paul@paulfoleylaw.ie
22 Northumberland Road, Dublin D04 ED73, Ireland, EU
© Copyright Paul Foley Law June 2024: All Rights Reserved. For advice and guidance as to how to comply with the EU Cybersecurity laws referred to below, please contact the firm at paul@paulfoleylaw.ie
The EU Cybersecurity laws framework comprises many pieces of legislation that cover cybersecurity from different angles (products, services, crisis management, and crimes).
In 2013, Directive 2013/40/EU (on attacks against information systems) which harmonised criminalisation and penalties for a number of offences directed against information systems, came into force.
In 2019, Regulation (EU) 2019/881 (EU Cybersecurity Act) entered into force. It aims to enhance the security of ICT products, ICT services and ICT processes by introducing a voluntary European cybersecurity certification framework.
Directive (EU) 2022/2555 (NIS2) is in force. Key provisions are described below. It is much wider in scope and more prescriptive than Directive (EU) 2016/1148 (NIS1) which is repealed as of 18.10.2024. Member States have until 17th of October 2024 to adopt and publish the measures necessary to comply with NIS2.
DORA is in force. Member States have to publish the necessary implementing legislation by the 17th of January 2025. DORA is accompanied by Directive (EU) 2022/2556 (Dora Directive) which also applies from 17th of January 2025. As the Central Bank of Ireland, have stated, regulated financial entities should recognise similarities between a number of key DORA requirements and existing Central Bank guidance in relation to Outsourcing, Operational Resilience and IT & Cybersecurity Risks as well as in existing sectoral guidelines.
The EU Cyber Resilience Act (EU CRA) imposes substantial obligations on economic operators (primarily manufacturers, importers, distributors) in respect of products with digital elements whose intended and reasonably foreseeable use, includes a direct or indirect logical or physical data connection to a device or network (in-scope products) (Art 3(1) and Art 2(1) of the CRA).
The EU CRA is expected to be finalised, adopted and come into force in 2024 and to apply 24 or 36 months from the date of its entry into force. However the EU CRA, Art 11 reporting obligations, concerning actively exploited vulnerabilities and incidents, are expected to apply 12 months from the entry into force of the EU CRA.
Two main objectives are identified: (1) create conditions for the development of secure products with digital elements by ensuring that hardware and software products are placed on the market with fewer vulnerabilities and ensure that manufacturers take security seriously throughout a product’s life cycle; and (2) create conditions allowing users to take cybersecurity into account when selecting and using products with digital elements.
The EU CRA as currently drafted will not apply to the following:
This article as regards the EU CRA, focuses on manufacturers (Art 3(18)), on whom the most onerous obligations apply.
Amongst other obligations, manufacturers must when placing any in-scope product on the market:
Software bill of materials
Within Annex I section 2(1) of the EU CRA, is the manufacturer requirement to identify and document vulnerabilities and components contained in the in-scope product, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the in-scope product.
A software bill of materials, the CRA states, can provide those who manufacture, purchase, and operate software, with information that enhances their understanding of the supply chain. This has multiple benefits: most notably it helps manufacturers and users to track known newly emerged vulnerabilities and risks. It is of particular importance for manufacturers to ensure that their products do not contain vulnerable components developed by third parties.
As a consequence, the Commission may, by means of implementing acts, specify the format and elements of the software bill of materials set out in section 2(1), of Annex I. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 51(2) (Art 10 (15)).
Presumption of Conformity (Art 18)
In-scope products and processes put in place by the manufacturer:
Conformity assessment procedures for products with digital elements (Art 24)
The manufacturer must demonstrate conformity with essential requirements by using one of the following procedures:
For class 1 critical in-scope products (see under class 1 of Annex III for the listing), where broadly Article 18 or Article 19, cannot be applied, the in-scope product concerned and the processes put in place by the manufacturer, must be submitted by the manufacturer with regard to those essential requirements to either of the following procedures:
For class 2 critical in-scope products (see under class 2 of Annex III for the listing) the manufacturer must, demonstrate conformity with the essential requirements, by using one of the following procedures:
The Commission argue that the EU CRA will minimise the regulatory burden put on manufacturers by several product safety acts. The Commission also argue that compliance with the CRA requirements will facilitate compliance with the requirement of security of processing of personal data under Regulation (EU) 2016/679 (General Data Protection Regulation).
The review of NIS1 (Directive (EU) 2016/1148) evidenced a wide divergence in its implementation (it was implemented in significantly different ways) and there are also divergences in its supervision and enforcement. Hence the need for and adoption of NIS2.
This article focuses on private sector aspects of NIS2. NIS2 is in force and is much wider in scope and more prescriptive than NIS1 which is repealed as of 18.10.2024). Art 20 and Art 21 (referred to below), are particularly onerous. Member States have until 17th of October 2024 to adopt and publish the measures necessary to comply with NIS2.
Entities subject to NIS2 are classified as essential entities and important entities (see Art 3 and Annex 1 (sectors of highly criticality ) and Annex II (other critical sectors) of NIS2). All entities of the type listed in Annexes I and II that do not qualify as essential entities will be considered important entities (Article 3(2)).
essential and important entities have the same cybersecurity management and reporting requirements, but different enforcement and fines regimes apply to each.
Digital Infrastructure, ICT Service Management and Digital providers
DNS service providers, TLD name registries, entities providing domain name registration services, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers are all in scope. Additionally providers of online marketplaces, of online search engines or of social networking services platforms are also in scope.
Manufacture, production and distribution of chemicals
Undertakings carrying out the manufacture of substances and the distribution of substances or mixtures, as referred to in Article 3(9) and (14), of Regulation (EC) No 1907/2006 (REACH Regulation) and undertakings carrying out the production of articles, as defined in Article 3(3), of that Regulation, from substances or mixtures, are in scope.
Health
Entities manufacturing medical devices considered to be critical during a public health emergency (public health emergency critical devices list) within the meaning of Article 22 of Regulation (EU) 2022/123 are in scope.
Transport: Air transport
Air carriers as defined in Article 3(4) of Regulation (EC) No 300/2008 (on common rules in the field of civil aviation security) used for commercial purposes are in scope.
Art 3 entities in scope
qualified trust service providers regardless of their size.
providers of public electronic communications networks or of publicly available electronic communications services which qualify as medium-sized enterprises.
Management bodies of essential and important entities must approve their Art 21 cybersecurity risk-management measures and oversee their implementation. Management bodies can be held liable for infringements by the entities of the Art 21 obligations (Art 20(1)).
Members of the management bodies of essential and important entities are required to follow training, and must offer similar training to their employees on a regular basis. The reason is so they gain sufficient knowledge and skills to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity (Art 20(2)).
Art 21 measures (just below) (as regards compliance with) will require detailed legal review.
essential and important entities must take technical, operational and organisational measures to manage the risks posed to the security of network and information systems which they use for their operations or for the provision of their services (Art 21(1)).
The measures must include at least the following:
essential and or important entities must submit to the CSIRT (as defined) or, where applicable, the competent authority:
early warning
without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning, which, where applicable, must indicate whether the significant incident is suspected of being caused by: (a) unlawful or malicious acts; or (b) could have a cross-border impact;
incident notification
without undue delay and in any event within 72 hours of becoming aware of the significant incident, an incident notification, which, where applicable, must update the information referred to just above ( ie the early warning) and indicate:
Intermediate report
on the request of the CSIRT or, where relevant, the competent authority, an intermediate report on relevant status updates;
Final report
a final report not later than one month after the submission of the incident notification referred to just above including the following:
Trust service provider exception
By way of derogation, a trust service provider must, with regard to significant incidents that have an impact on the provision of its trust services, notify the CSIRT or, where applicable, the competent authority, without undue delay and in any event within 24 hours of becoming aware of the significant incident (Art 23(4) last paragraph).
DNS service providers, TLD name registries, entities providing domain name registration services, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, as well as providers of online marketplaces, of online search engines or of social networking services platforms, not established in the Union, but which offer services within the Union, must designate a representative in the Union (Art 26(3)).
The representative must be established in one of those Member States where the services are offered (Art 26(3)).
ENISA must create and maintain a registry of digital infrastructure, ICT service management and digital providers (Art 27(1)).
The Art 27(1) entities will be required to submit the following information to the competent authorities by 17 January 2025:
The Article 27(1) entities will be required to notify the competent authority about any changes to the information they submitted under Art 27(2) without delay and in any event within three months of the date of the change (Art 27(3)).
The supervision and enforcement powers under NIS2 for competent authorities differ between essential entities ( set out in Art 32) and important entities (set out in Art 33).
For example under Art 32(5), Member States must ensure that their competent authorities have the power to:
Another example is provided by Art 34(4), which requires that infringements by essential entities of the obligations in Articles 21 or 23 are subject to administrative fines of a maximum of at least €10 million or 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher.
Under Art 34(5), in relation to fines, member states must ensure that infringements by important entities of the obligations laid down in Art 21 or Art 23 are subject to administrative fines of a maximum of at least EUR 7 million or 1.4% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the important entity belongs, whichever is higher.
There are additional obligations imposed on TLD name registries and entities providing domain name registration services in Art 28 (not reproduced here).
In 2019, as stated above, the EU Cybersecurity Act (Act) entered into force. Amongst other things, it aims to enhance the security of ICT products, ICT services and ICT processes by introducing a voluntary European cybersecurity certification framework.
Finally, on 18 April 2023, the European Commission adopted a proposal for a Regulation amending the Act as regards managed security services. The proposal aims to avoid fragmentation of the internal market, by enabling the adoption of European cybersecurity certification schemes for managed security services. There is a concrete risk the Commission argue, of fragmentation of the internal market for these services, which the present proposal aims to address.
Copyright Notice: No text or data mining, or web scraping
Our website: www.paulfoleylaw.ie
