Skip to content
DRAFT REPORT (COM(2023)0208 – C90137/2023 – 2023/0108(COD))

On the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) 2019/881 as regards managed security services

ITRE-PR-752802

Committee on Industry, Research and Energy · Rapporteur: Josianne Cutajar

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 2 Oct 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

This is the rapporteur's draft report on the Commission proposal to amend Regulation (EU) 2019/881 so that European cybersecurity certification covers managed security services. The draft supports the proposal and tables amendments to clarify the definition of managed security services, align certification with international standards, and add new recitals. It puts emphasis on the cybersecurity skills gap, training and talent, and on support for micro, small and medium-sized enterprises. It also asks the Commission to refer the matter to Parliament again if it substantially amends its proposal.

Committee position. The rapporteur supports the Commission proposal and proposes amendments to clarify the definition of managed security services, align certification with international standards, and emphasise skills, training and support for micro, small and medium-sized enterprises.

Key points

  1. Adopts Parliament's first-reading position as set out in the amendments.
  2. Calls on the Commission to refer the matter to Parliament again if it replaces or substantially amends its proposal.
  3. Adds a recital stating the regulation complements the horizontal framework setting cybersecurity requirements for products with digital elements.
  4. Amends the recital on managed security services to describe their activities, including prevention, detection, response and recovery, and notes providers have themselves been targets of cyberattacks.
  5. Adds recitals on accessibility and affordability for smaller actors, international recognition, data collection on the cybersecurity labour market, Member State capacity building, and Commission exchanges with ENISA and stakeholders.
  6. Adds recitals on mobilising academia and research institutions, on-the-job training, and Member State measures to train and retain talent, including attracting more women and girls into STEM.
  7. Amends the definition of 'managed security service' to specify it is an outsourced service and to include prevention, detection, response to or recovery from incidents.
  8. Adds criteria for certification schemes: prior alignment with applicable international standards and the provider's contribution to training and upskilling staff.
  9. Requires the Union rolling work programme to consider providers' contribution to training and attracting talent, especially through partnerships with universities.
  10. Requires candidate schemes to take into account input from the European system for technical standardisation or the Union's sectoral agencies.
  11. Requires providers to have internal procedures ensuring services are provided at a very high level of quality and reliability at all times.
  12. Requires the Commission to take account of implementation deadlines and the specific interests of microenterprises and SMEs, and to ensure appropriate financial support under existing Union programmes.

Who is affected

  • Providers of managed security services, who would be covered by European cybersecurity certification schemes.
  • Microenterprises and small and medium-sized enterprises, which should benefit from accessible services and financial support.
  • Member States, which should train and retain cybersecurity talent and contribute to data collection.
  • The Commission, which should increase exchanges with ENISA and facilitate dialogue with stakeholders.

Legal basis: Article 294(2) and Article 114 of the Treaty on the Functioning of the European Union.