Cybersecurity Act: an initial signal sent by Europe

Cybersecurity Act: finally, a Europe with cybersecurity? I Stormshield

With the adoption of the Cybersecurity Act a few months ago, Europe was taking a new step forward in cybersecurity by adopting a common framework. Strengthening the powers of the European Network and Information Security Agency (ENISA), European certification... what can we expect from these regulations?

More restrictive than the existing recognition agreements (Common Criteria Certification (CCRA), SOG-IS agreement or “EU Restricted” Certification), this new framework strengthens the European Union's position on cybersecurity issues. This will enable its Member States to stand united against the cyber-attacks they are undergoing.

Laying the foundations for a common future for security

In addition to the weight given to the European Network and Information Security Agency (ENISA), the Cybersecurity Act will improve the overall level of security across Europe by setting common certification rules. A company that has obtained certification in Italy will now be able to use this "European label" in France, Spain or Germany without taking any further steps in these countries.

These certifications are accompanied by a shared frame of reference with three security levels: basic, substantial and high. These three levels reflect a dimension of trust in IT solutions or services, including connected objects - whether consumer or more technical (such as connected medical devices, for example).

Differentiating between IT and security solutions

In contrast, national certifications - such as ANSSI in France - focus on the level of trust in cybersecurity solutions, such as smart cards, digital certificates or other cybersecurity products. Nuance is paramount when distinguishing between IT solutions and cybersecurity solutions. Since European certifications are designed for a broader scope than cybersecurity alone, their level of requirement is necessarily lower. This is enough to generate some reservations at the present time.

In France, the leading country in terms of digital security, the main concern is that the highest level of European certifications would correspond to the lowest level of French certifications. A blur that could represent a real risk to cybersecurity, favouring less reliable solutions than others. To protect against this, each country of the European Union will be able to maintain sovereign national levels in parallel with European certification. In particular, France, through ANSSI, maintains - beyond certification - its own qualification levels (basic, standard, enhanced), required to operate in national critical infrastructures such as OIVs (Operators of Vital Importance). In short, the solutions already certified by ANSSI - such as those of Stormshield - would therefore already correspond to a level of certification higher than or equal to the European requirement.

While some details related to the implementation of the Cybersecurity Act still need to be refined, this regulation is a good indicator for European cybersecurity. Beyond short-term harmonisation, this legislation will help to shape a more secure digital future.

Share on

European or national certification, regulations specific to your market... It is not easy to find your way around. To get a clearer picture, we have designed a guide with an entry specific to your sector of activity.
There are several types of labelling: Common Criteria Certification, First Level Security Certification (CSPN), and Qualification, which may itself be Basic, Standard, or Enhanced. So how do we find our way around?

About the author

mm
Stéphane Prevost
Product Marketing Manager, Stormshield

After 10 years building his IT and R&D experience, Stéphane joined Stormshield in March 2008 as a Product Manager. With this dual skillset in cybersecurity and product marketing, he now helps promote Stormshield products in his role as Product Marketing Manager. His curiosity, creativity and experience help him create accessible, sharp messaging around security products.