The EU’s New Cybersecurity Package: Enhancing Resilience in a Digital Age
On January 20, 2026, the European Commission rolled out an innovative Cybersecurity Package aimed at strengthening the EU’s cyber resilience in response to an increasingly complex and sophisticated threat landscape. This package comes at a time when digital threats are evolving at a rapid pace, making the need for robust cybersecurity measures more pressing than ever.
Introducing Cybersecurity Act 2.0
A cornerstone of this new Cybersecurity Package is the proposed Cybersecurity Act 2.0, which aims to revise the original 2019 Cybersecurity Act. This act is expected to play a pivotal role in enhancing the EU’s cybersecurity framework by addressing the contemporary challenges posed by cyber threats.
Key Enhancements to ENISA
One of the most significant developments within the new Cybersecurity Act is the expanded role of the European Union Agency for Cybersecurity (ENISA). Emphasizing proactive measures, ENISA will not only issue early alerts about cyber threats and incidents but also manage EU-level threat and incident repositories. This new mandate empowers ENISA to operate a unified incident notification platform and provide crucial support in responding to and recovering from ransomware attacks. Additionally, the agency will contribute to developing cybersecurity certification schemes tailored for the EU landscape.
A Simplified Cybersecurity Certification Framework
The updated Cybersecurity Package seeks to simplify and enhance the existing Cybersecurity Certification Framework established under the 2019 Act. This framework currently allows for the certification of various information and communication technology (ICT) products, services, and processes.
While certification will remain voluntary for businesses, there are three critical changes worth noting:
-
Expanded Certification Scope: Businesses will now have the option to certify their overall cybersecurity posture, creating a presumption of conformity with the NIS2 Directive and other relevant EU legislation.
-
Defined Procedures and Timelines: The proposal introduces clear procedures and timelines for developing new certification schemes. ENISA will have a default 12-month period to produce a candidate scheme following an EU Commission request.
-
Alignment with EU Regulations: The certification schemes will be aligned more closely with existing EU cybersecurity regulations, allowing businesses to utilize these frameworks as practical compliance tools.
Strengthening ICT Supply Chains
The new Cybersecurity Package also introduces a robust horizontal framework aimed at reinforcing the security of ICT supply chains across critical sectors. Recognizing the vulnerabilities present in the supply chain, the EU Commission will carry out EU-level risk assessments to identify potential threats.
These assessments will pinpoint critical ICT assets and evaluate both technical and non-technical risk factors, including any influence from third-party states. The framework will provide targeted mitigation measures, which could entail restrictions or prohibitions on using ICT components from suppliers classified as high-risk. This classification might include companies based in third countries flagged by the EU for cybersecurity concerns.
Legislative Path Ahead
As the Cybersecurity Package moves through the ordinary legislative procedure, there is still much to be discussed and refined. The timing of these discussions remains uncertain, but businesses must stay vigilant and proactive. Monitoring the progression of this Package is crucial, as it may significantly impact cybersecurity governance across the EU.
Organizations should begin assessing how the updated regulations will affect their cybersecurity practices, particularly in auditing their ICT supply chains. Emphasizing compliance and resilience now will prepare businesses for the evolving cybersecurity landscape.
Practical Considerations for Businesses
With the introduction of the Cybersecurity Package, businesses should:
- Audit Their Cybersecurity Posture: Evaluate current policies and practices in light of the proposed changes.
- Enhance Incident Response Plans: Prepare for new compliance requirements and ensure rapid responses to potential threats.
- Collaborate with ENISA: Engage with the European Union Agency for Cybersecurity to stay informed about emerging threats and best practices.
The new Cybersecurity Package represents a significant step toward a more resilient digital landscape in the EU. As threats continue to evolve, so too must our strategies and frameworks for securing the information and communication technologies that underpin our economies.
For more detailed information regarding the Cybersecurity Package and its implications, interested parties should follow the ongoing developments. This ensures that their organizations remain compliant and well-prepared for the future of cybersecurity regulation within the EU.