.¶¶ They require vetting of contractors' personnel and evaluation of security infrastructure, including the full supply chain.¶¶ They set deadlines for notifying breaches, change the Coordination Group's voting to simple majority, and adjust rules on cryptographic products and EUCI sharing.¶¶¶
Committee position. The Committee on Industry, Research and Energy calls on the Committee on Civil Liberties, Justice and Home Affairs to take into account 19 amendments to the proposed regulation, covering definitions, access to information, contractor vetting, breach notification deadlines, cryptographic products and the Coordination Group's voting.¶¶¶
Key points
- The rapporteur welcomes the proposal as part of the EU Security Union Strategy and supports modernising and streamlining information security rules for all Union entities.¶
- The amendments replace 'Union institutions and bodies' with 'Union entities' throughout the text, covering institutions, bodies, offices and agencies.¶¶¶
- A new recital and article state that Members of Union institutions should have access to all necessary information by virtue of their mandate, on a need-to-know principle.¶¶
- The amendments require contractors' personnel to undergo a vetting procedure as part of the tender procedure, taking into account the full supply chain and operational environment.¶
- A thorough evaluation of security infrastructure, including services, should be conducted, taking into account the full supply chain and operative environment.¶
- The Coordination Group should act by simple majority instead of consent, to streamline its work.¶¶
- Each Union entity shall be appropriately represented in the Coordination Group and in the thematic sub-groups.¶
- Security Authorities must inform the originator and notify competent authorities of a breach without undue delay and no later than one week after being informed.¶¶
- The Council maintains the list of approved cryptographic products for EUCI, while ENISA establishes and updates yearly a list of additional approved products for RESTREINT UE/EU RESTRICTED information.¶¶¶
- The Coordination Group shall inform the Council yearly of cryptographic products it recommends for evaluation by a Crypto Authority Approval of a member state or ENISA.¶
- The sub-group on EUCI sharing and exchange of classified information shall include the European Parliament alongside the Commission, Council and European External Action Service, working by consensus.¶
- A new ground for exception is added where there is a legal obligation under Union law or an interinstitutional agreement between Union institutions.¶
Who is affected
- Union entities: would be covered by common information security rules and represented in the Coordination Group.¶¶¶
- Members of Union institutions: would have access to all necessary information under a need-to-know principle.¶¶
- Contractors and third parties: their personnel would undergo vetting as part of tender procedures.¶
- European industry: fair processing of information, especially trade secrets, would be elevated to an adequate standard.¶
- ENISA: would establish and update yearly a list of additional approved cryptographic products for RESTREINT UE/EU RESTRICTED information.¶