Skip to content
DRAFT OPINION (COM(2022)0019 – C90121/2022 – 2022/0084(COD))

On the proposal for a regulation of the European Parliament and of the Council on information security in the institutions, bodies, offices and agencies of the Union

ITRE-PA-768157

Committee on Industry, Research and Energy · Rapporteur: Borys Budka

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 29 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

The Committee on Industry, Research and Energy gives its draft opinion on the proposed regulation on information security in the Union's institutions, bodies, offices and agencies. It proposes amendments to the Commission proposal. The amendments replace 'institutions and bodies' with 'entities' throughout, add common minimum standards, and require a common approach to sharing EU classified information and sensitive non-classified information. They add that Members of the Union institutions should have access to all necessary information under the need-to-know principle to exercise their mandate. They add data protection safeguards, transparency, limits on the use and duration of classification, and whistle-blower protection. They set rules on training, incident notification deadlines, cryptographic products, and a vetting procedure for contractors.

Committee position. The Committee on Industry, Research and Energy proposes amendments to the Commission proposal, including replacing 'institutions and bodies' with 'entities', adding common minimum standards, access rights for Members, data protection safeguards, and rules on training, incident notification, cryptographic products and contractor vetting.

Key points

  1. Replaces 'institutions and bodies' with 'entities' throughout the text, except in Article 3(e) and Articles 42 and 4(a).
  2. Adds that the regulation should ensure common minimum standards and a common structure for cooperation between Union entities.
  3. Adds that Members of the Union institutions should have access to all necessary information on the basis of the need-to-know principle to exercise their mandate.
  4. Adds that any limitation of the right to personal data protection and privacy must be necessary and proportionate under Article 52(1) of the Charter.
  5. Adds that information security measures involving personal data must comply with Union data protection law, with technical and organisational safeguards.
  6. Adds that Union entities should enhance transparency, minimise and limit in time the use of confidential documents, and protect whistle-blowers.
  7. Adds that contractors' personnel should undergo a vetting procedure as part of the tender procedure, taking into account the full supply chain.
  8. Requires Union entities to organise mandatory training at least once every 5 years for all individuals authorised to access EUCI, and specific training for information security functions.
  9. Requires the Security Authority to inform the originator and notify competent authorities of a breach without undue delay, and not later than one week after being informed.
  10. Requires a list of approved cryptographic products for EUCI to be maintained by the Council, and a yearly updated list for RESTREINT UE/EU RESTRICTED to be established by ENISA by 18 months after entry into force.
  11. Adds that the sub-group on EUCI sharing shall include the European Parliament and shall ensure that classification does not in itself prevent disclosure.
  12. Adds conditions for access to EUCI, including a legal obligation under Union law or an Interinstitutional agreement, or to fulfil a Union entity's mandate.

Who is affected

  • Union institutions, bodies, offices and agencies, which would have to apply common information security rules.
  • Members of the Union institutions, who should have access to necessary information under the need-to-know principle.
  • Contractors and outsourcing personnel, who would face a vetting procedure in tender procedures.
  • The Council and ENISA, which would maintain lists of approved cryptographic products.
  • The European Parliament, which would join the sub-group on EUCI sharing.

Figures and deadlines

  • at least once every 5 years, for mandatory training for all individuals authorised to access EUCI
  • not later than ...[six months after the date of entry into force of this Regulation], for designing and implementing trainings
  • not later than one week after the Security Authority has been informed of the breach, for informing the originator
  • not later than one week after the Security Authority has been informed of the breach, for notifying competent authorities
  • By ...[18 months after the date of entry into force of this Regulation] ENISA shall establish the list, for additional approved cryptographic products for RESTREINT UE/EU RESTRICTED
  • on a yearly basis, for updating the list of additional approved cryptographic products for RESTREINT UE/EU RESTRICTED
  • on a yearly basis, for the Coordination Group to inform the Council of recommended cryptographic products