European Parliament calls for stricter Cybersecurity requirements.

Negotiations on the Cybersecurity Package, presented by the European Commission in January, are progressing in the European Parliament. On 8 October, rapporteur Markéta Gregorová (Greens/EFA) presented her draft reports on the Cybersecurity Act 2 (CSA 2) and the amendments to the NIS 2 Directive in the lead Committee on Industry, Research and Energy (ITRE). While broadly supporting the Commission’s objectives, she proposes more far-reaching measures, particularly regarding the security of critical supply chains and cybersecurity certification.

Stricter requirements for critical ICT supply chains

One of the main priorities of CSA 2 is to reduce security risks in information and communication technology (ICT) supply chains. These include, for example, manufacturers and suppliers of hardware and software used in digital systems. Security risks can arise when individual components contain vulnerabilities that allow unauthorised access to sensitive data and systems.

The Commission’s proposal provides for a harmonised European framework aimed, in particular, at reducing dependencies on high-risk suppliers from third countries. Gregorová, however, proposes a different approach: While the Commission envisages initially assessing security risks associated with specific third countries, her proposal would focus on directly assessing individual suppliers. This would allow potential risks to be identified more precisely, regardless of a company's country of origin, and help prevent circumvention through intermediaries or licensing agreements.

The scope of risk assessments would also be expanded. In addition to telecommunications networks, other critical technologies would be covered, including smart electricity meters, routers, inverters and medical imaging equipment.

Cybersecurity certification to become more binding

The draft report also goes beyond the Commission’s proposal regarding the European Cybersecurity Certification Framework. Cybersecurity certification provides assurance that digital products, services and processes meet defined security requirements and are adequately protected against cyberattacks.

While the Commission primarily aims to make certification procedures faster, more flexible and more transparent, Gregorová advocates making certification mandatory as a general rule.

This would strengthen compliance with common European security requirements but could also introduce additional obligations for providers and users of digital products and services.

Simplifying Cybersecurity incident reporting obligations

Another key priority is the simplification of existing cybersecurity incident reporting obligations. Currently, companies and organisations may be required to report the same security incident to different authorities under several pieces of EU legislation. This can lead to duplicate reporting and additional administrative burdens.

To simplify these procedures, the Commission had already proposed a central reporting point at the European Union Agency for Cybersecurity (ENISA) as part of the Digital Omnibus package. Gregorová seeks to strengthen this approach further: Companies and organisations should be able to report security incidents through a single point of contact, thereby fulfilling their obligations under several EU legal acts simultaneously. These include, for example, the NIS 2 Directive on cybersecurity and the General Data Protection Regulation (GDPR), which establishes reporting obligations in the event of personal data breaches.

The proposed amendments to the NIS 2 Directive are also intended to provide greater legal clarity, reduce administrative burdens and ensure more consistent application of European cybersecurity requirements.

Relevance for German Social Insurance

For German Social Insurance, the proposed changes to cybersecurity certification, the security of critical ICT supply chains and cybersecurity incident reporting are particularly relevant. Social insurance institutions process large volumes of sensitive personal data while also having to comply with complex and, in some cases, overlapping European and national reporting obligations in the event of security incidents.

The planned central reporting point at ENISA offers an opportunity to avoid duplicate reporting and reduce the administrative burden on social insurance institutions. From the perspective of German Social Insurance, it is therefore important to ensure that the various European cybersecurity rules are aligned and that existing national reporting procedures are adequately taken into account. The further parliamentary deliberations should aim to combine a high level of cybersecurity with reporting procedures that are as simple and practical as possible.

Next steps in the European Parliament.

The deadline for amendments to both draft reports expired on 13 October. Members of the European Parliament will now discuss possible compromises before the ITRE Committee adopts its position. A date for the committee vote has not yet been set.