Report on the evaluation of the European Union Agency for Network and Information Security (ENISA)

The European Union Agency for Network and Information Security (ENISA) was originally established in 2004. ENISA's current mandate as set out in Regulation (EU) 526/2013 is to contribute to a high level of network and information security within the Union, and is due to expire on 19 June 2020. Article 32 of the ENISA Regulation requires the Commission to undertake an evaluation of ENISA by 20 June 2018 to assess the impact, effectiveness and efficiency of the Agency and its working practices and to consider whether the current mandate needs to be extended.

In light of the significant changes that have occurred in the cybersecurity landscape since 2013, when the current ENISA Regulation was adopted, the Commission announced in 2016 that it would advance the evaluation and review of ENISA. In particular, the Commission noted that the review would provide an opportunity for a possible enhancement of the Agency’s capabilities and capacities to support Member States in a sustainable manner in achieving cybersecurity resilience.

The results of the evaluation of ENISA fed into the impact assessment accompanying the Proposal for a Regulation on ENISA (the EU Cybersecurity Agency) and on Information and Communication Technology cybersecurity certification (Cybersecurity Act), also published on 13 September 2017.