EU moves towards collective cyber security regulation

The EU has agreed a new set of rules, marking the first step towards the union having a set of uniform cyber security rules. This week, the Network and Information Systems (NIS) directive won the support of most of the internal market committee. For it to come into effect it now needs to be passed by the EU council and parliament. Both have however voiced their support for the NIS. This outcome marks years of work and development, and will end a fragmented 28-body approach. Instead, member states will be obliged to implement mandatory data breach notifications and establish cyber attack response teams. The teams will handle incidents and threats, and liaise with their counterparts in other European countries. Critical operators in key fields including banking, energy, health and transport will be expected to fulfill security measures and notify the relevant authorities of any key cyber incidents. Only businesses that are identified as not running essential services will be exempt.

The European Union is one step closer to introducing uniform cyber security rules which would require all member states to implement mandatory data breach notifications and establish their own cyber attack response teams.

The EU currently has no common approach to cyber security or incident reporting.

However a new set of rules, known as the network and information systems (NIS) directive, has passed a major final hurdle by winning the endorsement of the vast majority of members of its internal market committee.

The rules now only need to be passed by the EU council and full parliament, both of which have already offered their in principle support to the scheme.

The European cyber regime has been many years in the making and will see all member states name all the organisations in their respective countries that qualify as “operators of essential services” to be subject to the new rules.

“Parliament has pushed hard for a harmonised identification of critical operators in energy, transport, health or banking fields, which will have to fulfil security measures and notify [authorities of] significant cyber incidents," said Andreas Schwab, the EU parliamentarian driving the reforms.

“Member states will also have to cooperate more on cybersecurity, which is even more important in light of the current security situation in Europe.”

The rules, including the mandatory data breach notifications, will not apply to businesses that are not identified as running essential services. However, the EU is also looking to add global internet giants, such as Amazon and Google, to the list of entities to be subject to the NIS directive.

Schwab insisted that the only real impact on these suppliers of digital services is that they will asked to keep the EU in the loop on any serious intrusions or targeted attacks.

“We only demand that they notify structured attacks to national authorities. And we don't talk here about every single incident, but only about a serious level of incidents that has to be reported. So the workload is quite small,” he said.

The governments of member states, however, will need to adopt a national NIS strategy and set up a computer security incident response team (CSIRT) to handle threats, incidents, and to liaise will their fellow teams in neighbouring countries.

One the NIS directive is passed, EU member states will have 21 months to add them to domestic legislation and another six months to come up with a list of their essential services operators.