DCMS publish call for views on EU Cybersecurity Act

The Department for Digital, Culture, Media and Sport (DCMS) has published a Call for Views on the UK’s proposed approach to cyber security certification, as currently regulated under the EU Cybersecurity Act, following the UK’s departure from the EU. 

Background

The EU Cyber Security Act entered into force on 27th June 2019. It provides the EU Cyber Security Agency (ENISA) with a strengthened and permanent mandate and establishes a cyber security certification framework under which EU-wide cyber security certification schemes will be developed and implemented.

The UK has previously operated a number of assurance schemes involving certification, such as Common Criteria and Commercial Product Assurance, and also participates in two mutual recognition arrangements which are based on Common Criteria, including CCRA and SOG-IS MRA.

The EU Cyber Security Act looks to harmonise those certification schemes operated within the EU.   The Act does not introduce directly operational certification schemes but creates a framework which allows voluntary cyber security certification schemes to be established and recognised across the EU.

These certification schemes would attest that the ICT products, services and processes that have been evaluated comply with specified security requirements. Connected and automated cars, electronic medical devices, industrial automation control systems and smart grids are provided as some examples of sectors in which certification is already widely used or is likely to be used in the near future.

The framework requires that each certification scheme:

  • is designed to achieve a number of security objectives as set out in the Act
  • may specify one or more assurance levels (basic, substantial, high)
  • may allow for conformity self-assessment
  • includes a number of other elements such as: scope, reference to standards, evaluation criteria, conditions for marks or labels, rules concerning vulnerability disclosure, validity period, conditions for mutual recognition with third countries
  • provides supplementary cybersecurity information as set out in the Act

The UK’s Proposed Approach

The UK is committed to maintaining a close relationship with the EU on cyber security following our departure from the EU and will seek to cooperate on approaches to cyber security certification with the EU.

The EU recognises in the Cyber Security Act that supply chains are global and that the introduction of certification schemes should seek to reduce market fragmentation. The Regulation therefore makes provision for mutual recognition arrangements on specific schemes to be agreed with third countries, with cyber security certification schemes implemented under the framework specifying conditions for such agreements.

It is the UK’s understanding that such arrangements would mean that there is provision within the Act for the UK and the EU to mutually recognise one another’s cyber security certification schemes, meaning that UK issued certificates would serve the same purpose in EU markets as EU issued certificates and vice versa.

The UK will therefore seek to enter into negotiations with the EU on mutual recognition arrangements under the terms set out by those schemes. The UK would look to work with experts and industry on the potential for entering into such arrangements for future certification schemes, as and when they are proposed, through its own stakeholder consultation groups which will consider each scheme on a sector by sector basis. 

It is proposed that the UK would look to ensure that the following principles are applied when determining its approach to each EU scheme proposal:

  • that the proposed EU scheme has been assessed by the relevant UK Government authority and the NCSC to be in the interests of improved cyber security
  • that it meets a consumer need and there is clear demand from UK consumers of the certified product, service or process for the UK to engage in the scheme
  • that is provides economic advantage to UK business, with a cost benefit analysis showing an evidence based economic benefit to UK business
  • that the proposed scheme is open and transparent

It is the understanding of the UK Government that even if the UK does not engage or develop a mutual recognition approach for a specific EU scheme this will not necessarily preclude UK companies from gaining EU certification for their products or services via an EU member state. This will depend on the conditions set out within each individual scheme.

The Government is seeking views on this proposed approach and techUK will be responding on behalf of its members.  If you have any views or supporting evidence to this approach, please send them in to Dan Patefield (dan.patefield@techuk.org) by the close of play on Monday 30 September. 

 

  • Talal Rajab

    Talal Rajab

    HEAD OF PROGRAMME | CYBER AND NATIONAL SECURITY
    T 020 7331 2189
  • Dan Patefield

    Dan Patefield

    Programme Manager | Defence and Cyber
    T 020 7331 2165

Share this

FROM SOCIAL MEDIA

We at #techUK are proud to celebrate this #LivingWageWeek as an accredited #LivingWage Employer! @LivingWageUK https://t.co/a0DLEmHPXA
Read the comment from our @techUKCEO in response to Labour's plans to part nationalise BT https://t.co/m2OrUaWk4e https://t.co/F9kJc7NgWJ
We're running a free SME Strategy Breakthrough Workshop with AddVantage Strategy on 05 December. Providing members… https://t.co/tzWApo8DmR
techUK's final Introductory Evening of 2019 will be on 09 December. Join us to discover more about techUK, meet the… https://t.co/fH68uSR7ng
User trust in government and business has time and again been the watch word across discussions @SommetGovTech No different in #healthtech
@idatin calls for user centred design as a priority to overcome systemic challenges. Rune Simensen echoes the calls… https://t.co/g3dUpMjDNt
Scores on the doors universally low: 3, 3, 2 and a cautious 6.
Health 2.0: Transforming Healthcare Through Technology @SommetGovTech #healthtechuk @JulietBauer asks the panel to… https://t.co/j4YBfvdiRY
Fascinating discussion on the future of payments and what government can learn from fintech @SommetGovTech https://t.co/CagvVn2Dbr
#GovTechSummit assembled a stellar panel on established the conditions for Europe’s GovTech moment @SerbianPMhttps://t.co/5ikt3qrNIX
Become a Member
×

Become a techUK Member

By becoming a techUK member we will help you grow through:

Click here to learn more...