(1)

Our daily lives and economies become increasingly dependent on digital technologies, citizens become more and more exposed to serious cyber incidents. Future security depends, among others, on enhancing technological and industrial ability to protect the Union against cyber threats, as both civilian infrastructure and military capacities rely on secure digital systems.

(1)

More than 80 % of the population of the Union is connected to the internet and our daily lives and economies are becoming increasingly dependent on digital technologies, with citizens becoming more and more exposed to serious cyber incidents. Future security depends, among others, on contributing to overall resilience, on enhancing technological and industrial ability to protect the Union against constantly evolving cyber threats, as both infrastructure and security capacities rely on secure digital systems. Such security can be achieved by raising the awareness for cybersecurity threats, by developing competences, capacities, capabilities throughout the Union, thoroughly taking into account the interplay of hardware and software infrastructure, networks, products and processes, and the societal and ethical implications and concerns.

(1a)

Cybercrime is a fast growing threat to the Union, its citizens and its economy. In 2017, 80 % of the European companies experienced at least one cyber incident. The Wannacry-attack in May 2017 affected more than 150 countries and 230 000 IT-systems and had significant impacts on critical infrastructures, such as hospitals. This underlines the necessity for the highest cybersecurity standards and holistic cybersecurity solutions, involving people, products, processes and technology in the Union, as well as for the Union’s leadership in the matter, and for digital autonomy.

(4)

The Heads of State and Government at the Tallinn Digital Summit, in September 2017, called for the Union to become ‘a global leader in cyber-security by 2025, in order to ensure trust, confidence and protection of our citizens, consumers and enterprises online and to enable a free and law-governed internet.’

(4)

The Heads of State and Government at the Tallinn Digital Summit, in September 2017, called for the Union to become a global leader in cybersecurity by 2025, in order to ensure trust, confidence and protection of our citizens, consumers and enterprises online and to enable a free , safer and law-governed internet , and declared to ‘make more use of open source solutions and/or open standards when (re)building ICT systems and solutions (among else, to avoid vendor lock-ins), including those developed and/or promoted by EU programmes for interoperability and standardisation, such as ISA2’.

(4a)

The European Cybersecurity Industrial, Technology and Research Competence Centre (the ‘Competence Centre’) should help to increase the resilience and reliability of the infrastructure of network and information systems, including the internet and other critical infrastructure for the functioning of society such as transport, health, and banking systems.

(4b)

The Competence Centre and its actions should take into account the implementation of Regulation (EU) 2019/XXX [recast of Regulation (EC) No 428/2009 as proposed by COM(2016)0616]  (1a) .

(5)

Substantial disruption of network and information systems can affect individual Member States and the Union as a whole. The security of network and information systems is therefore essential for the smooth functioning of the internal market . At the moment, the Union depends on non-European cybersecurity providers. However, it is in the Union's strategic interest to ensure that it retains and develops essential cybersecurity technological capacities to secure its Digital Single Market, and in particular to protect critical networks and information systems and to provide key cybersecurity services.

(5)

Substantial disruption of network and information systems can affect individual Member States and the Union as a whole. The highest level of security of network and information systems throughout the Union is therefore essential for society and economy alike . At the moment, the Union depends on non-European cybersecurity providers. However, it is in the Union's strategic interest to ensure that it retains and develops essential cybersecurity technological capacities and capabilities to secure the protection of data and critical networks and information systems of European citizens and companies, including critical infrastructures for the functioning of society such as transport systems, health systems and banking, and the Digital Single Market, and to provide key cybersecurity services.

(6)

A wealth of expertise and experience in cybersecurity research, technology and industrial development exists in the Union but the efforts of industrial and research communities are fragmented, lacking alignment and a common mission, which hinders competitiveness in this domain. These efforts and expertise need to be pooled, networked and used in an efficient manner to reinforce and complement existing research, technology and industrial capacities at Union and national levels.

(6)

A wealth of expertise and experience in cybersecurity research, technology and industrial development exists in the Union but the efforts of industrial and research communities are fragmented, lacking alignment and a common mission, which hinders competitiveness and effective protection of critical data, networks and systems in this domain. These efforts and expertise need to be pooled, networked and used in an efficient manner to reinforce and complement existing research, technology , skills and industrial capacities at Union and national levels. Whereas Information and Communication Technology (ICT) sector faces important challenges, such as fulfilling its demand for skilled workers, it can benefit from representing the diversity of society at large, and from achieving a balanced representation of genders, ethnic diversity, and non-discrimination against disabled persons, as well as from facilitating the access to knowledge and training for future cybersecurity experts, including their education in non-formal contexts, for example in Free and Open Source Software projects, civic tech projects, start-ups and microenterprises.

(6a)

Small and medium-sized enterprises (SMEs) are crucial actors in the Union’s cybersecurity sector, which can provide cutting-edge solutions due to their agility. SMEs that are not specialised in cybersecurity are, however, also prone to be more vulnerable to cyber incidents due to high investment and knowledge requirements to establish effective cybersecurity solutions. It is therefore necessary that the Competence Centre and the Cybersecurity Competence Network (the ‘Network’) provide special support for SMEs by facilitating their access to knowledge and training in order to allow them to secure themselves sufficiently and to allow those who are active in cybersecurity to contribute to the Union’s leadership in the field.

(6b)

Expertise exists beyond industrial and research contexts. Non-commercial and pre-commercial projects, referred to as ‘civic tech’ projects, make use of open standards, Open Data, and Free and Open Source Software, in the interest of society and the public good. They contribute to the resilience, awareness and development of competence in cybersecurity matters and play an important role in building capacities for industry and research in the field.

(6c)

The term ‘stakeholders’, when used in the context of this Regulation, refers to, inter alia, industry, public entities and other entities which deal with operational and technical matters in the area of cybersecurity, as well as to civil society, inter alia trade unions, consumer associations, the Free and Open Source Software community, and the academic and research community.

(8)

The Competence Centre should be the Union's main instrument to pool investment in cybersecurity research, technology and industrial development and to implement relevant projects and initiatives together with the Cybersecurity Competence Network. It should deliver cybersecurity-related financial support from the Horizon Europe and Digital Europe programmes, and should be open to the European Regional Development Fund and other programmes where appropriate. This approach should contribute to creating synergies and coordinating financial support related to cybersecurity research, innovation, technology and industrial development and avoiding duplication.

(8)

The Competence Centre should be the Union's main instrument to pool investment in cybersecurity research, technology and industrial development and to implement relevant projects and initiatives together with the Network. It should deliver cybersecurity-related financial support from the Horizon Europe and Digital Europe programmes, as well as from the European Defence Fund for actions and administrative costs related to defence, and should be open to the European Regional Development Fund and other programmes where appropriate. This approach should contribute to creating synergies and coordinating financial support related to Union initiatives in the field of cybersecurity research and development , innovation, technology and industrial development and avoiding duplication.

(8a)

‘Security by design’ as a principle established in Commission Joint Communication of 13 September 2017 entitled ‘Resilience, Deterrence and Defence: Building strong cybersecurity for the EU’ includes state-of-the-art methods by which to increase security, at all stages of the lifecycle of a product or service, starting with secure design and development methods, reducing the attack surface, and incorporating adequate security testing and security audits. For the duration of operation and maintenance, producers or providers need to make available updates remedying new vulnerabilities or threats without delay, for the estimated lifetime of a product and beyond. This can also be achieved by enabling third parties to create and provide such updates. The provision of updates is especially necessary in the case of commonly used infrastructures, products and processes.

(8b)

In view of the extent of the cybersecurity challenge and in view of the investments made in cybersecurity capacities and capabilities in other parts of the world, the Union and its Member States should step up their financial support to research, development and deployment in this area. In order to realise economies of scale and achieve a comparable level of protection across the union, the Member States should put their efforts into a European framework by investing through the Competence Centre mechanism where relevant.

(8c)

The Competence Centre and the Cybersecurity Competence Community should, in order to foster the Union’s competitiveness and the highest cybersecurity standards internationally, seek the exchange on cybersecurity products and processes, standards and technical standards with the international community. Technical standards include the creation of reference implementations, published under open standard licences. The secure design of, in particular, reference implementations is crucial for the overall reliability and resilience of commonly used network and information system infrastructure like the internet and critical infrastructures.

(9)

Taking into account that the objectives of this initiative can be best achieved if all Member States or as many Member States as possible participate , and as an incentive for Member States to take part, only Member States who contribute financially to the administrative and operational costs of the Competence Centre should hold voting rights.

(9)

Taking into account that the objectives of this initiative can be best achieved if all Member States or as many Member States as possible contribute , and as an incentive for Member States to take part, only Member States who contribute financially to the administrative and operational costs of the Competence Centre should hold voting rights.

(12)

National Coordination Centres should be selected by Member States. In addition to the necessary administrative capacity, Centres should either possess or have direct access to cybersecurity technological expertise in cybersecurity, notably in domains such as cryptography, ICT security services, intrusion detection, system security, network security, software and application security, or human and societal aspects of security and privacy. They should also have the capacity to effectively engage and coordinate with the industry, the public sector, including authorities designated pursuant to the Directive (EU) 2016/1148 of the European Parliament and of the Council (23), and the research community.

(12)

National Coordination Centres should be selected by Member States. In addition to the necessary administrative capacity, Centres should either possess or have direct access to cybersecurity technological expertise in cybersecurity, notably in domains such as cryptography, ICT security services, intrusion detection, system security, network security, software and application security, or human , ethical, societal and environmental aspects of security and privacy. They should also have the capacity to effectively engage and coordinate with the industry, the public sector, including authorities designated pursuant to the Directive (EU) 2016/1148 of the European Parliament and of the Council (23), and the research community in order to establish a continuous public-private dialogue on cybersecurity . In addition, awareness should be raised among the general public about cybersecurity through appropriate means of communication.

(14)

Emerging technologies such as artificial intelligence, Internet of Things, high-performance computing (HPC) and quantum computing, blockchain and concepts such as secure digital identities create at the same time new challenges for cybersecurity as well as offer solutions . Assessing and validating the robustness of existing or future ICT systems will require testing security solutions against attacks run on HPC and quantum machines. The Competence Centre, the Network and the Cybersecurity Competence Community should help advance and disseminate the latest cybersecurity solutions. At the same time the Competence Centre and the Network should be at the service of developers and operators in critical sectors such as transport, energy, health, financial, government, telecom, manufacturing, defence, and space to help them solve their cybersecurity challenges.

(14)

Emerging technologies such as artificial intelligence, Internet of Things, high-performance computing (HPC) and quantum computing, as well as concepts such as secure digital identities create at the same time new challenges for cybersecurity as well as offer products and processes . Assessing and validating the robustness of existing or future ICT systems will require testing security products and processes against attacks run on HPC and quantum machines. The Competence Centre, the Network , the European Digital Innovation Hubs and the Cybersecurity Competence Community should help advance and disseminate the latest cybersecurity products and processes, including dual use, in particular those that help organisations to be in a constant state of building capacity, resilience and appropriate governance. The Competence Centre and the Network should stimulate the whole innovation cycle and contribute to bridging the valley of death of innovation of cybersecurity technologies and services. At the same time the Competence Centre, the Network and the Community should be at the service of developers and operators in critical sectors such as transport, energy, health, financial, government, telecom, manufacturing, defence, and space to help them solve their cybersecurity challenges , and research the various motivations of attacks on the integrity of networks and information systems, such as crime, industrial espionage, defamation, and disinformation .

(14a)

Due to the fast changing nature of cyber threats and cybersecurity, the Union needs to be able to adapt fast and continuously to new developments in the field. Hence, the Competence Centre, the Network and the Cybersecurity Competence Community should be flexible enough to ensure the required reactivity. They should facilitate solutions that help entities to be able to constantly build capability to enhance their and the Union’s resilience.

(14b)

The Competence Centre should have the objectives to establish the Union’s leadership and expertise in cybersecurity, and by that guarantee the highest security standards in the Union, ensure the protection of data, information systems, networks and critical infrastructures in the Union, create new high-quality jobs in the area, prevent brain drain from the European cybersecurity experts to third countries, and add European value to the already existing national cybersecurity measures.

(15)

The Competence Centre should have several key functions. First, the Competence Centre should facilitate and help coordinate the work of the European Cybersecurity Competence Network and nurture the Cybersecurity Competence Community. The Centre should drive the cybersecurity technological agenda and facilitate access to the expertise gathered in the Network and the Cybersecurity Competence Community. Secondly, it should implement relevant parts of Digital Europe and Horizon Europe programmes by allocating grants, typically following a competitive call for proposals. Thirdly, the Competence Centre should facilitate joint investment by the Union, Member States and/or industry.

(15)

The Competence Centre should have several key functions. First, the Competence Centre should facilitate and help coordinate the work of the Network and nurture the Cybersecurity Competence Community. The Centre should drive the cybersecurity technological agenda and pool, share and facilitate access to the expertise gathered in the Network and the Cybersecurity Competence Community , and to cybersecurity infrastructure . Secondly, it should implement relevant parts of Digital Europe and Horizon Europe programmes by allocating grants, typically following a competitive call for proposals. Thirdly, the Competence Centre should facilitate joint investment by the Union, Member States and/or industry as well as joint training opportunities and awareness raising programmes in line with the Digital Europe Programme for citizens and businesses to overcome the skill gap . It should pay special attention to the enabling of SMEs in the area of cybersecurity.

(16)

The Competence Centre should stimulate and support the cooperation and coordination of the activities of the Cybersecurity Competence Community, which would involve a large, open, and diverse group of actors involved in cybersecurity technology. That Community should include in particular research entities, supply-side industries, demand side industries, and the public sector. The Cybersecurity Competence Community should provide input to the activities and work plan of the Competence Centre and it should also benefit from the community-building activities of the Competence Centre and the Network, but otherwise should not be privileged with regard to calls for proposals or calls for tender.

(16)

The Competence Centre should stimulate and support the long-term strategic cooperation and coordination of the activities of the Cybersecurity Competence Community, which would involve a large, open, interdisciplinary and diverse group of European actors involved in cybersecurity technology. That Community should include in particular research entities, including those working on cybersecurity ethics, supply-side industries, demand-side industries including SMEs , and the public sector. The Cybersecurity Competence Community should provide input to the activities and work plan of the Competence Centre and it should also benefit from the community-building activities of the Competence Centre and the Network, but otherwise should not be privileged with regard to calls for proposals or calls for tender.

(16a)

The Competence Centre should provide the appropriate support to ENISA in its tasks defined by Directive (EU) 2016/1148 (‘NIS Directive’) and Regulation (EU) 2019/XXX of the European Parliament and of the Council  (1a) (‘Cybersecurity Act’). Therefore, ENISA should provide relevant inputs to the Competence Centre in its task of defining funding priorities.

(17)

In order to respond to the needs of both demand and supply side industries, the Competence Centre's task to provide cybersecurity knowledge and technical assistance to industries should refer to both ICT products and services and all other industrial and technological products and solutions in which cybersecurity is to be embedded.

(17)

In order to respond to the needs of the public sector and both demand and supply side industries, the Competence Centre's task to provide cybersecurity knowledge and technical assistance to the public sector and industries should refer to both ICT products , processes and services and all other industrial and technological products and processes in which cybersecurity is to be embedded. In particular, the Competence Centre should facilitate the deployment of dynamic enterprise-level solutions focused on building capabilities of entire organisations, including people, processes and technology, in order to effectively protect the organizations against constantly changing cyber threats.

(17a)

The Competence Centre should contribute to the wide deployment of state-of-the-art cybersecurity products and solutions, in particular those that are internationally recognised.

(18)

Whereas the Competence Centre and the Network should strive to achieve synergies between the cybersecurity civilian and defence spheres, projects financed by the Horizon Europe Programme will be implemented in line with Regulation XXX [Horizon Europe Regulation], which provides that research and innovation activities carried out under Horizon Europe shall have a focus on civil applications.

(18)

Whereas the Competence Centre and the Network should strive to achieve synergies and coordination between the cybersecurity civilian and defence spheres, projects financed by the Horizon Europe Programme will be implemented in line with Regulation XXX [Horizon Europe Regulation], which provides that research and innovation activities carried out under Horizon Europe shall have a focus on civil applications.

(19)

In order to ensure structured and sustainable collaboration, the relation between the Competence Centre and the National Coordination Centres should be based on a contractual agreement.

(19)

In order to ensure structured and sustainable collaboration, the relation between the Competence Centre and the National Coordination Centres should be based on a contractual agreement that should be harmonised at Union level .

(20)

Appropriate provisions should be made to guarantee the liability and transparency of the Competence Centre.

(20)

Appropriate provisions should be made to guarantee the liability and transparency of the Competence Centre and those undertakings receiving funding .

(20a)

The implementation of deployment projects, in particular those relating to infrastructures and capabilities deployed at European level or in joint procurement, can be divided into different phases of implementation, such as separate tenders for the architecture of hard- and software, their production and their operation and maintenance, whereas companies may only participate in one of the phases each and requiring that the beneficiaries in one or several of those phases meet certain conditions in terms of European ownership or control.

(20b)

With ENISA being the dedicated Union cybersecurity agency, the Competence Centre should seek the greatest possible synergies with it and the Governing Board should consult ENISA due to its experience in the field in all matters regarding cybersecurity, in particular on research-related projects.

( 20c)

In the process of the nomination of the representative to the Governing Board, the European Parliament should include details of the mandate, including the obligation to report regularly to the European Parliament, or the committees responsible.

(21)

In view of their respective expertise in cybersecurity, the Joint Research Centre of the Commission as well as the European Network and Information Security Agency (ENISA) should play an active part in the Cybersecurity Competence Community and the Industrial and Scientific Advisory Board.

(21)

In view of their respective expertise in cybersecurity and in order to ensure greatest possible synergies , the Joint Research Centre of the Commission as well as the European Network and Information Security Agency (ENISA) should play an active part in the Cybersecurity Competence Community and the Industrial and Scientific Advisory Board. ENISA should continue to fulfil its strategic objectives especially in the field of cybersecurity certification as defined in Regulation (EU) 2019/XXX [Cybersecurity Act]  (1a) while the Competence Centre should act as an operational body in cybersecurity .

(24)

The Governing Board of the Competence Centre, composed of the Member States and the Commission, should define the general direction of the Competence Centre’s operations, and ensure that it carries out its tasks in accordance with this Regulation. The Governing Board should be entrusted with the powers necessary to establish the budget, verify its execution, adopt the appropriate financial rules, establish transparent working procedures for decision making by the Competence Centre, adopt the Competence Centre’s work plan and multiannual strategic plan reflecting the priorities in achieving the objectives and tasks of the Competence Centre, adopt its rules of procedure, appoint the Executive Director and decide on the extension of the Executive Director’s term of office and on the termination thereof.

(24)

The Governing Board of the Competence Centre, composed of the Member States and the Commission, should define the general direction of the Competence Centre’s operations, and ensure that it carries out its tasks in accordance with this Regulation. The Governing Board should be entrusted with the powers necessary to establish the budget, verify its execution, adopt the appropriate financial rules, establish transparent working procedures for decision making by the Competence Centre, adopt the Competence Centre’s work plan and multiannual strategic plan reflecting the priorities in achieving the objectives and tasks of the Competence Centre, adopt its rules of procedure, appoint the Executive Director and decide on the extension of the Executive Director’s term of office and on the termination thereof. In order to benefit from synergies, ENISA should be a permanent observer in the Governing Board and contribute the work of the Competence Centre, including by being consulted on the multi-annual strategic plan and on the work plan and on the list of actions selected for funding.

(24a)

The Governing Board should aim to promote the Competence Centre globally, so as to raise its attractiveness and make it a world-class body for excellence in cybersecurity.

(25)

In order for the Competence Centre to function properly and effectively, the Commission and the Member States should ensure that persons to be appointed to the Governing Board have appropriate professional expertise and experience in functional areas. The Commission and the Member States should also make efforts to limit the turnover of their respective Representatives on the Governing Board in order to ensure continuity in its work.

(25)

In order for the Competence Centre to function properly and effectively, the Commission and the Member States should ensure that persons to be appointed to the Governing Board have appropriate professional expertise and experience in functional areas. The Commission and the Member States should also make efforts to limit the turnover of their respective Representatives on the Governing Board in order to ensure continuity in its work and aim to achieve gender balance .

(25a)

The weight of the Commission vote in the decisions of the Governing Board should be in line with the contribution of the Union budget to the Competence Centre, according to the Commission responsibility to ensure proper management of the Union budget in the Union interest, as set in the Treaties.

(26)

The smooth functioning of the Competence Centre requires that its Executive Director be appointed on grounds of merit and documented administrative and managerial skills, as well as competence and experience relevant for cybersecurity, and that the duties of the Executive Director be carried out with complete independence.

(26)

The smooth functioning of the Competence Centre requires that its Executive Director be appointed in a transparent manner on the grounds of merit and documented administrative and managerial skills, as well as competence and experience relevant for cybersecurity, and that the duties of the Executive Director be carried out with complete independence.

(27)

The Competence Centre should have an Industrial and Scientific Advisory Board as an advisory body to ensure regular dialogue with the private sector, consumers’ organisations and other relevant stakeholders. The Industrial and Scientific Advisory Board should focus on issues relevant to stakeholders and bring them to the attention of the Competence Centre's Governing Board. The composition of the Industrial and Scientific Advisory Board and the tasks assigned to it, such as being consulted regarding the work plan, should ensure sufficient representation of stakeholders in the work of the Competence Centre.

(27)

The Competence Centre should have an Industrial and Scientific Advisory Board as an advisory body to ensure regular and appropriately transparent dialogue with the private sector, consumers’ organisations and other relevant stakeholders . It should also provide the Executive Director and the Governing Board with independent advice on deployment and procurement . The Industrial and Scientific Advisory Board should focus on issues relevant to stakeholders and bring them to the attention of the Competence Centre's Governing Board. The composition of the Industrial and Scientific Advisory Board and the tasks assigned to it, such as being consulted regarding the work plan, should ensure sufficient representation of stakeholders in the work of the Competence Centre. A minimum number of seats should be allocated to each category of industry stakeholders, with particular attention paid to the representation of SMEs.

(28)

The Competence Centre should benefit from the particular expertise and the broad and relevant stakeholders’ representation built through the contractual public-private partnership on cybersecurity during the duration of Horizon2020, through its Industrial and Scientific Advisory Board.

(28)

The Competence Centre and its activities should benefit from the particular expertise and the broad and relevant stakeholders’ representation built through the contractual public-private partnership on cybersecurity during the duration of Horizon2020, and the pilot projects under Horizon2020 on the Cybersecurity Competence Network, through its Industrial and Scientific Advisory Board. The Competence Centre and Industrial and Scientific Advisory Board should, if appropriate, consider replications of existing structures, for example as working groups.

(28a)

The Competence Centre and its bodies should make use of the experience and contributions of past and current initiatives, such as the contractual public-private partnership (cPPP) on cybersecurity, the European Cyber Security Organisation (ECSO), and the pilot project and preparatory action on Free and Open Source Software Audits (EU FOSSA).

(29)

The Competence Centre should have in place rules regarding the prevention and the management of conflict of interest. The Competence Centre should also apply the relevant Union provisions concerning public access to documents as set out in Regulation (EC) No 1049/2001 of the European Parliament and of the Council (24). Processing of personal data by the Competence Centre will be subject to Regulation (EU) No XXX/2018 of the European Parliament and of the Council. The Competence Centre should comply with the provisions applicable to the Union institutions, and with national legislation regarding the handling of information, in particular sensitive non classified information and EU classified information.

(29)

The Competence Centre should have in place rules regarding the prevention , identification and resolution of conflicts of interest in respect of its members, bodies and staff, the Governing Board, as well as the Scientific and Industrial Advisory Board, and the Community. Member States should ensure the prevention, identification, and resolution of conflicts of interest in respect of the National Coordination Centres . The Competence Centre should also apply the relevant Union provisions concerning public access to documents as set out in Regulation (EC) No 1049/2001 of the European Parliament and of the Council (24). Processing of personal data by the Competence Centre will be subject to Regulation (EU) No XXX/2018 of the European Parliament and of the Council. The Competence Centre should comply with the provisions applicable to the Union institutions, and with national legislation regarding the handling of information, in particular sensitive non classified information and EU classified information.

(31)

The Competence Centre should operate in an open and transparent way providing all relevant information in a timely manner as well as promoting its activities, including information and dissemination activities to the wider public. The rules of procedure of the bodies of the Competence Centre should be made publicly available.

(31)

The Competence Centre should operate in an open and transparent way comprehensively providing information in a timely manner as well as promoting its activities, including information and dissemination activities to the wider public. It should provide the public and any interested parties with a list of the Cybersecurity Competence Community members and should make public the declarations of interest made by them in accordance with Article 42. The rules of procedure of the bodies of the Competence Centre should be made publicly available .

(31a)

It is advisable that both the Competence Centre and the National Coordination Centres monitor and follow the international standards as much as possible, in order to encourage development towards global best practices.

(33a)

The power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission in respect of defining the elements of contractual agreements between the Competence Centre and National Coordination Centres, and in respect of specifying criteria for assessing and accrediting entities as members of the Cybersecurity Competence Community. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making  (1a) . In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States' experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts.

(34)

Since the objectives of this Regulation, namely retaining and developing Union's cybersecurity technological and industrial capacities, increasing the competitiveness of the Union's cybersecurity industry and turning cybersecurity into a competitive advantage of other Union industries, cannot be sufficiently achieved by the Member States due the fact that existing, limited resources are dispersed as well as due to the scale of the investment necessary, but can rather by reason of avoiding unnecessary duplication of these efforts, helping to achieve critical mass of investment and ensuring that public financing is used in an optimal way be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve that objective.

(34)

The objectives of this Regulation, namely strengthening the Union’s competitiveness and capacities in cybersecurity through, and reducing its digital dependence by increasing the uptake of cybersecurity products, processes and services developed within the Union, retaining and developing Union's cybersecurity technological and industrial capacities, increasing the competitiveness of the Union's cybersecurity industry and turning cybersecurity into a competitive advantage of other Union industries, cannot be sufficiently achieved by the Member States due the fact that existing, limited resources are dispersed as well as due to the scale of the investment necessary, but can rather by reason of avoiding unnecessary duplication of these efforts, helping to achieve critical mass of investment and ensuring that public financing is used in an optimal way be better achieved at Union level . In addition, only actions at Union level can ensure the highest level of cybersecurity in all Member States and thus close security gaps existing in some Member States that create security gaps for the whole Union. Hence , the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve that objective.

(1)

‘cybersecurity’ means the protection of network and information systems, their users, and other persons against cyber threats;

(1)

‘cybersecurity’ means all activities necessary to protect network and information systems, their users, and affected persons from cyber threats;

(1a)

(2)

‘ cybersecurity products and solutions ’ means ICT products, services or process with the specific purpose of protecting network and information systems, their users and affected persons from cyber threats;

(2)

‘products and processes ’ means commercial and non-commercial ICT products, services or processes with the specific purpose of protecting data, network and information systems, their users and other persons from cybersecurity threats;

(2a)

(3)

‘public authority’ means any government or other public administration, including public advisory bodies, at national, regional or local level or any natural or legal person performing public administrative functions under national law, including specific duties;

(3)

‘public authority’ means any government or other public administration, including public advisory bodies, at national, regional or local level or any natural or legal person performing public administrative functions under Union and national law, including specific duties;

(4)

‘ participating Member State’ means a Member State which voluntarily contributes financially to the administrative and operational costs of the Competence Centre.

(4)

‘ contributing Member State’ means a Member State which voluntarily contributes financially to the administrative and operational costs of the Competence Centre;

(4a)

‘European Digital Innovation Hubs’ means a legal entity as defined in Regulation (EU) 2019/XXX of the European Parliament and of the Council  (1a) .

(a)

retain and develop the cybersecurity technological and industrial capacities necessary to secure its Digital Single Market;

(a)

develop the cybersecurity technological, industrial , societal, academic and research expertise capacities and capabilities necessary to secure its Digital Single Market and further the protection of data of Union citizens, companies and public administrations ;

(aa)

increase the resilience and reliability of the infrastructure of network and information systems, including critical infrastructure, the internet and commonly used hardware and software in the Union;

(b)

increase the competitiveness of the Union's cybersecurity industry and turn cybersecurity into competitive advantage of other Union industries.

(b)

increase the competitiveness of the Union's cybersecurity industry and turn cybersecurity into a competitive advantage of other Union industries.

(ba)

raise the awareness for cybersecurity threats, and related societal and ethical implications and concerns and reduce the skills gap in cybersecurity in the Union;

(bb)

develop the Union’s leadership in cybersecurity and ensure the highest cybersecurity standards throughout the Union;

(bc)

strengthen the Union’s competitiveness and capacities while reducing its digital dependence by increasing the uptake of cybersecurity products, processes and services developed within the Union;

(bd)

reinforce the trust of citizens, consumers and businesses in the digital world, and therefore contribute to the goals of the Digital Single Market strategy;

1.

facilitate and help coordinate the work of the National Coordination Centres Network (‘the Network’) referred to in Article 6 and the Cybersecurity Competence Community referred to in Article 8;

1.

create, manage and facilitate the Network referred to in Article 6 and the Community referred to in Article 8;

2.

contribute to the implementation of the cybersecurity part of the Digital Europe Programme established by Regulation No XXX (26) and in particular actions related to Article 6 of Regulation (EU) No XXX [Digital Europe Programme] and of the Horizon Europe Programme established by Regulation No XXX (27) and in particular Section 2.2.6 of Pillar II of Annex I. of Decision No XXX on establishing the specific programme implementing Horizon Europe — the Framework Programme for Research and Innovation[ref. number of the Specific Programme]. and of other Union programmes when provided for in legal acts of the Union];

2.

coordinate the implementation of the cybersecurity part of the Digital Europe Programme established by Regulation No XXX (26) and in particular actions related to Article 6 of Regulation (EU) No XXX [Digital Europe Programme] and of the Horizon Europe Programme established by Regulation No XXX (27) and in particular Section 2.2.6 of Pillar II of Annex I. of Decision No XXX on establishing the specific programme implementing Horizon Europe — the Framework Programme for Research and Innovation[ref. number of the Specific Programme]. and of other Union programmes when provided for in legal acts of the Union] and contribute to the implementation of the actions funded by the European Defence Fund established by Regulation (EU) 2019/XXX ;

3.

enhance cybersecurity capabilities, knowledge and infrastructures at the service of industries, the public sector and research communities, by carrying out the following tasks:

3.

enhance cybersecurity resilience, capacities, capabilities, knowledge and infrastructures at the service of society, industries, the public sector and research communities, by carrying out the following tasks , having regard to the state-of-the-art cybersecurity industrial and research infrastructures and related services :

(a)

having regard to the state-of-the-art cybersecurity industrial and research infrastructures and related services , acquiring, upgrading, operating and making available such infrastructures and related services to a wide range of users across the Union from industry including SMEs, the public sector and the research and scientific community;

(a)

acquiring, upgrading, operating and making available the Competence Centre’s facilities and related services in a fair, open and transparent way to a wide range of users across the Union from industry in particular SMEs, the public sector and the research and scientific community;

(b)

having regard to the state-of-the-art cybersecurity industrial and research infrastructures and related services, providing support to other entities, including financially, to acquiring, upgrading, operating and making available such infrastructures and related services to a wide range of users across the Union from industry including SMEs, the public sector and the research and scientific community;

(b)

providing support to other entities, including financially, to acquiring, upgrading, operating and making available such facilities and related services to a wide range of users across the Union from industry , in particular SMEs, the public sector and the research and scientific community;

(ba)

providing financial support and technical assistance to cybersecurity start-ups, SMEs, microenterprises, associations, individual experts and to civic tech projects;

(bb)

financing software security code audits and related improvements for Free and Open Source Software projects, commonly used for infrastructure, products and processes;

(c)

providing cybersecurity knowledge and technical assistance to industry and public authorities, in particular by supporting actions aimed at facilitating access to the expertise available in the Network and the Cybersecurity Competence Community;

(c)

facilitating the sharing of cybersecurity knowledge and technical assistance among others to civil society, the industry and public authorities , and the academic and research community , in particular by supporting actions aimed at facilitating access to the expertise available in the Network and the Cybersecurity Competence Community with the aim of improving cyber resilience within the Union ;

(ca)

promoting ‘security by design’ as principle in the process of developing, maintaining, operating, and updating infrastructures, products and services, in particular by supporting state-of-the-art secure development methods, adequate security testing, security audits, and including the commitment of producer or provider to make available updates remedying new vulnerabilities or threats, without delay, and beyond the estimated product lifetime, or enabling a third party to create and provide such updates;

(cb)

assisting source code contribution policies and their development, in particular for public authorities where Free and Open Source Software projects are used;

(cc)

bringing together stakeholders from industry, trade unions, academia, research organisations and public entities to ensure long-term cooperation on developing and implementing cybersecurity products and processes, including pooling and sharing of resources and information regarding such products and processes if appropriate;

4.

contribute to the wide deployment of state-of-the-art cyber security products and solutions across the economy , by carrying out the following tasks:

4.

contribute to the wide deployment of state-of-the-art and sustainable cyber security products and processes across the Union , by carrying out the following tasks:

(a)

stimulating cybersecurity research, development and the uptake of Union cybersecurity products and solutions by public authorities and user industries ;

(a)

stimulating cybersecurity research, development and the uptake of Union cybersecurity products and holistic processes throughout the entire innovation cycle, by, inter alia, public authorities , the industry and the market ;

(b)

assisting public authorities, demand side industries and other users in adopting and integrating the latest cyber security solutions ;

(b)

assisting public authorities, demand side industries and other users in increasing their resilience by adopting and integrating state-of-the-art cybersecurity products and processes ;

(c)

supporting in particular public authorities in organising their public procurement, or carrying out procurement of state-of-the-art cybersecurity products and solutions on behalf of public authorities;

(c)

supporting in particular public authorities in organising their public procurement, or carrying out procurement of state-of-the-art cybersecurity products and processes on behalf of public authorities , including by providing support for procurement, to increase the security of and the benefits from public investment ;

(d)

providing financial support and technical assistance to cybersecurity start-ups and SMEs to connect to potential markets and to attract investment;

(d)

providing financial support and technical assistance to cybersecurity start-ups and SMEs , micro-enterprises, individual experts, commonly used Free and Open Source Software projects, and civic tech projects, to enhance expertise on cybersecurity, connect to potential markets and deployment opportunities, and to attract investment;

5.

improve the understanding of cybersecurity and contribute to reducing skills gaps in the Union related to cybersecurity by carrying out the following tasks:

5.

improve the understanding of cybersecurity and contribute to reducing skills gaps and strengthening the level of skills in the Union related to cybersecurity by carrying out the following tasks:

(-a)

(a)

supporting further development of cybersecurity skills, where appropriate together with relevant EU agencies and bodies including ENISA.

(a)

supporting further development , pooling, and sharing of cybersecurity skills and competences at all relevant educational levels, supporting the objective of achieving gender balance, facilitating a common high level of cybersecurity knowledge and contributing to the resilience of users and infrastructures throughout the Union in cooperation with the Network and , where appropriate , aligning with relevant EU agencies and bodies including ENISA;

(a)

providing financial support to cybersecurity research efforts based on a common, continuously evaluated and improved multiannual strategic, industrial, technology and research agenda ;

(a)

providing financial support to cybersecurity research efforts based on a common, continuously evaluated and improved multiannual strategic, industrial, technology and research plan referred to in Article 13 ;

(b)

support large-scale research and demonstration projects in next generation cybersecurity technological capabilities, in collaboration with the industry and the Network;

(b)

supporting large-scale research and demonstration projects in next generation cybersecurity technological capabilities, in collaboration with the industry , the academic and research community, public sector and authorities, including the Network and the Community ;

(ba)

ensuring respect for fundamental rights and ethical conduct in cybersecurity research projects supported by the Competence Centre;

(bb)

monitoring reports of vulnerabilities discovered by the Community and facilitating the disclosure of vulnerabilities, the development of patches, fixes and solutions, and the distribution of those;

(bc)

monitoring research results regarding self-learning algorithms used for malicious cyber activities in collaboration with ENISA and supporting the implementation of Directive (EU) 2016/1148;

(bd)

supporting research in the field of cybercrime;

(be)

supporting the research and development of products and processes that can be freely studied, shared, and built upon, in particular in the field of verified and verifiable hardware and software, in close cooperation with the industry, the Network and the Community;

(c)

support research and innovation for standardisation in cybersecurity technology

(c)

support research and innovation for formal and non-formal standardisation and certification in cybersecurity technology , linking to the existing work and where appropriate in close cooperation with the European Standardisation Organisations, certification bodies and ENISA;

(ca)

provide special support to SMEs by facilitating their access to knowledge and training through tailored access to the deliverables of research and development reinforced by the Competence Centre and the Network in order to increase competitiveness;

7.

enhance cooperation between the civil and defence spheres with regard to dual use technologies and applications in cybersecurity, by carrying out the following tasks:

7.

enhance cooperation between the civil and defence spheres with regard to dual use technologies and applications in cybersecurity, by carrying out the following tasks , which shall be reactive and defensive cyber defence technology, applications and services :

8.

enhance synergies between the civil and defence dimensions of cybersecurity in relation to the European Defence Fund by carrying out the following tasks:

8.

enhance synergies between the civil and defence dimensions of cybersecurity in relation to the European Defence Fund by carrying out the following tasks , which shall be reactive and defensive cyber defence technology, applications and services :

(ba)

assisting and providing advice to the Commission with regard to the implementation of Regulation (EU) 2019/XXX [recast of Regulation (EC) No 428/2009 as proposed by COM(2016)0616].

8a.

(a)

rules governing the operation of an infrastructure or capability, including where relevant entrusting the operation to a hosting entity based on criteria that the Competence Centre shall define;

(a)

specific rules governing the operation of an infrastructure or capability, including where relevant entrusting the operation to a hosting entity based on criteria that the Competence Centre shall define;

(ba)

specific rules governing different phases of implementation;

(bb)

that as a result of Union contribution, access is as open as possible and as closed as necessary, and re-use is possible.

(a)

supporting the Competence Centre in achieving its objectives and in particular in coordinating the Cybersecurity Competence Community;

(a)

supporting the Competence Centre in achieving its objectives and in particular in establishing and coordinating the Cybersecurity Competence Community;

(b)

facilitating the participation of industry and other actors at the Member State level in cross-border projects;

(b)

promoting, encouraging and facilitating the participation of civil society, industry , in particular start-ups and SMEs, academic and research community and other actors at the Member State level in cross-border projects;

(ba)

in cooperation with other entities with similar tasks, operating as a one-stop-shop for cybersecurity products and processes financed through other Union programmes like InvestEU or the Single Market Programme, in particular for SMEs;

(c)

contributing, together with the Competence Centre, to identifying and addressing sector-specific cyber security industrial challenges;

(c)

contributing, together with the Competence Centre, to identifying and addressing sector-specific cyber security challenges;

(ca)

cooperating closely with National Standardisation Organisations to promote the uptake of existing standards and to involve all relevant stakeholders, particularly SMEs, in setting new standards;

(e)

seeking to establish synergies with relevant activities at the national and regional level;

(e)

seeking to establish synergies with relevant activities at the national, regional and local level;

(fa)

promoting and disseminating a common minimal cybersecurity educational curricula in cooperation with the relevant bodies in the Member States;

(g)

promoting and disseminating the relevant outcomes of the work by the Network, the Cybersecurity Competence Community and the Competence Centre at national or regional level;

(g)

promoting and disseminating the relevant outcomes of the work by the Network, the Cybersecurity Competence Community and the Competence Centre at national, regional or local level;

(h)

assessing requests by entities established in the same Member State as the Coordination Centre for becoming part of the Cybersecurity Competence Community.

(h)

assessing requests by entities and individuals established in the same Member State as the Coordination Centre for becoming part of the Cybersecurity Competence Community.

(a)

research;

(a)

academia or research;

(ca)

ethics;

(cb)

formal and technical standardisation and specifications.

(5a)

(a)

adopt a multi-annual strategic plan, containing a statement of the major priorities and planned initiatives of the Competence Centre, including an estimate of financing needs and sources;

(a)

adopt a multi-annual strategic plan, containing a statement of the major priorities and planned initiatives of the Competence Centre, including an estimate of financing needs and sources , taking into account advice provided by ENISA ;

(b)

adopt the Competence Centre's work plan, annual accounts and balance sheet and annual activity report, on the basis of a proposal from the Executive Director;

(b)

adopt the Competence Centre's work plan, annual accounts and balance sheet and annual activity report, on the basis of a proposal from the Executive Director , taking into account advice provided by ENISA ;

(e)

adopt the criteria and procedures for assessing and accrediting the entities as members of the Cybersecurity Competence Community;

(e)

adopt the procedures for assessing and accrediting the entities as members of the Community;

(ea)

adopt the working arrangements referred to in Article 10(2);

(ga)

adopt transparency rules for the Competence Centre;

(i)

establish working groups with members of the Cybersecurity Competence Community;

(i)

establish working groups with members of the Community , taking into account advice provided by the permanent observers ;

(l)

promote the Competence Centre globally, so as to raise its attractiveness and make it a world-class body for excellence in cybersecurity ;

(l)

promote the cooperation of the Competence Centre with global actors ;

(r)

adopt an anti-fraud strategy that is proportionate to the fraud risks having regard to a cost-benefit analysis of the measures to be implemented;

(r)

adopt an anti-fraud and anti-corruption strategy that is proportionate to the fraud and corruption risks having regard to a cost-benefit analysis of the measures to be implemented , as well as adopt comprehensive protection measures for persons reporting on breaches of Union law in accordance with applicable Union legislation ;

(s)

adopt the methodology to calculate the financial contribution from Member States;

(s)

adopt an extensive definition of financial contributions from Member States and a methodology to calculate the amount of Member States ’ voluntary contributions that can be accounted for as financial contributions in accordance with that definition, such a calculation being executed at the end of every financial year ;

(a)

governance and organisation of the Competence Centre and the Network;

(b)

allocation of budget for the Competence Centre and the Network;

(c)

joint actions by several Member States, possibly complemented by Union budget further to decision allocated in accordance with point (b).

(c)

after consultation with the Governing Board and the Commission, prepare and submit for adoption to the Governing Board the draft multiannual strategic plan and the draft annual work plan of the Competence Centre including the scope of the calls for proposals, calls for expressions of interest and calls for tenders needed to implement the work plan and the corresponding expenditure estimates as proposed by the Member States and the Commission;

(c)

after consultation with the Governing Board , the Industrial and Scientific Advisory Board, ENISA, and the Commission, prepare and submit for adoption to the Governing Board the draft multiannual strategic plan and the draft annual work plan of the Competence Centre including the scope of the calls for proposals, calls for expressions of interest and calls for tenders needed to implement the work plan and the corresponding expenditure estimates as proposed by the Member States and the Commission;

(h)

prepare an action plan following-up on the conclusions of the retrospective evaluations and reporting on progress every two years to the Commission

(h)

prepare an action plan following-up on the conclusions of the retrospective evaluations and reporting on progress every two years to the Commission and the European Parliament;

(l)

approve the list of actions selected for funding on the basis of the ranking list established by a panel of independent experts;

(l)

after consulting the Industrial and Scientific Advisory Board and ENISA, approve the list of actions selected for funding on the basis of the ranking list established by a panel of independent experts;

(s)

prepare an action plan following-up conclusions of internal or external audit reports, as well as investigations by the European Anti-Fraud Office (OLAF) and reporting on progress twice a year to the Commission and regularly to the Governing Board;

(s)

prepare an action plan following-up conclusions of internal or external audit reports, as well as investigations by the European Anti-Fraud Office (OLAF) and reporting on progress twice a year to the Commission and the European Parliament and regularly to the Governing Board;

(v)

ensure effective communication with the Union's institutions;

(v)

ensure effective communication with the Union's institutions and report, upon request, to the European Parliament and to the Council ;

(1)

provide to the Executive Director and the Governing Board strategic advice and input for drafting the work plan and multi-annual strategic plan within the deadlines set by the Governing Board;

(1)

provide to the Executive Director and the Governing Board strategic advice and input for deployment by, orientation and operations of the Competence Centre as far as industry and research is concerned, and drafting the work plan and multi-annual strategic plan within the deadlines set by the Governing Board;

(1a)

(3)

promote and collect feedback on the work plan and multi-annual strategic plan of the Competence Centre.

(3)

promote and collect feedback on the work plan and multi-annual strategic plan of the Competence Centre and advise the Governing Board on how to improve the Competence Centre’s strategic orientation and operation .

(a)

EUR 1 981 668 000 from the Digital Europe Programme, including up to EUR 23 746 000 for administrative costs;

(a)

EUR 1 780 954 875 in 2018 prices (EUR 1 998 696 000 in current prices) from the Digital Europe Programme, including up to EUR 21 385 465 in 2018 prices ( EUR 23 746 000 in current prices) for administrative costs;

(ba)

an amount from the European Defence Fund for defence-related actions of the Competence Centre, including for all related administrative costs such as costs that the Competence Centre may incur when acting as a project manager for actions carried out under the European Defence Fund.

(a)

participating Member States' financial contributions to the administrative costs;

(a)

the Union's and participating Member States' financial contributions to the administrative costs;

(b)

participating Member States' financial contributions to the operational costs;

(b)

the Union's and participating Member States' financial contributions to the operational costs;

(ca)

Articles 22 [Ownership of results], 23 [Ownership of results] and 30 [Application of the rules on classified information] of Regulation (EU) 2019/XXX [European Defence Fund] shall apply to participation in all defence-related actions by the Competence Centre, when provided for in the work plan, and the grant of non-exclusive licenses may be limited to third parties established or deemed to be established in Members States and controlled by Member States and/or nationals of Member States.