The European Union Agency for Network and Information Security (ENISA)

This briefing is one in a series of 'Implementation Appraisals' on the operation of existing EU legislation in practice. Each such briefing focuses on a specific EU law which is likely to be amended or reviewed, as foreseen in the European Commission's Annual Work Programme.

Implementation Appraisals aim to provide a succinct overview of material publicly available on the implementation, application and effectiveness of an EU law to date – drawing on available input from the EU institutions and external organisations. They are provided to assist parliamentary committees in their consideration of the new proposals, once tabled.Information and communication technologies play an increasing role in modern-day life and in the creation of a digital society. To ensure further growth, significant investments in security are necessary. Cybersecurity is a growing concern for citizens, influencing their digital activity. It is also a significant cost for the economy. In 2015, the estimated worldwide economic impact of cyber-attacks reached US$500 billion. The cybersecurity market in Europe was estimated at €20.1 billion.

The European Union Agency for Network and Information Security (ENISA) was established to support the EU and the Member States in enhancing and strengthening their ability to prevent, detect and respond to network and information security (NIS) problems and incidents. ENISA is part of the broader legal and policy environment, which includes the EU cybersecurity strategy and the recently adopted directive on security of networks and information systems across the EU.

By September 2017, the European Commission would review the mandate of ENISA to define its role in the changed cybersecurity ecosystem, including aligning it to the requirements of the NIS Directive, based on the recent public consultation and results of the ongoing evaluation 'Communication on the Mid-Term Review on the implementation of the Digital Single Market Strategy. A Connected Digital Single Market for All (COM (2017) 228).

ENISA operates under Regulation(EU) No.526/2013 until June 2020. In view of the current cybersecurity environment, the European Commission intended to present a new proposal by the end of 2017.

EP: EPRS: Briefing: Implementation Appraisal: Ex-ante Impact Assessment http://www.europarl.europa.eu/thinktank/en/search.html?policyAreas=EXIMAS

ESO: Key Source: European Network and Information Security Agency (ENISA) http://www.europeansources.info/record/european-network-and-information-security-agency-enisa/

ESO: Background information: Wannacry Ransomware: recent cyber-attack http://www.europeansources.info/record/wannacry-ransomware-recent-cyber-attack/

---