Understanding EU Cybersecurity: History, Regulations, and Certifications
According to a recent study by Cloudflare focused on cybersecurity in Europe, 40% of organizations experienced a cybersecurity incident in the last 12 months and 84% of that group reported that the frequency of these events has increased over the same period.
Most also expect this trend to continue. 64% of surveyed European business leaders said they expect a cybersecurity incident in the next 12 months, and only 29% feel highly prepared to defend against them.
Since individuals, businesses, and public institutions across the EU are increasingly subject to and impacted by cyber attacks, cybersecurity is a key agenda item for the EU. Below we’ll briefly cover the history of cybersecurity regulation in the EU as well as the latest laws that have been passed.
A brief history of cybersecurity regulation in the EU
The EU began formalizing its approach to cybersecurity in the early 2000s with the recognition of the growing importance of digital infrastructure. Early initiatives focused on awareness and foundational security principles. However, the last decade has witnessed a surge in regulations, reflecting the increasing sophistication and frequency of cyberattacks.
Major milestones in EU cybersecurity include:
- 2004: Establishment of the European Network and Information Security Agency (ENISA) to provide expertise and support for EU Member States.
- 2013: Introduction of the EU Cybersecurity Strategy, which set the groundwork for pan-European cooperation on cyber defense.
- 2016: Adoption of the Network and Information Security (NIS) Directive, the first EU-wide legislation on cybersecurity, and the General Data Protection Regulation (GDPR), a landmark data privacy and security law.
- 2017: Establishment of the Trusted Information Security Assessment Exchange (TISAX), a globally recognized information security assessment for the automotive industry.
- 2019: Adoption of the EU Cybersecurity Act (CSA), which created an EU-wide cybersecurity certification framework for ICT products, services, and processes and made ENISA a permanent EU agency for cybersecurity.
- 2021: Agreement reached on new cybersecurity directives and acts, including the NIS2 Directive and Digital Operational Resilience Act (DORA), to further improve the resilience and incident response capacities of EU entities, including financial entities, and the EU as a whole.
- 2022: Adoption of NIS2, a revision of the original NIS Directive that aims to harmonize cybersecurity requirements and implementation of cybersecurity measures in different Member States.
- 2024: Adoption of the Cyber Resilience Act, a new law on cybersecurity requirements for products with digital components, such as IoT products, to ensure they are safe before being placed on the market.
Recommended reading
Cybersecurity Explained: What It Is & 13 Reasons Cybersecurity is Important
Cybersecurity regulations and initiatives in the EU
The European commission, working with governments and the private sector, has presented and adopted regulations, strategies, and other measures to strengthen cybersecurity. Let’s take a look at some of the most important regulatory developments and initiatives in the EU.
EU Cybersecurity Strategy
The EU Cybersecurity Strategy was introduced in 2013 and updated in 2020 to address new challenges. It aims to create a secure and trusted digital environment, foster resilience to cyber threats, and promote collaboration across Member States.
Key highlights include:
- Aims to strengthen cybersecurity coordination between EU countries and also international partners
- Focus on improving cybersecurity and response capabilities for essential services and critical infrastructure
- Another key aim is to achieve strategic autonomy to strengthen the EU's digital leadership
EU Cybersecurity Act (CSA)
In addition to upgrading ENISA to a permanent EU agency for cybersecurity, CSA also launched an EU-wide cybersecurity certification framework for ICT products, services, and processes. For most businesses, certification is optional. But businesses that choose to certify their ICT offerings can attain a recognised certificate that holds validity across the EU, which will help businesses expand across borders and build trust with users.
Key highlights include:
- Introduces a system of EU-wide certification schemes
- Certification is voluntary unless otherwise specified in EU law or Member States' law
- Strengthens ENISA by making it a permanent EU agency for cybersecurity and giving it new tasks
Digital Operational Resilience Act (DORA)
DORA is designed to ensure the operational resilience of EU financial entities against cyber threats. It mandates stringent requirements for risk management, incident reporting, operational resilience testing, and third-party risk monitoring,
Key highlights:
- Applies to financial entities, including banks, investment firms, and insurance companies
- Aims to improve the digital operational resilience of the EU's financial sector
- Introduces oversight mechanisms for critical ICT providers
General Data Protection Regulation (GDPR)
GPDR is designed to protect the personal data and privacy of EU residents. It is widely considered the most significant data privacy laws in recent history, with major implications for how companies can handle European Union residents’ personal data.
Key highlights include:
- While GDPR is EU law, it applies to any organization that processes the personal data of EU residents or offers goods and/or services to EU residents
- Harsh penalties for GDPR violations, with fines reaching the tens of millions of euros
- Inspired similar data privacy laws around the world, most notably the California Consumer Privacy Act (CCPA)
NIS2 Directive
The NIS2 Directive, replacing the original NIS Directive, expands the scope of cybersecurity requirements for essential and important entities, imposing stricter obligations and enforcing tougher penalties for noncompliance. It aims to harmonize cybersecurity practices across the EU, improve incident reporting, and enhance supply chain security.
Key highlights include:
- Broader coverage of sectors, including transport, financial market infrastructures, digital infrastructure, pharma and medtech, chemical manufacturers, digital service providers, public administration, and managed service providers
- Mandates stricter incident reporting requirements, including that organizations must notify authorities of significant incidents within 24 hours of discovering them
- Heavy penalties for non-compliance, similar to GDPR
Cyber Resilience Act
The Cyber Resilience Act addresses the security of connected devices and software, aiming to minimize vulnerabilities. This regulation is especially relevant as IoT devices proliferate across sectors.
Key highlights include:
- Establishes comprehensive cybersecurity requirements for hardware and software products
- Helps consumers to take cybersecurity into account when selecting and using products with digital elements
- Mandates vulnerability handling requirements to improve cybersecurity throughout a product’s lifecycle
- Empowers market surveillance authorities to enforce penalties for non-compliance to encourage adherence
Trusted Information Security Assessment Exchange (TISAX)
Established in 2017 by the German Association of the Automotive Industry, TISAX provides a standardized approach to ensuring that organizations within the automotive supply chain meet stringent information security requirements.
Key highlights include:
- A globally recognized information security assessment designed specifically for the automotive sector
- Uses a maturity model with three assessment levels with varying information security requirements, depending on the sensitivity of the data and the role the organization plays within the automotive supply chain
- Any organization that works with a European automotive company and deals with sensitive information could be asked to comply, even if based outside of EU
Recommended reading
10 Common Cybersecurity Frameworks: Choosing the Right One for Your Clients
EU cybersecurity organizations
Below are the key players in EU cybersecurity regulation and enforcement.
European Commission
The European Commission has increasingly stepped up its efforts and investment in cybersecurity, starting with the adoption of the EU Cybersecurity Strategy in 2013. Since then, it has adopted a set of legislative proposals around cybersecurity, earmarked hundreds of millions of euros for research and innovation in cybersecurity projects, and fostered cooperation within the EU and with partners on the global stage to strengthen cyber resilience.
European Union Agency for Cybersecurity (ENISA)
ENISA was established in 2004 and reformed under the EU Cybersecurity Act in 2019. As the EU agency for cybersecurity, it is responsible for contributing to EU cyber policy, enhancing the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperating with Member States and EU bodies, and more.
Here’s a look at some of its key roles:
- Developing guidelines and best practices for cybersecurity
- Facilitating cooperation among Member States and industry stakeholders
- Supporting incident response efforts through expert guidance and tools
- Managing the EU Cybersecurity Certification Framework for ICT products and services
Computer Emergency Response Team (CERT-EU)
Established in 2017, the CERT-EU is a permanent inter-institutional arrangement covering all the EU's institutions, bodies, and agencies. Designed to ensure a coordinated EU response to cyber attacks against its institutions, this arrangement marked an important step in strengthening the cooperation of EU institutions in the fight against cyber attacks.
The Europol’s Cybercrime Centre (EC3)
Set up by Europol, EC3 is designed to strengthen the law enforcement response to cybercrime in the EU in order to help protect European citizens, businesses, and governments, particularly against cyber-dependent crime, child sexual exploitation, and payment fraud.
Recommended reading
How to Build a Resilient Cyber Incident Response Plan: Challenges & Best Practices
EU cybersecurity certification
Cybersecurity certification has been developed at the EU level in order to enable product vendors and service providers to demonstrate and consumers to recognize the level of cybersecurity of ICT solutions across the EU.
The EU introduced the EU Cybersecurity Certification Framework under the 2019 EU Cybersecurity Act. This framework establishes a unified approach to certifying the cybersecurity of IT products, services, and processes across Member States.
Certifications under this framework are categorized into three assurance levels (Basic, Substantial, High). These are commensurate with the level of risk associated with the intended use of the product, service, or process, in terms of probability and impact of an accident.
ENISA is responsible for developing EU certification schemes within the EU Cybersecurity Certification Framework. ENISA has developed or is exploring several schemes, including:
- The European Cybersecurity Certification Scheme on Common Criteria targeting ICT products
- The European Certification Scheme for Cloud Services
- The European Cybersecurity Certification Scheme for 5G
- Preparatory work on the topics of AI and Managed Security Services
These certifications aim to build trust in digital products and services, foster market transparency, and promote secure innovation across the EU and beyond.
Recommended reading
Essential insights for companies on international cybersecurity compliance
Cybersecurity in the EU vs US
The approaches to cybersecurity in the EU and the US differ significantly, shaped by each region's legal, cultural, and technological priorities. Understanding these contrasts is essential for businesses operating globally, as compliance strategies must adapt to regional requirements. Let’s take a look at three major differences below.
Prescriptive vs market-driven
The EU is known for its prescriptive regulatory approach, which aims to safeguard citizens' privacy and security. Regulations like the NIS2 Directive set stringent requirements for cybersecurity, with penalties designed to enforce compliance across all Member States. This approach ensures a common level of cybersecurity across Europe.
In contrast, the US adopts a market-driven approach, allowing industries to self-regulate unless federal or state laws intervene. While cybersecurity frameworks like SOC 2 and NIST CSF exist, they tend to be more flexible, narrow in scope, and driven by customer demand rather than regulatory mandate. This approach results in varying levels of cybersecurity across different sectors and states.
Proactive vs reactive
The EU is also more proactive in regulating sectors and technologies. When it comes to emerging technologies like AI, for example, the EU has introduced the AI Act, aiming to regulate high-risk applications. In contrast, the US is cautious about early regulation, fearing it might stifle innovation.
Standardization vs fragmentation
As mentioned above, the EU has adopted various directives and regulations to bolster cybersecurity across the EU and critical infrastructure sectors in particular. However, each directive and regulation aims to build off and harmonize existing ones where possible in order to strengthen the collective cybersecurity level of Member States. For example, the NIS2 Directive mandates cybersecurity requirements across 15 sectors. GDPR establishes data privacy and security laws for the European Economic Area, which includes all EU countries plus Iceland, Liechtenstein, and Norway.
In contrast, the U.S. lacks a similar unified regulatory framework, relying primarily on regulations that vary from state to state or sector to sector. Organizations are therefore challenged with regulatory fragmentation, with federal, state, and industry-specific rules creating complexity. A single company might need to comply with CCPA in California, HIPAA for healthcare, and NIST 800-53 for government contracts, leading to a higher operational burden and costs related to compliance management.
As a result of the region’s differing regulatory approaches, companies expanding into the EU or US face challenges adapting to cybersecurity regulations and customer expectations. Understanding these differences is an important first step organizations can take in tailoring their cybersecurity strategies to meet the requirements of both regions, ensuring compliance, operational efficiency, and customer trust.
Compliance automation can also help reduce the complexity, cost, and time it takes to comply with multiple regulations and frameworks.
Recommended reading
How UK-based Arbor Education Streamlined Multi-Framework Compliance with Secureframe
How Secureframe can help simplify EU cybersecurity and compliance
The EU's proactive approach to cybersecurity underscores the importance of safeguarding its digital ecosystem. With evolving regulations like the NIS2 Directive, DORA, and the Cyber Resilience Act, organizations based in the EU or hoping to move into that market must stay ahead to achieve and maintain compliance and improve their cyber resilience.
Secureframe simplifies this process, offering tailored solutions to navigate the complexities of EU cybersecurity and ensure businesses are both secure and compliant, including:
- Automated compliance management: Secureframe simplifies adherence to regulations like NIS2 and DORA with automated workflows for evidence collection, risk assessments, policy management, continuous monitoring, and more.
- Comprehensive framework support: Secureframe supports 40+ regulatory and security standards out of the box, including ISO 27001, NIS2, DORA, Cyber Essentials, TISAX, and GDPR — more than any other solution on the market.
- Automated control testing: Secureframe automates the testing of EU cybersecurity framework requirements through integrations with your existing tech stack, ensuring continuous compliance without the manual burden.
- Policies developed by experts: Secureframe offers policies and procedure templates, developed and vetted by compliance experts for NIS2, DORA, and other EU-specific frameworks. You can easily publish this documentation, assign them to owners, and track policy acceptance and regular review within Secureframe.
- European Data Center: Secureframe customers in Europe have the flexibility to choose where their data is stored and processed so they can further ensure data privacy of their customers, and easily achieve and maintain compliance with privacy standards like GDPR.
- Expert and EU-based support: Our team of compliance managers and former auditors provide essential support to help you navigate EU cybersecurity requirements effectively and implement best practices to enhance your cybersecurity posture. We also have a dedicated support team in the EU to ensure that you receive timely and localized assistance.
For more information on how Secureframe can help you navigate the complexities of EU cybersecurity regulations, request a demo.
Recommended reading
How rready Achieved ISO 27001 Certification 5x Faster and Expanded in a Competitive Global Market with Secureframe
FAQs
Can non-EU companies be affected by EU cybersecurity laws?
Yes, non-EU companies offering services within the EU or managing data of EU citizens must comply with relevant regulations like NIS2 and the Cyber Resilience Act.
What are the penalties for non-compliance with EU cybersecurity laws?
Penalties vary by regulation but can be substantial. For example, fines under NIS2 can reach up to €10 million or 2% of global turnover, whichever is higher, for essential entities and up to €7 million or 1.4% of the company’s total global annual turnover, whichever is higher, for important entities. The most serious GDPR violations can result in fines of up to 20 million euros, or 4% of the company’s global annual revenue from the previous financial year, whichever is higher.
What is the brief history of GDPR?
The EU passed the European Data Protection Directive in 1995 to establish some baseline data privacy and information security standards as the internet became more prominent. Each EU member state implemented its own law based on those guidelines. In the next couple decades as the internet matured, the EU recognized the need for a more comprehensive regulation that would harmonize data protection laws across the EU and passed the GDPR to replace the DPR.
What sectors are covered under the NIS2 Directive?
NIS2 applies to both essential and important sectors, including healthcare, energy, finance, water supply, transport, space, digital infrastructure, public administration, postal services, waste management, chemicals, research, foods, manufacturing, and digital providers.
How does DORA differ from other EU cybersecurity regulations?
DORA specifically targets financial entities, focusing on operational resilience and third-party risk management, while other regulations have broader applicability across sectors.
What are the TISAX assessment levels?
Below is a brief overview of TISAX’s three assessment levels and requirements:
- Level 1 is for organizations that deal with non-sensitive data or only need to demonstrate a basic level of information security through self-assessments.
- Level 2 is for organizations that handle moderately sensitive information, such as non-critical project details or limited personal data, and whose business partners require some level of external verification.
- Level 3 is for organizations that deal with highly sensitive information, such as vehicle prototypes, critical systems data, or large amounts of personal data and need to provide the highest assurance to business partners. It is often mandated by major automotive manufacturers.
Is ENISA involved in cyber incident response?
Yes, ENISA is involved in cyber incident response at EU level. Most notably, it supports the prevention, detection, and resolution of incidents through a network of Computer Security Incident Response Teams (CSIRTs) known as the EU CSIRTs Network. This network is designed to increase cross-border collaboration and enhance and improve incident response capabilities and readiness across the EU. ENISA is also responsible for providing guidance, recommendations, and tools to collaborate and respond to large scale incidents and crises.