The EU Policy on Cyber Defence

24. 11. 2022

• Government Information Security Office

On November 10, the Commission and the High Representative put forward a Joint Communication on an EU Cyber Defence policy and an Action Plan on Military Mobility 2.0 to address the deteriorating security environment following Russia's aggression against Ukraine and to boost the EU's capacity to protect its citizens and infrastructure.

With its new cyber defence policy, the EU will enhance cooperation and investments in cyber defence to better protect, detect, deter, and defend against a growing number of cyber-attacks that call for more action to protect citizens, armed forces, as well as the EU's civilian and military missions and operations, against cyber threats.

The EU Policy on Cyber Defence aims to boost EU cyber defence capabilities and strengthen coordination and cooperation between the civilian and military cyber communities. It will enhance efficient cyber crisis management within the EU and help reduce strategic dependencies in critical cyber technologies, while strengthening the European Defence Technological Industrial Base (EDTIB). It will also stimulate training, attracting, and retaining cyber talents and step-up cooperation with partners in the field of cyber defence.

The EU Policy on Cyber Defence is built around four pillars that cover a wide range of initiatives that will help the EU and Member States. Better and stronger cooperation between the civilian and military actors is the common thread running across all these pillars:

• Act together for a stronger EU cyber defence: The EU will reinforce its coordination mechanisms among national and EU cyber defence players, to increase information exchange and cooperation between civilian and military cybersecurity communities, and further support military CSDP missions and operations.
• Secure the EU defence ecosystem: Even non-critical software components can be used to carry out cyber-attacks on companies or governments, including in the defence sector. This calls for further work on cybersecurity standardisation and certification to secure both civilian and military domains.
• Invest in cyber defence capabilities: Member States need to significantly increase investments in modern military cyber defence capabilities in a collaborative manner, using the cooperation platforms and funding mechanisms available at the EU level, such as PESCO, the European Defence Fund.
• Partner to address common challenges: Building on existing security and defence as well as cyber dialogues with partner countries, the EU will seek to set up tailored partnerships in the area of cyber defence.

As everything is interconnected, lines between the civilian and military dimensions of cyberspace are blurred. This is especially seen in relation to cyber-attacks on critical infrastructure, which affect both communities. Thus, cooperation between civilian, diplomatic and law enforcement cyber communities and their defence counterparts will bring high added value to all players concerned. It is therefore crucial to enable such collaboration. In this regard, cyber situation and analysis centre is being set up in the Commission with the support of the European Union Agency for Cybersecurity (ENISA) and CERT-EU to provide analysis and more effective crisis management support.

Moreover, the interdependency between physical and digital infrastructure, and the potential for significant cybersecurity incidents to disrupt or damage critical infrastructure illustrate even more, that the EU needs close military and civilian cooperation in cyberspace to become a stronger security provider for its citizens. Since armed forces depend to a large extent on civilian critical infrastructure, be it for mobility, communications or energy, the new EU Policy on Cyber Defence aims at enabling the cyber defence community to benefit from stronger civilian and military detection and situational awareness capabilities. Therefore, at the request of the Council, the Commission, the High Representative, and the NIS Cooperation Group are developing risk scenarios for digital infrastructure security.

The Commission will also prepare an EU Cyber Solidarity Initiative to strengthen common EU detection of cyber threats and incidents and situational awareness, as well as preparedness and response capabilities. This would include the testing of essential entities operating critical infrastructure for potential vulnerabilities based on EU risk assessments - building on actions already started together with ENISA - as well as incident response actions to mitigate the impact of serious incidents, to support immediate recovery and/or restore the functioning of essential services.

In the next steps, the Commission and the High Representative, including in his capacity as Head of the European Defence Agency (EDA), will present an annual report to the Council of the EU to monitor and assess the progress of the implementation of the actions in the Joint Communication on the EU Policy on Cyber Defence. Member States are encouraged to contribute with their inputs on the progress of the implementation measures taking place in national or in cooperation formats.