This Regulation amending the Cybersecurity Act adds the possibility to develop European certification cybersecurity schemes for managed security services. At the same time, it is acknowledged that a thorough review of the Cybersecurity Act is of utmost importance, including the assessment of the procedures leading to the preparation, adoption and review of European cybersecurity certification schemes. This review should be based on a deep analysis and broad consultation on the impact, effectiveness and efficiency of the functioning of the European cybersecurity certification framework. The analysis carried out as part of the evaluation established in Article 67 of the Cybersecurity Act should include on-going scheme development activities, such as the one concerning European cybersecurity certification scheme for cloud services (EUCS) as well as those of adopted schemes such as the one concerning the European Common Criteria-based cybersecurity certification scheme (EUCC).

In particular, the review should identify the strengths and weaknesses of the procedures leading to cybersecurity certification schemes and formulate recommendations for future improvements. It should also address aspects relating to stakeholder consultations and transparency of the process.

Accordingly, the Commission, which is responsible for the review of the Cybersecurity Act, shall ensure that the review takes into account as appropriate the necessary elements mentioned in light of Article 67 when presenting the review to the co-legislators.