NIS Directive and NIS Platform Trust and Security Unit DG Communications Networks, Content and Technology Jakub Boratynski Head of Unit 27.11.2014 Enisa Cyber Security Strategies Workshop

EU Cybersecurity Strategy: An Open, Safe and Secure Cyberspace Digital Agenda for Europe Cyber resilience - NIS Directive (capabilities, cooperation, risk management, incident reporting) - Raising awareness Justice and Home Affairs Reduce cybercrime EU Foreign and Security Policy Cyber defence policy and capabilities International cyberspace policy Industrial and technological resources: NIS platform; H2020 Fundamental rights apply both in physical and digital world Cybersecurity depends on and contributes to protecting fundamental rights Access for all Democratic and efficient multi-stakeholder governance Cybersecurity is a shared responsibility

Proposal for a Directive on NIS Key elements (1/3) Capabilities: Common NIS requirements at national level NIS strategy and cooperation plan NIS competent authority Computer Emergency Response Team (CERT)

NIS exercises at EU level ENISA to assist Proposal for a Directive on Network and Information Security (NIS) – Article 114 TFEU Key elements (2/3) Cooperation: NIS competent authorities to cooperate within a network at EU level Early warnings and coordinated response Capacity building NIS exercises at EU level ENISA to assist

Risk management and incident reporting for: Proposal for a Directive on Network and Information Security (NIS) – Article 114 TFEU Key elements (3/3) Risk management and incident reporting for: Energy – electricity, gas and oil Credit institutions and stock exchanges Transport – air, maritime, rail Healthcare Internet enablers Public administrations

State of play and achievements NIS Platform State of play and achievements

A key action of the EU Cybersecurity Strategy The NIS Public-Private Platform A key action of the EU Cybersecurity Strategy Identify and develop incentives to adopt good cybersecurity practices Promote the development and the adoption of secure ICT solutions Draw from working practices, incl. relevant standards Process-related and technoly-neutral Incentives for voluntary adoption Cross-cutting / horizontal approach Focus on SMEs

Working Groups and deliverables WG1: risk management Guidance document (04/2014) WG2: information sharing and incident notification WG3 on secure ICT research and innovation Stakeholder views for H2020 WP 2016 and beyond Business cases and innovation (Q4 2014) Education and training (Q2 2015) Work ongoing 2014-2015 to deepen first set of guidance

An inclusive and multi-stakeholder platform Participants An inclusive and multi-stakeholder platform Driven by the participants More than 200 participants 18 MS + Norway: ministries, NIS agencies, NRAs, CERTs Research & academia Industry: ICT, finance, post, transport, healthcare, defence, energy, water sectors

Thank you for your attention NIS Platform Documents: Questions? CNECT-NIS@ec.europa.eu NIS Platform Documents: https://resilience.enisa.europa.eu/nis-platform The following minimum conditions shall apply: (a) at least three legal entities shall participate in an action; (b) three legal entities shall each be established in a different Member State or associated country; and (c) the three legal entities referred to in point (b) shall be independent of each other within the meaning of Article 8. (a) any legal entity established in a Member State or associated country, or created under Union law; (b) any international European interest organisation; (c) any legal entity established in a third country identified in the work programme. The proposals submitted shall be evaluated on the basis of the following award criteria: (a) excellence; (b) impact; (c) quality and efficiency of the implementation. In cases where the requested funding from the Union for the action is equal or superior to EUR 500 000, the Commission or the relevant funding body shall, by means compatible with national law, verify in advance the financial capacity of only the coordinators. Furthermore, whenever there are grounds to doubt the financial capacity of the coordinator or other participants on the basis of available information, the Commission or the relevant funding body shall verify their financial capacity. 10