On the proposal for a directive of the European Parliament and of the Council amending Directive (EU) 2022/2555 as regards simplification measures and alignment with the [Proposal for the Cybersecurity Act 2]
ITRE-PR-792221
Committee on Industry, Research and Energy · Rapporteur: Markéta Gregorová
Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.
This is the rapporteur's draft report on a Commission proposal to amend Directive (EU) 2022/2555 with simplification measures and alignment with the proposed Cybersecurity Act 2.¶¶ It sets fixed dates for the migration to post-quantum cryptography: critical use cases by 31 December 2030 and all other use cases by 31 December 2035.¶¶ It requires the Commission to issue guidance on the harmonised application of the Directive and guidelines on supplier information requests in a common, machine readable format.¶¶¶ It adds confidentiality, deletion and liability rules for ransomware information, and data minimisation and resource rules for ENISA's registry and tasks.¶¶¶ It routes incident notifications through a single entry point and amends Regulation (EU) No 910/2014, Regulation (EU) 2022/2554 and Directive (EU) 2022/2557 accordingly.¶¶¶
Committee position. The rapporteur proposes that Parliament adopt its first-reading position with 33 amendments to the Commission proposal, covering post-quantum migration dates, harmonised guidance, supplier guidelines, ransomware confidentiality, ENISA resources and data minimisation, single entry point notifications, and changes to three other Union acts.¶¶¶
Key points
- Sets fixed migration dates to post-quantum cryptography: critical use cases by 31 December 2030 and all other use cases by 31 December 2035, in line with the NIS Cooperation Group roadmap.¶¶
- Requires the Commission to adopt guidelines in a common, machine readable format for supplier information requests, so obligations are not unduly passed to micro and small enterprises and free and open-source software developers, maintainers and foundations.¶¶
- Requires ransomware information to be collected exclusively for prevention, situational awareness and support, treated confidentially, not used in supervisory or enforcement proceedings, transmitted onward only where Union or national law expressly provides, and deleted when no longer necessary.¶¶
- Requires the ENISA registry to comply with data minimisation, keeps information on entities' IP ranges with national competent authorities, and requires state-of-the-art protection designed with the European Data Protection Supervisor.¶
- Requires ENISA's new tasks to be matched by adequate resources, the cross-border risk assessment report and annual updates to go simultaneously to Parliament, the Council and the Commission, and unactionable requests to appear in its annual activity report.¶¶¶
- Requires the Commission, with the NIS Cooperation Group and ENISA, to issue guidance on harmonised interpretation of key obligations, including classification of entities, audit conditions, cross-border registration and reporting, and proportionality in supervision.¶¶
- Defines 'main establishment' and requires ENISA to keep an up-to-date, machine readable record of registered entities' main establishments.¶
- Replaces implementing acts with delegated acts for technical, methodological and sectoral requirements, requires assessments every two years, and ends national requirements going beyond those acts 12 months after their application.¶¶
- Requires significant incidents to be notified via a single entry point, states that notification does not increase liability, and requires ransomware communication channels to use end-to-end encryption by default with statistics published annually.¶¶¶
- Allows a manufacturer's notification of a severe incident under Regulation (EU) 2024/2847 to count as reporting under the Directive where it contains the required information.¶
- Requires cyber posture certificates to be recognised in all Member States and prevents additional supervisory measures where a certificate demonstrates compliance.¶¶
- Amends Regulation (EU) No 910/2014, Regulation (EU) 2022/2554 and Directive (EU) 2022/2557 to route notifications through the single entry point, and allows implementing acts on the type and format of critical entity notifications.¶¶¶
Who is affected
- Essential and important entities: must meet post-quantum migration dates, notify incidents via a single entry point, and follow supplier guidelines.¶¶¶
- Micro and small enterprises and free and open-source software developers, maintainers and foundations: protected from unduly passed-on obligations.¶
- ENISA: gains registry, guidance and reporting tasks, with resource and data protection conditions.¶¶¶
- Manufacturers of products with digital elements: their severe incident notifications can count as reporting under the Directive.¶
- Financial entities and critical entities: must report incidents through the single entry point.¶¶¶
Figures and deadlines
- 31 December 2030: deadline for migrating critical use cases to post-quantum cryptography.¶¶
- 31 December 2035: deadline for migrating all other use cases to post-quantum cryptography.
- 12 months after entry into force: deadline for Commission guidance on harmonised application and for supplier guidelines.¶¶
- 24 months after receipt: latest deletion of ransomware information collected.¶
- 15 months after entry into force: deadline for ENISA's cross-border cybersecurity risk analysis.¶
- 24 hours: deadline for critical entities' initial notification of incidents.¶
- One month: deadline for critical entities' detailed report after an incident.
- 12 months after application of delegated acts: national requirements going beyond them cease to apply.¶
Legal basis: Article 294(2) and Article 114 of the Treaty on the Functioning of the European Union.¶