EU proposes to create a joint IT unit for better response to large-scale incidents

The European Commission presented a vision to build a new joint IT unit to address the growing number of serious cyber incidents affecting public services and the lives of businesses and citizens across the European Union. Advanced and coordinated cybersecurity responses are increasingly necessary as cyber-attacks grow in number, scale and impact, seriously affecting the security of all. 

The EU calls for a collective readiness to respond and exchange relevant information on a "need to communicate" basis, not just on a "need to know" basis.

The joint IT unit proposed on Wednesday and announced by President Ursula von der Leyen in her political guidelines, aims to bring together the resources and expertise available to the EU and its Member States to effectively prevent, deter and respond to massive cyber crises and cyber incidents. Cybersecurity stakeholders, including civilian, law enforcement, diplomatic, cyber defence and private sector partners too often work separately. Alongside the joint IT unit, they will have a virtual and physical platform for cooperation: relevant EU institutions, bodies, offices and agencies, in cooperation with Member States, will gradually create a European platform for solidarity and assistance to fight large-scale cyber-attacks.

The recommendation on the creation of the joint IT unit is an important step towards the completion of the European cyber security crisis management framework. It is a concrete outcome of the EU Cybersecurity Strategy and the European Security Union Strategy contributing to a secure digital economy and society.

As part of this package, the Commission reported on progress made in recent months on the Security Union Strategy. In addition, the Commission and the High Representative of the Union for Foreign Affairs and Security Policy presented the first implementation report on the Cybersecurity Strategy, as requested by the European Council, while publishing the fifth progress report on the implementation of the 2016 Common Framework for Combating Hybrid Threats and the 2018 Joint Communication 'Building Resilience and Developing Capacities to Address Hybrid Threats'. Finally, the Commission adopted the decision establishing the European Union Agency for Cybersecurity (ENISA) in Brussels, in accordance with the Cybersecurity Regulation

The joint IT unit will function as a platform to ensure a coordinated EU response to large-scale cyber incidents and cyber crises, and to provide assistance in recovering from such attacks. The EU and Member States currently have numerous stakeholders in different areas and sectors. While the areas may be specific, the threats are often common, so there is a need for coordination, knowledge sharing and even early warning.

Participants will be asked to provide operational resources for mutual assistance within the joint IT unit. The JIT will allow them to exchange best practices and real-time information on threats that may arise in their respective areas. It will also work at operational and technical level to fulfil the EU cyber security incident and crisis response plan, based on national plans; set up and mobilise EU cyber security rapid reaction teams; facilitate the adoption of mutual assistance protocols between participants; build national and international monitoring and detection capabilities, such as security operations centres; and have other activities.

The EU cybersecurity ecosystem is large and diverse and, thanks to the joint IT unit, there will now be a common space for collaboration between different groups and domains, allowing existing networks to realise their full potential. It builds on the work started in 2017 with the recommendation on a coordinated response to incidents and crises, the so-called master plan.

The Commission proposes to set up the common IT unit through a gradual and transparent process with four steps, on the basis of shared responsibility with Member States and the various entities active in this area. The objective is to ensure that this unit is operational by 30 June 2022 and fully established one year later, by 30 June 2023 at the latest. The European Union Agency for Cybersecurity (ENISA) will act as the secretariat in the preparatory phase and the unit will operate close to its offices in Brussels and the office of CERT-EU, the Computer Emergency Response Team of the EU institutions, bodies, offices and agencies.

The Commission will provide the necessary investments for the setting up of the joint IT unit, mainly under the Digital Europe programme. The funds will be used to set up the physical and virtual platform, to create and maintain secure communication channels, and to improve detection capabilities. The European Defence Fund could contribute, in particular to enhance Member States' cyber defence capabilities.