Cybersecurity

Legal Acts

• Network and Information Security Directive (NIS2-RL)
• Critical Entities‘ Resilience Directive (CER-RL)
• Digital Operational Resilience Act (DORA)
• Cyber Resilience Act (CRA)
• Cyber Solidarity Act
• Cyber Security Act (CSA)

Background and Overview

General

Cybersecurity refers to practices for the protection of digital systems, networks, and data from attacks, unauthorized access, and damage.

IT security: Focuses on the protection of information technology systems.

Information security: Encompasses the protection of all types of information, both digital and physical.

Network security: Focuses specifically on the protection of computer networks.

Data security: Aims to protect data from loss, manipulation, and unauthorized access.</ref>

As part of its cybersecurity strategy, the European Union (EU) aims to set standards to increase the level of cybersecurity in the EU. The EU's cybersecurity strategy is a key component of its efforts to make the digital transformation secure and resilient. It aims to increase resilience against cyber threats, ensure technological sovereignty, and strengthen cooperation both within the EU and with international partners. This strategy is closely linked with a series of legal acts that govern and implement specific aspects of cybersecurity. The strategy emphasises the importance of a coordinated approach by all member states as well as a high degree of technological independence. At the same time, international cooperation is fostered to develop global standards for a secure cyberspace.

The EU Cybersecurity Strategy pursues three main objectives:

The EU Cybersecurity Strategy pursues three main objectives:

She addresses the growing threat of cyberattacks, which are becoming increasingly complex and affect critical infrastructure as well as businesses and citizens. To meet these challenges, the EU relies on a combination of regulatory measures, investments in technology, and political cooperation. Essential legal acts in the context of the cybersecurity strategy:

NIS2 Directive (Network and Information Security Directive)

The NIS2 Directive forms the backbone of the EU cybersecurity strategy and aims to ensure a high common level of security for network and information systems across the EU. It replaces the original NIS Directive from 2016 and expands its scope to 18 critical sectors, including energy, healthcare, transport, and digital infrastructure. The directive requires member states to develop national cybersecurity strategies and enhance cooperation in responding to cross-border incidents. Companies in the affected sectors must implement strict risk management measures and report security incidents.

CER Directive (Critical Entities’ Resilience Directive)

This directive complements the NIS2 Directive by specifically focusing on the physical and digital resilience of critical infrastructures. It obliges member states to identify critical entities and ensure their protection against cyber and physical threats.

DORA (Digital Operational Resilience Act)

DORA richtet sich an den Finanzsektor und legt detaillierte Anforderungen an das IT-Risikomanagement fest. Ziel ist es, sicherzustellen, dass Finanzinstitute wie Banken oder Versicherungen auch bei schwerwiegenden Cybervorfällen funktionsfähig bleiben. Der Fokus liegt auf Belastungstests, Berichtspflichten und der Überwachung von Drittanbietern.

Cyber Resilience Act (CRA)

Der CRA zielt darauf ab, verbindliche Cybersicherheitsanforderungen für Produkte mit digitalen Elementen einzuführen. Hersteller sind verpflichtet, Sicherheitsaspekte während des gesamten Produktlebenszyklus zu berücksichtigen. Dies soll dazu beitragen, Schwachstellen in digitalen Produkten frühzeitig zu minimieren.

Cyber Solidarity Act

Dieser Rechtsakt stärkt die Zusammenarbeit zwischen den EU-Mitgliedstaaten bei der Bewältigung großer Cyberangriffe. Er sieht unter anderem einen Notfallmechanismus sowie ein Frühwarnsystem für Cybersicherheitsvorfälle vor.

Cyber Security Act (CSA)

Der CSA etablierte ein EU-weites Zertifizierungssystem für IKT-Produkte und stärkte das Mandat der Europäischen Agentur für Cybersicherheit (ENISA). Ziel ist es, einheitliche Standards für Cybersicherheit in der gesamten EU zu schaffen.

Einzelnachweise