Image
Mandated by the Cybersecurity Act, the European Union Agency’s (ENISA’s) work is centered on achieving a “high common level of cybersecurity across the Union” and supporting the European Union and Member States to “increase their cybersecurity capabilities”.
Recent years have been characterised by a proliferation of EU cybersecurity policy framework and initiatives with the introduction of key horizontal and sectorial legislation, aiming to elevate the state of cybersecurity in the EU. At the same time, geopolitics and the emerging cybersecurity threats greatly influence the stance and tactics of state and non-state actors.
In this complex landscape, a comprehensive understanding of the current state of cybersecurity maturity of EU Member States is fundamental to achieve these objectives. Continuous and consistent monitoring of the cybersecurity levels across the EU over time, is the primary means of assessing current cybersecurity capabilities and identify areas of improvement in the EU cyber ecosystem.
In accordance to Article 18 of the Directive (EU) 2022/2555 (NIS2 Directive), ENISA was tasked to adopt, in cooperation with the European Commission and the Cooperation Group, a biennial report on the state of cybersecurity in the Union. In December 2024, the first ever version of this report will besubmitted and presented to the European Parliament. The aim of the report is to offer EU policy makers an evidence-based overview of the state of play with regard to the cybersecurity landscape and capabilities across the EU, national, and societal domains. The end product of the report is policy recommendations to address revealed gaps and weaknesses, leading to the improvement of the cybersecurity level in the Union.
From a cybersecurity investment perspective, allocating sufficient budgetary and human resources to cybersecurity is key to maintain existing cybersecurity capabilities and advancing cyber resilience. Through its NIS Investments report, ENISA offers insights on the impact of the EU cybersecurity framework, and particularly the NIS Directive, on cybersecurity investments and the overall maturity of organisations in scope. The annual report examines how essential and important entities of critical sectors are affected by the evolving regulatory landscape and current challenges in the cybersecurity field.
The EU Cybersecurity Index (EU CSI) - Framework and methodological note
Towards enhancing this effort, ENISA has developed the ‘EU Cybersecurity Index’ (EU CSI), which is a tool to describe the cybersecurity posture of Member States and the EU. Making the most of the available data and information, the ‘Index’ provides insights on the respective cybersecurity maturity and capabilities while helping detect opportunities for peer-learning and improvement. This way, it enables the evaluation of progress towards higher levels of cybersecurity vis-à-vis index indicators.
To find more, download the EU CSI - Framework and methodological note.
Public consultation
We invite all interested stakeholders to contribute their insights and feedback to help shape the further development of the EU-CSI framework and methodology. Please contact us at eucsi-feedback@enisa.europa.eu
