View source for Cyber Solidarity Act/en

<languages/>
{{Infobox Rechtsakt (EU)|Typ=Verordnung|Jahr=2025|Nummer=38|Vertrag=EU|EWR=ja|Titel=Verordnung (EU) 2025/38 des Europäischen Parlaments und des Rates vom 19. Dezember 2024 über Maßnahmen zur Stärkung der Solidarität und der Kapazitäten in der Union für die Erkennung von, Vorsorge für und Bewältigung von Cyberbedrohungen und Sicherheitsvorfällen und zur Änderung der Verordnung (EU) 2021/694|Kurztitel=Cyber Solidarity Act|Bezeichnung=|Rechtsmaterie=Binnenmarkt, Cybersicherheit|Grundlage=AEUV, insbesondere {{Art.|173|AEUV|dejure|}}
 Para 3 and {{Art.|322|TFEU|dejure|}} Para 1 lit a|Reference=OJ L 2025/38, 1|Applicable=February 4, 2025|Valid=applicable}}

<span id="Einführung"></span>
== Introduction ==

Regulation (EU) 2025/38 (Cyber Solidarity Act)<ref>https://eur-lex.europa.eu/eli/reg/2025/38/oj</ref> is an EU initiative to detect, prepare for, and respond to significant and large-scale cybersecurity threats and attacks. The Act includes a European Cybersecurity Warning System, consisting of interconnected Security Operations Centers across the EU, and a comprehensive Cybersecurity Emergency Mechanism to improve the EU's cyber resilience.<ref>European Commission: The EU Cyber Solidarity Act https://digital-strategy.ec.europa.eu/en/policies/cyber-solidarity 08.08.2024</ref>

<span id="Anwendungsbereich"></span>
== Scope of Application ==

The Cyber Solidarity Act refers to Art. 6 Para 38 NIS II Directive (Art. 2 Para 4. CSA) as well as activities of entities in Annex I or II of the NIS2-RL, which are designated as critical or highly critical sectors. (Art. 2 Para 5. CSA)

A general reference to Art 3 NIS II-RL is not present, which means that the size-independent scope of application of the NIS2 II-RL is not covered in the basic concept. However, with regard to the use of support from the EU Cybersecurity Reserve, entities are mentioned again in Art. 14 Para 2 CSA. This systematically creates the legally questionable impression that the entities of Art. 3 NIS-II-RL are only covered by the CSA within this narrow framework and, for example, are not intended to participate in the Cybersecurity Shield.

<span id="Zentrale_Inhalte"></span>
== Core Content ==

<span id="Europäischer_Cybersicherheitsschild"></span>
=== European Cyber Shield ===

The European Cyber Shield consists of a pan-European infrastructure of National Security Operations Centers (National SOCs) and Cross-border Security Operations Centers (Cross-border SOCs). The SOCs are interconnected and form an EU-wide cybersecurity infrastructure.

<span id="Funktionsweise"></span>
==== Functionality ====

The European Cyber Shield operates as follows (Art 3 CSA):

Detection of cyber threats and incidents by the networked SOCs
 Analysis of collected data using AI and data analytics
 Issuance of cross-border warnings for identified threats
 Enabling faster and more efficient response to major cyber incidents by authorities and relevant entities
Obligations for data provision by entities or regulations of the relationship with the provisions of the GDPR are not recognizable. The decision of several institutions to share data on cyber threats is voluntary and trust-based. If Member States wish to benefit from the system, they must make the institutions concerned in this context as attractive as possible.

Obligations for data provision by entities or regulations of the relationship with the provisions of the GDPR are not recognizable. The decision of several institutions to share data on cyber threats is voluntary and trust-based. If Member States wish to benefit from the system, they must make the institutions concerned in this context as attractive as possible.

<span id="Prüfung_kritischer_Einrichtungen_auf_potenzielle_Schwachstellen"></span>
=== Assessment of Critical Entities for Potential Vulnerabilities ===

The coordinated readiness tests serve to identify potential vulnerabilities in critical infrastructures that could make them susceptible to cyber threats. The tests are conducted in a coordinated manner to assess the cybersecurity readiness of the selected entities. According to Art. 2 Para 9. in conjunction with Art 11 CSA, potential vulnerabilities are identified, responsiveness to cyber threats is tested, and potential for improvement is examined. Since no obligations for entities to cooperate are stipulated, participation in the tests by the tested entities is likely to be voluntary.

<span id="Synergien"></span>
== Synergies ==

<span id="Risikomanagement_in_der_Cybersicherheit"></span>
===== Cybersecurity Risk Management =====

=== CSA ===

 Strengthens the EU's ability to respond to major cyberattacks by promoting a network of national and cross-border Security Operations Centers (SOCs) and strengthening cooperation in cyber crises. Through the planned network of SOCs, threat data should be exchanged in real-time.

<span id="NIS2-RL"></span>
=== NIS2-D ===

 Requires organizations in critical sectors to implement robust cybersecurity measures to increase resilience against cyber threats.

'''Synergy'''
 The strengthened security infrastructure (e.g., through SOCs) supports companies and public institutions in better complying with the standards required under NIS-II RL, especially through early threat detection and information exchange.

<span id="Konsequenzen/Strafen"></span>
== Consequences/Penalties ==

The CSA contains no sanction mechanisms.

<span id="Weiterführende_Literatur"></span>
== Further Reading ==

<span id="Einzelnachweise"></span>
== Sources ==