On the proposal for a regulation of the European Parliament and of the Council on Measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cybersecurity threats and incidents
TRAN-PA-752607
Committee on Transport and Tourism · Rapporteur: Gheorghe Falcă
Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.
This is the draft opinion of the Committee on Transport and Tourism on the proposed regulation on strengthening EU solidarity and capacities against cybersecurity threats. The rapporteur welcomes the proposal and calls for a deeper understanding of transport cybersecurity needs and for funding for transport critical entities.¶ The rapporteur endorses the 'transport cybersecurity toolkit' for cyber-awareness and cyber-hygiene, aimed at transport organisations of all sizes and at transport critical infrastructure and military mobility.¶ The rapporteur says the Emergency Response Fund for Cybersecurity must be large enough to help Member States prepare for, respond to and recover from major incidents, and that support should also go to Union institutions, bodies, offices and agencies.¶ The draft notes the European Cyber Shield will improve Member States' threat detection and the Cyber Emergency Mechanism will complement their actions through emergency support for preparedness, response and recovery of essential services.¶
Committee position. The rapporteur welcomes the proposal, endorses the transport cybersecurity toolkit, and calls for a deeper understanding of transport cybersecurity needs, funding for transport critical entities, and a sufficiently large Emergency Response Fund for Cybersecurity.¶¶¶
Key points
- The rapporteur notes that organisations hit by cyberattacks, especially private companies, rarely report them, and that the NIS2 Directive harmonises incident reporting obligations across Member States.¶
- The rapporteur cites an ENISA report finding cybercriminals caused more than half of transport incidents in the 2022 reporting period (55%), mostly for financial gain, and that most attacks target IT systems, causing operational disruptions.¶
- The rapporteur notes limited Union-level support and solidarity between Member States on preparedness and response, and that the Council Conclusions of May 2022 called for a proposal on a new Emergency Response Fund for Cybersecurity.¶
- The rapporteur states the regulation implements the EU Cybersecurity Strategy of December 2020 and its European Cyber Shield, a federation of national and cross-border Security Operations Centres, supported by Digital Europe Programme funding.¶
- The rapporteur notes the regulation re-allocates EUR 100 million from other Digital Europe Programme objectives, bringing the total for cybersecurity actions under the programme to EUR 842.8 million.¶
- The rapporteur says part of the additional EUR 100 million reinforces the budget managed by the European Cybersecurity Competence Centre for Security Operations Centres and preparedness, and supports the EU Cybersecurity Reserve.¶
- The rapporteur welcomes the proposal as offering significant benefits to stakeholders and underlines the need for a deeper understanding of transport cybersecurity needs and for funding for transport critical entities.¶
- The rapporteur endorses the 'transport cybersecurity toolkit' for cyber-awareness and cyber-hygiene, addressing transport organisations of all sizes and domains, and taking into account transport critical infrastructure and military mobility, particularly regarding the war in Ukraine.¶
- The toolkit covers air carriers, airports, air traffic management and control, the European Union Aviation Safety Agency and Eurocontrol; infrastructure managers, railway undertakings and the European Rail Traffic Management System.¶¶
- The toolkit also covers inland, sea and coastal passenger and freight water transport, port managing bodies and facilities, vessel traffic service operators, road authorities for traffic management, Intelligent Transport Systems operators, and postal and courier services.¶¶¶
- The rapporteur says the size of the Emergency Response Fund for Cybersecurity budget will determine its success, so it should be large enough to support Member States in preparing for, responding to and recovering from significant and large-scale incidents.¶
- The rapporteur says support for incident response should also be available to Union institutions, bodies, offices and agencies, and that the Cyber Emergency Mechanism will complement Member States' actions for preparedness, response and immediate recovery of essential services.¶
Who is affected
- Transport organisations of all sizes and domains, which the transport cybersecurity toolkit addresses.¶
- Air, rail, water, road and postal transport operators and authorities, which the toolkit covers.¶¶¶
- Transport critical entities, which the rapporteur says need access to proper funding for preparedness, response and solving incidents.¶
- Member States, which the Emergency Response Fund for Cybersecurity should support in preparing for, responding to and recovering from major incidents.¶
- Union institutions, bodies, offices and agencies, which should also receive incident response support.
Figures and deadlines
- 55% — share of transport incidents in the 2022 reporting period attributed to cybercriminals.¶
- EUR 100 million — amount the regulation proposes to re-allocate from other Digital Europe Programme strategic objectives.¶
- EUR 842.8 million — new total available for cybersecurity actions under the Digital Europe Programme.
- 551 million — possible total for 2023-2027 from the main Digital Europe Programme and Cybersecurity work programme.¶
- 115 million — dedicated already as pilots for 2021-2022.
- 1.109 billion euros — overall budget possible including Member States contributions.
- October 2024 — deadline for Member States to transpose the NIS2 Directive.¶