Cybersecurity Act (CSA)

About

Recitals

TITLE I – General Provisions (Art. 1-2)
Art. 1CSA - Subject matter and scope
Art. 2CSA - Definitions
TITLE II / Chapter I – Mandate and objectives (Art. 3-4)
Art. 3CSA - Mandate
Art. 4CSA - Objectives
Chapter II – Tasks (Art. 5-12)
Art. 5CSA - Development and implementation of Union policy and law
Art. 6CSA - Capacity-building
Art. 7CSA - Operational cooperation at Union level
Art. 8CSA - Market, cybersecurity certification, and standardisation
Art. 9CSA - Knowledge and information
Art. 10CSA - Awareness-raising and education
Art. 11CSA - Research and innovation
Art. 12CSA - International cooperation
Chapter III – Organisation of ENISA (Art. 13-28)
Art. 13CSA - Structure of ENISA
Art. 14CSA - Composition of the Management Board
Art. 15CSA - Functions of the Management Board
Art. 16CSA - Chairperson of the Management Board
Art. 17CSA - Meetings of the Management Board
Art. 18CSA - Voting rules of the Management Board
Art. 19CSA - Executive Board
Art. 20CSA - Duties of the Executive Director
Art. 21CSA - ENISA Advisory Group
Art. 22CSA - Stakeholder Cybersecurity Certification Group
Art. 23CSA - National Liaison Officers Network
Art. 24CSA - Single programming document
Art. 25CSA - Declaration of interests
Art. 26CSA - Transparency
Art. 27CSA - Confidentiality
Art. 28CSA - Access to documents
Chapter IV – Establishment and structure of ENISA’s budget (Art. 29-33)
Art. 29CSA - Establishment of ENISA’s budget
Art. 30CSA - Structure of ENISA’s budget
Art. 31CSA - Implementation of ENISA’s budget
Art. 32CSA - Financial rules
Art. 33CSA - Combating fraud
Chapter V – Staff (Art. 34-37)
Art. 34CSA - General provisions
Art. 35CSA - Privileges and immunity
Art. 36CSA - Executive Director
Art. 37CSA - Seconded national experts and other staff
Chapter VI – General provisions concerning ENISA (Art. 38-45)
Art. 38CSA - Legal status of ENISA
Art. 39CSA - Liability of ENISA
Art. 40CSA - Language arrangements
Art. 41CSA - Protection of personal data
Art. 42CSA - Cooperation with third countries and international organisations
Art. 43CSA - Security rules on the protection of sensitive non-classified information and classified information
Art. 44CSA - Headquarters Agreement and operating conditions
Art. 45CSA - Administrative control
TITLE III – Cybersecurity certification network (Art. 46-65)
Art. 46CSA - European cybersecurity certification framework
Art. 47CSA - The Union rolling work programme for European cybersecurity certification
Art. 48CSA - Request for a European cybersecurity certification scheme
Art. 49CSA - Preparation, adoption and review of a European cybersecurity certification scheme
Art. 50CSA - Website on European cybersecurity certification schemes
Art. 51CSA - Security objectives of European cybersecurity certification schemes
Art. 52CSA - Assurance levels of European cybersecurity certification schemes
Art. 53CSA - Conformity self-assessment
Art. 54CSA - Elements of European cybersecurity certification schemes
Art. 55CSA - Supplementary cybersecurity information for certified ICT products, ICT services and ICT processes
Art. 56CSA - Cybersecurity certification
Art. 57CSA - National cybersecurity certification schemes and certificates
Art. 58CSA - National cybersecurity certification authorities
Art. 59CSA - Peer review
Art. 60CSA - Conformity assessment bodies
Art. 61CSA - Notification
Art. 62CSA - European Cybersecurity Certification Group
Art. 63CSA - Right to lodge a complaint
Art. 64CSA - Right to an effective judicial remedy
Art. 65CSA - Penalties
TITLE IV – Final provisions (Art. 66-69)
Art. 66CSA - Committee procedure
Art. 67CSA - Evaluation and review
Art. 68CSA - Repeal and succession
Art. 69CSA - Entry into force
Annexes
Art. Annex ICSA - Annex

Chapter V – Staff (Art. 34-37)

Art. 34 CSA – General provisions

The Staff Regulations of Officials and the Conditions of Employment of Other Servants, as well as the rules adopted by agreement between the Union institutions for giving effect to the Staff Regulations of Officials and the Conditions of Employment of Other Servants shall apply to the staff of ENISA.
Art. 35 CSA – Privileges and immunity
Protocol No 7 on the privileges and immunities of the European Union, annexed to the TEU and to the TFEU, shall apply to ENISA and its staff.
Art. 36 CSA – Executive Director
1. The Executive Director shall be engaged as a temporary agent of ENISA under point (a) of Article 2 of the Conditions of Employment of Other Servants.
2. The Executive Director shall be appointed by the Management Board from a list of candidates proposed by the Commission, following an open and transparent selection procedure.
3. For the purpose of concluding the employment contract with the Executive Director, ENISA shall be represented by the Chairperson of the Management Board.
4. Before appointment, the candidate selected by the Management Board shall be invited to make a statement before the relevant committee of the European Parliament and to answer Members’ questions.
5. The term of office of the Executive Director shall be five years. By the end of that period, the Commission shall carry out an assessment of the performance of the Executive Director and ENISA’s future tasks and challenges.
6. The Management Board shall reach decisions on appointment, extension of the term of office or removal from office of the Executive Director in accordance with Article 18(2).
7. The Management Board, acting on a proposal from the Commission which takes into account the assessment referred to in paragraph 5, may extend the term of office of the Executive Director once by five years.
8. The Management Board shall inform the European Parliament about its intention to extend the Executive Director’s term of office. Within three months before any such extension, the Executive Director, if invited, shall make a statement before the relevant committee of the European Parliament and answer Members’ questions.
9. An Executive Director whose term of office has been extended shall not participate in another selection procedure for the same post.
10. The Executive Director may be removed from office only by decision of the Management Board acting on a proposal from the Commission.
Show Related Recitals
- Recital CSA 57
  The Management Board, composed of the representatives of the Member States and of the Commission, should establish the general direction of ENISA’s operations and ensure that it carries out its tasks in accordance with this Regulation. The Management Board should be entrusted with the powers necessary to establish the budget, verify the execution of the budget, adopt appropriate financial rules, establish transparent working procedures for decision making by ENISA, adopt ENISA’s single programming document, adopt its own rules of procedure, appoint the Executive Director and decide on the extension and termination of the Executive Director’s term of office.
- Recital CSA 59
  The smooth functioning of ENISA requires that its Executive Director be appointed on grounds of merit and documented administrative and managerial skills, as well as competence and experience relevant to cybersecurity. The duties of the Executive Director should be carried out with complete independence. The Executive Director should prepare a proposal for ENISA’s annual work programme, after prior consultation with the Commission, and should take all steps necessary to ensure the proper implementation of that work programme. The Executive Director should prepare an annual report to be submitted to the Management Board, covering the implementation of ENISA’s annual work programme, draw up a draft statement of estimates of revenue and expenditure for ENISA, and implement the budget. Furthermore, the Executive Director should have the option of setting up ad hoc working groups to address specific matters, in particular matters of a scientific, technical, legal or socioeconomic nature. In particular, in relation to the preparation of a specific candidate European cybersecurity certification scheme (‘candidate scheme’), the setting up of an ad hoc working group is considered to be necessary. The Executive Director should ensure that the members of ad hoc working groups are selected according to the highest standards of expertise, aiming to ensure gender balance and an appropriate balance, according to the specific issues in question, between the public administrations of the Member States, the Union institutions, bodies, offices and agencies and the private sector, including industry, users, and academic experts in network and information security.
Art. 37 CSA – Seconded national experts and other staff
1. ENISA may make use of seconded national experts or other staff not employed by ENISA. The Staff Regulations of Officials and the Conditions of Employment of Other Servants shall not apply to such staff.
2. The Management Board shall adopt a decision laying down rules on the secondment of national experts to ENISA.
Show Related Recitals
- Recital CSA 21
  In order to be able to provide adequate support to the operational cooperation between Member States, ENISA should further strengthen its technical and human capabilities and skills. ENISA should increase its know-how and capabilities. ENISA and Member States, on a voluntary basis, could develop programmes for seconding national experts to ENISA, creating pools of experts and staff exchanges.

Chapter IV - Establishment and structure of ENISA’s budget (Art. 29-33)

Chapter VI - General provisions concerning ENISA (Art. 38-45)

AI

Proposal

Final

Consumer & E-commerce

Proposal

Final

Cybersecurity

Proposal

Final

Data

Proposal

Final

Digital Privacy

Proposal

Final

Digital Services

Proposal

Final

Cybersecurity Act (CSA)

About

Chapter V – Staff (Art. 34-37)