(1)

Cybersecurity is essential to the success of the digital transformation of the economy and society. The EU is committed to unprecedented levels of investment in ensuring people, businesses and public authorities have confidence in digital tools.

(2)

The COVID-19 pandemic has increased the importance of connectivity and Europe’s reliance on stable network and information systems and showed the need to protect the whole supply chain. Reliable and secure network and information systems are particularly important for entities in the frontline of the fight against the pandemic, such as hospitals, medical agencies and vaccine manufacturers. Coordinating EU efforts to prevent, detect, discourage, deter, mitigate and respond to the most impactful cyber attacks against such entities could prevent the loss of life and attempts to undermine the EU’s ability to defeat the pandemic in the swiftest possible manner. Moreover, strengthening the EU’s ability to counter cyber-attacks effectively contributes to advancing a global, open, stable and secure cyberspace.

(3)

Faced with the cross-border nature of cybersecurity threats and the continuous surge of more complex, pervasive and targeted attacks (1), relevant cybersecurity institutions and actors should increase their ability to respond to such threats and attacks by harnessing existing resources and better coordinating efforts. All relevant actors in the EU need to be prepared to respond collectively and exchange information on a ‘need to share’, rather than ‘need to know’, basis.

(4)

Despite the major progress achieved through cooperation between Member States on cybersecurity, most notably through the Cooperation Group (‘NIS Cooperation Group’) and the Computer Security Incident Response Teams (CSIRTs) network set up under Directive (EU) 2016/1148 of the European Parliament and of the Council (2), there is still no common EU platform where information gathered in different cybersecurity communities can be exchanged efficiently and safely and where operational capabilities can be coordinated and mobilised by relevant actors. As a result, cyber threats and incidents risk being addressed in silos with limited efficiency and increased vulnerability. Furthermore, an EU-level channel for technical and operational cooperation with the private sector, both in terms of information sharing and incident response support, is missing.

(5)

Existing frameworks, structures and the resources and expertise available in Member States and relevant EU institutions, bodies and agencies provide a strong basis for a collective response to cybersecurity threats, incidents and crises (3). This existing architecture includes, on the operational side, the Blueprint for a Coordinated Response to Large Scale Cybersecurity Incidents and Crises (‘the Blueprint’) (4), the CSIRTs network and the European Cyber Crises Liaison Organisation (‘EU CyCLONe’) network (5), as well as the European Cybercrime Centre (‘EC3’) and the Joint Cybercrime Taskforce (‘J-CAT’) at the European Union Agency for Law Enforcement Cooperation (‘Europol’), and the EU Law Enforcement Emergency Response Protocol (‘EU LE ERP’). The NIS Cooperation Group, the EU Intelligence and Situation Centre (‘EU INTCEN’), and the Cyber Diplomacy Toolbox (6) and cyber defence-related projects launched under the Permanent Structured Cooperation (PESCO) (7) also contribute to policy and operational cooperation in different cybersecurity communities. The European Agency for Cybersecurity (‘ENISA’), by virtue of its reinforced mandate, is tasked with supporting operational cooperation (8) with regard to the cybersecurity of network and information systems, the users of such systems, and other persons affected by cyber threats and incidents. Through the Integrated Political Crisis Response (‘IPCR’) arrangements, the EU is able to coordinate its political response to major crises, including in the event of large-scale cyber attacks.

(6)

However, a mechanism for harnessing existing resources and providing mutual assistance across the cyber communities responsible for network and information systems security, for combating cybercrime, for conducting cyber-diplomacy, and, where appropriate, for cyber-defence in the event of a crisis does not yet exist. Nor is there a comprehensive mechanism at EU level for technical and operational cooperation in situational awareness, preparedness as well as response, between all communities. Moreover, synergies with the law enforcement and intelligence communities should be achieved respectively through Europol and INTCEN.

(7)

The Commission, the High Representative of the Union for Foreign Affairs and Security Policy (High Representative), Member States and relevant EU institutions, bodies and agencies recognise the importance of analysing the strengths, weaknesses, gaps and overlaps of the current EU cybersecurity architecture which has been created over recent years. In consultation with Member States, the Commission, with the involvement of the High Representative, has developed a concept for a Joint Cyber Unit as a response to this analysis and as an important component of the Security Union Strategy (9), the Digital Strategy (10) and the Cybersecurity Strategy (11).

(8)

In cases of crisis, Member States should be able to rely on EU solidarity in the form of coordinated assistance, including from all four cyber communities, i.e. civilian, law enforcement (12), diplomacy and, where appropriate, defence. The degree of intervention of participants from one or more communities may depend on the nature of a large-scale incident or crisis and, consequently, on the type of countermeasures that will be required to respond to it. When confronted with cyber threats, incidents and crises, well-trained experts and technical equipment represent essential assets that can contribute to avoid serious damage and bring effective recovery. Therefore, clearly identified technical and operational capabilities, primarily experts and equipment, ready to be deployed to Member States in case of need, will be at the centre of the Joint Cyber Unit. Within that platform, participants will be in a unique position to nurture and coordinate such capabilities through EU Cybersecurity Rapid Reaction teams, while ensuring appropriate synergies with the already existing Cyber projects conducted in the framework of PESCO.

(9)

The Joint Cyber Unit provides for a virtual and physical platform and does not require the creation of an additional, standalone body. Its set-up should not affect the competencies and powers of national cybersecurity authorities and relevant Union entities. The Joint Cyber Unit should be anchored in memoranda of understanding between its participants. It should build on, and add value to, existing structures, resources and capabilities as a platform for secure and rapid operational and technical cooperation between EU entities and Member State authorities. It should also bring together all cybersecurity communities, i.e. civilian, law enforcement, diplomacy and defence. Participants in the platform should have either an operational or supporting role. Operational participants should include ENISA, Europol, the Computer Emergency Response Team for the EU Institutions, bodies and agencies (‘CERT-EU’), the Commission, the European External Action Service (including INTCEN), the CSIRTs Network and EU-CyCLONe. Supporting participants should include the European Defence Agency (‘EDA’), the NIS Cooperation Group Chair, the Council Horizontal Working Party on Cyber Issues Chair, and one representative of the relevant PESCO projects (13). Since the Member States have operational capabilities and competences to respond to large-scale cyber threats, incidents and crises, the platform’s participants should primarily rely on their capacities, with the help of relevant Union entities, to achieve their objectives.

(10)

The Joint Cyber Unit should provide a new impetus to the process started in 2017 with the Blueprint. It should further operationalise the Blueprint architecture and mark a decisive step towards a European cybersecurity crisis management framework where threats and risks are identified, mitigated and responded to in a coordinated and timely manner. By taking such a step, the Joint Cyber Unit should help the EU respond to current and impending threats.

(11)

By participating in the Joint Cyber Unit, operational and supporting participants should be able to engage with a wider range of stakeholders as part of the EU Cybersecurity Crisis Response Framework. While exercising their functions within the limits of their mandates, participants should benefit from enhanced preparedness and wider situational awareness covering all aspects related to cybersecurity threats and incidents, and leverage additional cybersecurity expertise. For instance, participants should be regularly involved in cross-community exercises, acquire a well-defined role in the EU Crisis Response Plan, enhance the visibility of their actions through shared public communication, and conclude operational cooperation agreements with the private sector. In parallel, contributing to the Joint Cyber Unit should enable participants to strengthen existing networks, such as the CSIRTs Network and EU CyCLONe, providing them with secure information exchange tools and better detection capabilities (i.e. Security Operation Centres, ‘SOCs’) and allowing them to tap into available EU operational capabilities.

(12)

Participants in the Joint Cyber Unit should focus on technical and operational cooperation, including joint operations. Participants should contribute to such cooperation to the extent permitted by their mandates. Cooperation should build on and complement ongoing efforts. Depending on the type of cooperation concerned, additional participants may take part.

(13)

The platform should gather technical and operational crisis management experts from Member States and EU entities with a view to coordinating responses to cyber threats, incidents and crises by making use of existing capabilities and expertise. Experts participating in the Joint Cyber Unit will be able to monitor and protect a much wider attack surface by making use of both the physical and virtual platform. To this end, participants should coordinate efforts in the case of cross-border incidents and crises, as well as the delivery of assistance to incident stricken countries through the platform.

(14)

Building the Joint Cyber Unit requires an incremental process harnessing and consolidating existing frameworks and structures mentioned in this Recommendation, including the collaboration mechanisms established under Member States’ led fora (e.g. the CSIRTs network, EU CyCLONe, the Council Horizontal Working Party on Cyber Issues, J-CAT and relevant PESCO projects) and on the side of the EU Institutions, Bodies and Agencies, the structured cooperation between ENISA and CERT-EU as well as of the inter-Institutional Cybersecurity Information Exchange Group. Frameworks for hybrid threats, civil-protection (14) and sector-specific (15) should be adequately involved. Similarly, a structured link with the IPCR (16) should be created. This will allow, in case of crisis, to swiftly and effectively transmit information to decision-makers at political level gathered in Council.

(15)

The creation of the Joint Cyber Unit should therefore follow a gradual and transparent process to be completed over the next two years. For this reason, the objectives set out in this Recommendation should be achieved through a four steps process, as described in the Annex to this Recommendation. A preparatory process, organised and supported by ENISA, involving operational and supporting participants at EU and Member State level, should be launched in the first two steps and take place under a working group to be set up by the Commission. The preparatory work should be guided by the principles of mutual engagement, inclusiveness and consensus building. The engagement of all participants should be fostered, allowing for diverse views and positions to be expressed and endeavouring to find solutions which command the widest possible support. Depending on the needs and based on well-justified conditions, the timeline for the different steps indicated in this Recommendation may be adjusted.

(16)

Under step one, the preparatory process should start with the identification of relevant available EU operational capabilities and the launch of an assessment of the roles and responsibilities of participants within the platform. Step two should include the development of the EU Incident and Crisis Response Plan, consistent with the Blueprint (17) and the EU Law Enforcement Emergency Response Protocol, the roll-out of preparedness and situational awareness related activities, consistent with the Cybersecurity Act and the Europol Regulation (18), and the conclusion of the assessment on the roles and responsibilities of participants within the platform. The working group should present the results of that assessment to the Commission and the High Representative, which subsequently will share those results with the Council. The Commission and the High Representative should work together, in line with their respective competences, to draw up a joint report based on that assessment and invite the Council to endorse that report via Council conclusions.

(17)

Following that endorsement, the Joint Cyber Unit will be made operational, with a view to completing the two remaining steps of the process. Under step three, participants should be able to deploy EU Rapid Reaction teams within the Joint Cyber Unit , along the lines of procedures defined in the EU Incident and Crisis Response Plan, leveraging both the physical and virtual platform and contributing to various aspects of incident response (from public communication to ex-post recovery). Finally, under step four, private sector stakeholders, including both users and providers of cybersecurity solutions and services, will be invited to contribute to the platform, allowing participants to improve information sharing and enhance the EU’s coordinated response to cyber threats and incidents.

(18)

By the end of the four step process, participants should draw up an activity report on progress made in the implementation of the four steps set out in the Recommendation, describing achievements and challenges faced, which should be presented to the Commission and the High Representative. Based on that report, the Commission and the High Representative should carry out an assessment of those outcomes and draw conclusions for the future of the Joint Cyber Unit.

(19)

The Commission, ENISA, Europol and CERT-EU should provide administrative, financial and technical support to the Joint Cyber Unit as set out in Section IV of this Recommendation, subject to budget and human resource availability. The reinforcement of relevant EU institutions’, bodies’ and agencies’ operational cybersecurity capacities will be key to ensure effective preparation and sustainability of the Joint Cyber Unit. The Commission intends to ensure that the forthcoming regulation on common binding rules on cybersecurity for EU Institutions, Bodies and Agencies (October 2021) will provide the legal base for this contribution in the case of CERT-EU.

(20)

In view of its reinforced mandate under Regulation (EU) 2019/881 (‘Cybersecurity Act’), ENISA is in a unique position to organise and support the preparation of the Joint Cyber Unit, as well as to contribute to its operationalisation. In line with the provisions of the Cybersecurity Act, ENISA is currently establishing a Brussels office to support its structured cooperation with CERT-EU. That structured cooperation, including adjacent offices, provides a useful framework to facilitate the creation of the Joint Cyber Unit, including the establishment of its physical space which should be made available to participants in case of need, as well as to staff from other relevant EU institutions, bodies and agencies. The physical platform should be combined with a virtual platform composed of collaboration and secure information sharing tools. Those tools will leverage the wealth of information gathered through the European Cyber-Shield (19), including Security Operation Centres (‘SOCs’) and Information Sharing and Analysis Centres (‘ISACs’).

(21)

The EU Law Enforcement Emergency Response Protocol for major cross-border cyber-attacks, adopted by the Council in 2018, gives a central role to Europol’s European Cybercrime Centre (‘EC3’) (20) as part of the ‘Blueprint’ framework. That Protocol allows EU law enforcement authorities to provide a response to large-scale cross-border attacks of a suspected malicious nature on a 24/7 basis through rapid reaction and assessment, as well as the secure and timely sharing of critical information for the effective coordination of responses to cross-border incidents. The Protocol further elaborates on the collaboration with other EU institutions and EU-wide crisis protocols, as well as crisis cooperation with the private sector. The law enforcement community, with the support of Europol when appropriate, should contribute to the Joint Cyber Unit by taking the necessary steps within the full investigation cycle, in line with the requirements of the criminal justice framework and the applicable electronic evidence handling procedures. Europol has been providing operational support and facilitating operational cooperation against cyber threats since the inception of EC3 in 2013. Europol should support the platform according to its mandate and the intelligence-led policing approach, while leveraging all types of in-house expertise, products, tools and service of pertinence for the incident or crisis response.

(22)

The 2013/40/EU Directive on Attacks against information systems also requires Member States to ensure that they have an operational national point of contact available 24 hours a day and seven days a week for the purpose of exchanging information relating to the offences defined in that Directive. The network of operational national points of contact should also contribute to the Joint Cyber Unit by ensuring involvement of Member State law enforcement authorities where appropriate.

(23)

The EU cyber diplomacy community contributes to promoting and protect a global, open, stable and secure cyberspace and to prevent, deter and respond to malicious cyber activities in this regard. In 2017, the EU established a Framework for a Joint EU Diplomatic Response to Malicious Cyber Activities (‘Cyber Diplomacy Toolbox’). This framework is part of EU’s wider cyber diplomacy policy. It contributes to conflict prevention and greater stability in international relations. It allows the EU and Member States, in cooperation with international partners where relevant, to use all Common Foreign and Security Policy (‘CFSP’) measures, in line with the respective procedures for their attainment, to encourage cooperation, mitigate threats and influence current and potential future malicious behaviour in cyberspace. The cyber diplomacy community should cooperate under the Joint Cyber Unit by using and providing support in using the full range of diplomatic measures, notably as regards public communication, supporting shared situational awareness and engagement with third countries in the event of a crisis.

(24)

In line with the Blueprint framework, the High Representative, including through INTCEN, should contribute to the Joint Cyber Unit by providing continuous intelligence-based shared situational awareness on existing and emerging threats, including the necessary strategic situational awareness to any given event.

(25)

Within the cyber defence community, the EU and Member States aim to strengthen cyber defence capabilities and enhance further synergies, coordination and cooperation between relevant EU institutions, bodies and agencies, as well as with and between Member States, including as regards the Common Security and Defence Policy (‘CSDP’) missions and operations. The community functions based on an intergovernmental governance at EU level, national military command structures and military, or dual-use capabilities and assets. In light of its different nature, specific interfaces with the Joint Cyber Unit should be built to enable information sharing with the cyber defence community (21)

(26)

The Permanent Structured Cooperation is a legal framework introduced by the Treaty of Lisbon (22) and established in 2017 within the Union framework. Structured cooperation led to the establishment of a number of PESCO projects in the cyber domain, contributing to the fulfilment of the commitment 11 (23) to “ensure increasing efforts in the cooperation on cyber defense, such as information sharing, training and operational support”. EEAS, including the EU Military Staff and EDA, form the PESCO secretariat, which provides a single point of contact within the Union's framework for all PESCO matters, including supporting and coordinating functions related to the PESCO projects (e.g. the assessment of new project proposals, preparation of the projects’ progress reports, etc.). Representatives of relevant PESCO projects should support the Joint Cyber Unit notably in relation to situational awareness and preparedness.

(27)

Through the Joint Cyber Unit, participants should adequately integrate private sector stakeholders, including both providers and users of cybersecurity solutions and services, to support the European cybersecurity crisis management framework, with due regard to the legal framework for data sharing and security of information. Cybersecurity providers should contribute to the initiative by sharing threat intelligence and providing incident responders to quickly expand the Unit’s capacity to respond to large scale attacks and crises. Users of cybersecurity goods and services, primarily those under the scope of the NIS Directive, should be able to seek help and advice through currently missing structured channels linked to EU-level Information Sharing and Analysis Centres (ISACs) (24). The platform could also contribute to strengthen cooperation with international partners.

(28)

Developing and maintaining situational awareness requires cutting-edge intrusion detection and prevention capabilities. The Joint Cyber Unit should rely on a state-of-the-art network that is able to analyse malicious threats and incidents that may impact key communication and information systems across the Union. This means that, among other sources, threat knowledge extracted from communication networks monitored by national, sectoral and cross-border SOCs should feed into the Joint Cyber Unit to improve participants’ assessment of the EU threat landscape.

(29)

In order to support the exchange of operational information, possibly including confidential material, the platform should rely on appropriately secure communication channels. Such channels could also build on existing infrastructure, such as the secure information exchange network application (‘SIENA’) used by Europol and the law enforcement community. As announced in the Cybersecurity Strategy, tools used by EU institutions, bodies and agencies should respect rules on information security that the Commission will soon propose.

(30)

The Commission, primarily through the Digital Europe Programme, will support the necessary investments to set up the physical and virtual platform and build and maintain secure communication channels and training capabilities as well as developing and deploying detection capabilities. In addition, the European Defence Fund could help fund key cyber defence technologies and cyber defence capabilities which would reinforce national cyber defence preparedness,