Skip to content
OPINION (COM(2023)0209 – C90136/2023 – 2023/0109(COD))

On the proposal for a regulation of the European Parliament and of the Council on Measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cybersecurity threats and incidents

TRAN-AD-752607

Committee on Transport and Tourism · Rapporteur: Gheorghe Falcă

Official HTML ↗ PDF DOCX
✦ In shortFull textProcedure & committee votes
✦ In short · AI summary of this text, generated 29 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

The Committee on Transport and Tourism gives its opinion on the proposed regulation on measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cybersecurity threats and incidents. It proposes amendments to add transport-specific wording throughout the proposal. The amendments add new recitals on cyber threats to transport, including a 25% increase in reported incidents affecting the sector in 2022 compared to 2021, and on attacks following Russia's invasion of Ukraine. They ask for transport operators to receive training and tools, for the transport sector to be prioritised in coordinated preparedness testing, and for more resources for the European Union Agency for Cybersecurity (ENISA). They also call for the European Cyber Shield to cover transport infrastructure such as the trans-European transport network (TEN-T) and Intelligent Transport Systems, and to enable cooperation with the cyber defence community and military mobility.

Committee position. The committee welcomes the proposal and proposes amendments to add transport-specific wording throughout, to prioritise the transport sector in preparedness testing, to provide training and tools to transport operators, and to increase resources for ENISA.

Key points

  1. The committee notes that organisations affected by cyberattacks, especially private companies in transport, rarely report them, and that the NIS2 Directive harmonises reporting obligations, with Member States due to transpose it by October 2024.
  2. It cites an ENISA report finding that cybercriminals were responsible for more than half (55%) of incidents observed in the 2022 reporting period, mostly for financial gain, and that most attacks target IT systems.
  3. It states that Union-level support and solidarity on preparedness and response are limited, and that the Council Conclusions of May 2022 called for a proposal on a new Emergency Response Fund for Cybersecurity.
  4. It says the regulation implements the EU Cybersecurity Strategy of December 2020 and its European Cyber Shield, a federation of national and cross-border Security Operations Centres (SOCs), supported by the Digital Europe Programme (DEP).
  5. It notes the regulation re-allocates EUR 100 million from other DEP strategic objectives, bringing the total for cybersecurity actions under DEP to EUR 842.8 million, with the overall budget possibly reaching up to 1.109 billion euros including Member States contributions.
  6. The rapporteur welcomes the proposal and calls for a deeper understanding of transport cybersecurity needs and for transport critical entities to have access to funding for preparedness, response and incident solving.
  7. The rapporteur endorses the transport cybersecurity toolkit, aimed at cyber-awareness and cyber-hygiene for transport organisations of all sizes, covering air, rail, water, road and postal and courier services.
  8. The rapporteur says the Emergency Response Fund for Cybersecurity must be large enough to help Member States prepare for, respond to and recover from significant and large-scale incidents, and that support should also be available to Union institutions, bodies, offices and agencies.
  9. The committee proposes adding transport references to recitals on the threat landscape, including state-sponsored actors, cybercriminals and hacktivists, and on the need to protect transport operators and critical infrastructure.
  10. It proposes recitals on Russia's invasion of Ukraine increasing incidents such as distributed denial-of-service (DDoS) attacks on airports, railways and transport authorities, and on cyberattacks targeting all transport subsectors.
  11. It proposes that transport operators receive proper training and tools, that ENISA support be covered by the Union budget, and that ENISA receive additional financial and human resources and an amending budget.
  12. It proposes that the transport sector be prioritised for coordinated preparedness testing, that the European Cyber Shield cover cross-border transport infrastructure such as TEN-T and Intelligent Transport Systems, and that it enable cooperation with the cyber defence community and military mobility.

Who is affected

  • Transport operators and critical infrastructure managers, who would receive training, tools and priority in preparedness testing.
  • Air, rail, water, road and postal and courier services, named as sectors covered by the toolkit and amendments.
  • ENISA, which would receive additional financial and human resources and an amending budget.
  • Member States, which would receive support from the Emergency Response Fund for Cybersecurity for preparedness, response and recovery.

Figures and deadlines

  • 55%: share of incidents in the 2022 reporting period attributed to cybercriminals.
  • October 2024: deadline for Member States to transpose the NIS2 Directive.
  • EUR 100 million: amount re-allocated from other DEP strategic objectives.
  • EUR 842.8 million: new total available for cybersecurity actions under DEP.
  • 551 million: possible total for 2023-2027 from the main DEP and Cybersecurity DEP Work Programme.
  • 115 million: dedicated in the form of pilots for 2021-2022.
  • 1.109 billion euros: overall budget possible including Member States contributions.
  • 25%: increase in the monthly average number of reported incidents affecting the transport sector in 2022 compared to 2021.