The European Commission has published a proposed directive on network and information security (NIS) as a key component of a new EU Cybersecurity plan. As proposed, the NIS Directive would require all member states, key internet enablers and critical infrastructure operators (e-commerce platforms, social networks, operators in energy, transport, banking and healthcare) to ensure a secure and trustworthy digital environment throughout the EU.
The directive’s measures include member states adopting an NIS strategy, designating a competent national authority, creating a cooperation mechanism among member states and the commission to share incident and risk information, and requiring businesses and public administrations to adopt risk management practices and report major security incidents.
European telecom operators’ association ETNO welcomed the extension of security requirements to all internet enablers and setting minium security requirement and reporting procedures beyond the e-communications sectors. “As e-communications services and network providers are increasingly competiting with new players from outside the telecoms sector and often outside the EU, it is important that all actors of the ICT value chain, independently of their geographical location, offering the same services are subject to the same requirements, to avoid a competitive disadvantage for EU players and to guarantee a consistent consumer experience”.
The EU Cybersecurity plan drafted by the EC home and foreign affairs directorates sets out five priorities: achieving cyber resilience, drastically reducing cybercrime, developing cyber defence policy and capabilities related to the Common Security and Defence Policy (CSDP), developing the industrial and technological resources for cyber-security, and establishing a coherent international cyberspace policy for the European Union and promoting core EU values.
EC vice president Catherine Ashton said: "For cyberspace to remain open and free, the same norms, principles and values that the EU upholds offline, should also apply online. Fundamental rights, democracy and the rule of law need to be protected in cyberspace. The EU works with its international partners as well as civil society and the private sector to promote these rights globally”.
