Skip to content
Adopted text

Managed security services

TA-9-2024-0354 · P9_TA(2024)0354 · PE752.802

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 26 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament adopted its first-reading position on a regulation amending Regulation (EU) 2019/881 to cover managed security services. The amended text allows European cybersecurity certification schemes to be developed for managed security services. Parliament takes note of a Commission statement that a thorough review of the Cybersecurity Act is important, covering how certification schemes are prepared, adopted and reviewed, and that the review should assess impact, effectiveness and efficiency. The statement says the review should include ongoing scheme work such as the European cybersecurity certification scheme for cloud services (EUCS) and adopted schemes such as the European Common Criteria-based cybersecurity certification scheme (EUCC). The review should identify strengths and weaknesses of the procedures for certification schemes, recommend future improvements, and address stakeholder consultations and transparency. The Commission must take these elements into account when presenting the review.

Key points

  1. Parliament adopts its first-reading position on the proposal to amend Regulation (EU) 2019/881 as regards managed security services.
  2. The amended regulation adds the possibility to develop European certification cybersecurity schemes for managed security services.
  3. Parliament takes note of the Commission's annexed statement, to be published in the C series of the Official Journal.
  4. The Commission statement acknowledges that a thorough review of the Cybersecurity Act is of utmost importance.
  5. The review should assess the procedures for preparing, adopting and reviewing European cybersecurity certification schemes.
  6. The review should be based on deep analysis and broad consultation on the impact, effectiveness and efficiency of the European cybersecurity certification framework.
  7. The evaluation under Article 67 of the Cybersecurity Act should include ongoing scheme development such as the European cybersecurity certification scheme for cloud services (EUCS) and adopted schemes such as the European Common Criteria-based cybersecurity certification scheme (EUCC).
  8. The review should identify strengths and weaknesses of the procedures leading to certification schemes and recommend future improvements.
  9. The review should address stakeholder consultations and transparency of the process.
  10. The Commission, responsible for the review, must ensure it takes into account the necessary elements in light of Article 67 when presenting the review to the co-legislators.

Who is affected

  • Providers of managed security services, which may be covered by new European cybersecurity certification schemes.
  • The Commission, which must carry out the review of the Cybersecurity Act and present it to the co-legislators.
  • Stakeholders involved in consultations on the certification framework.

Figures and deadlines

  • Article 67 of the Cybersecurity Act, which establishes the evaluation.

Legal basis: Article 294(2) and Article 114 of the Treaty on the Functioning of the European Union.