For a better user experience please update your browser or use Chrome or Firefox browser.
Utilities
Publication detail
HomeStudy to support the evaluation of the European Union Agency for Cybersecurity (ENISA) and the European Cybersecurity Certification Framework
Final report
Publication metadata
This study presents the results of an external evaluation of the European Union Agency for Cybersecurity (ENISA) and the European Cybersecurity Certification Framework (ECCF). The evaluation assessed the performance of ENISA and the ECCF in relation to their objectives and tasks as set out in Regulation (EU) 2019/881. Covering the 2017-2023 period, the evaluation analysed the following criteria: effectiveness, efficiency, relevance, coherence and EU added value, as well as the Agency’s internal practices and organisation. Evidence was gathered through a mixed-methods stakeholder consultation and analysis of multiple data sources, such as interviews, surveys, internal documents, the public consultation, and workshops. The results show that during the evaluation period, ENISA and the ECCF carried out most of the tasks assigned to them by the legal framework, with greater reservations in the case of the ECCF. ENISA’s outputs supported the work of the Commission and the Member States in the field of cybersecurity largely met the needs of ENISA’s other stakeholders, such as EU institutions and industry. The Agency became a centre of expertise in the field of cybersecurity and a key body for the engagement of different stakeholders in cybersecurity issues. The ECCF constituted the first effort of building a comprehensive framework for cybersecurity certification at European level. While it brought together relevant stakeholders (i.e. national authorities, EU institutions, bodies and agencies, industry, standardisation organisations and subject matter experts) in a systematic manner, the ECCF showed slow progress in adopting European cybersecurity certification schemes. This led the framework to partially meet its objectives, particularly in relation to enhancement of the cybersecurity of the internal market. The evaluation identified a number of lessons. They focus on the careful calibration and expansion of the Agency’s mandate, supported by options to improve human and financial resources, as well as improving ENISA’s practices of stakeholder engagement and support to policy development and implementation. The evaluation also suggested that the ECCF could clarify its scope, especially in relation to non-technical threats, streamline scheme development and adoption processes and reassess stakeholders’ roles within the Framework, including for scheme implementation and maintenance. Additionally, aligning these efforts with upcoming cybersecurity and sectorial EU legislation, especially with the Cyber Resilience Act (CRA) and the Cyber Solidarity Act (CSoA), is crucial.
- Published:
- Corporate author(s): Directorate-General for Communications Networks, Content and Technology (European Commission)
- Themes: Activities of the institutions and bodies , Information technology and telecommunications
- Subject: computer crime , data protection , digital technology , European cooperation , European security , European Union Agency for Cybersecurity , information network , information security , information technology , operation of the Institutions , standardisation
|
PDF
|
|||
| ISSN | ISBN 978-92-68-35031-7 | DOI 10.2759/7122638 | Catalogue number KK-01-26-003-EN-N |
- Released on EU publications website:
Document viewer
Note:
The publication cannot be displayed in the document viewer. Open web version
You may access it from: Download and languages