23 Amendments of Kathleen VAN BREMPT related to 2017/0225(COD)
Amendment 244 #
Proposal for a regulation
Article 4 – paragraph 1
Article 4 – paragraph 1
1. The Agency shall be a centre of expertise on theoretical and practical cybersecurity by virtue of its independence, the scientific and technical quality of the advice and assistance it delivers and the information it provides, the transparency of its operating procedures and methods of operation, and its diligence in carrying out its tasks.
Amendment 254 #
Proposal for a regulation
Article 4 – paragraph 5
Article 4 – paragraph 5
5. The Agency shall increase cybersecurity capabilities at Union level in order to complement the action of Member States in preventing and responding to cyber threats, notably in the event of cross- border incidents, and in order to carry out its task of assisting Union institutions in developing policies related to cybersecurity.
Amendment 262 #
Proposal for a regulation
Article 4 – paragraph 6
Article 4 – paragraph 6
6. The Agency shall promote the use of certification, including by contributing to the establishment and maintenance of a cybersecurity certification framework at Union level in accordance with Title III of this Regulation, with a view to increasing transparency of cybersecurity assurance of ICT products and servic, services and processes and thus strengthen trust in the digital internal market.
Amendment 269 #
Proposal for a regulation
Article 4 – paragraph 7
Article 4 – paragraph 7
7. The Agency shall promote a high level of cyber hygiene and awareness of citizens and businesses on issues related to the cybersecurity.
Amendment 272 #
Proposal for a regulation
Article 5 – paragraph 1 – point 1
Article 5 – paragraph 1 – point 1
1. assisting and advising, in particular by providing its independent opinion and analysis of relevant activities in cyberspace and supplying preparatory work, on the development and review of Union policy and law in the area of cybersecurity, as well as sector-specific policy and law initiatives where matters related to cybersecurity are involved;
Amendment 276 #
Proposal for a regulation
Article 5 – paragraph 1 – point 2 a (new)
Article 5 – paragraph 1 – point 2 a (new)
2 a. assisting Member States to implement consistently the Union policy and law regarding data protection notably in relation to Regulation (EU) 2016/679, as well as assisting the European Data Protection Board (EDPB) in the development of guidelines related to the implementation of Regulation (EU) 2016/679 for cybersecurity purposes. The EDPB should be required to consult ENISA every time it issues an opinion or adopts a decision concerning the implementation of the GDPR and cybersecurity, in particular on, but not limited to, issues related to privacy impact assessments, data breach notification, security processing, security requirements, and privacy by design.
Amendment 299 #
Proposal for a regulation
Article 7 – paragraph 5 – subparagraph 1
Article 7 – paragraph 5 – subparagraph 1
Upon a request by twoone or more Member States concerned, and with the sole purpose of providing assistance either in the form of advice for the prevention of future incidents , or in the form of assisting in the response to a current large scale incidents, the Agency shall provide support to or carry out an ex-post technical enquiry following notifications by affected undertakings of incidents having a significant or substantial impact pursuant to Directive (EU) 2016/1148. The Agency shall perform the above activities by receiving relevant information from the affected Member States and by utilising its own resources on threat analysis as well as resources on incident response made available from CERT EU for that purpose. The Agency shall also carry out such an enquiry upon a duly justified request from the Commission in agreement with the concerned Member States in case of such incidents affecting more than twoone Member States.
Amendment 304 #
Proposal for a regulation
Article 7 – paragraph 7
Article 7 – paragraph 7
7. The Agency shall prepare a regular and in-depth EU Cybersecurity Technical Situation Report on incidents and threats based on open source information, its own analysis, and reports shared by, among others: Member States' CSIRTs (on a voluntary basis) or NIS Directive Single Points of Contact (in accordance with NIS Directive Article 14 (5)); European Cybercrime Centre (EC3) at Europol, CERT-EU. The Executive Director shall present the public findings to the European Parliament.
Amendment 307 #
Proposal for a regulation
Article 7 – paragraph 8 – point a
Article 7 – paragraph 8 – point a
(a) analyzing and aggregating reports from national sources with a view to contribute to establishing common situational awareness;
Amendment 308 #
Proposal for a regulation
Article 7 – paragraph 8 – point c
Article 7 – paragraph 8 – point c
(c) supporting the technical handling of an incident or crisis, based on its own independent expertise and resources including facilitating the sharing of technical solutions between Member States;
Amendment 310 #
Proposal for a regulation
Article 7 – paragraph 8 – point e a (new)
Article 7 – paragraph 8 – point e a (new)
(e a) assisting Member States and Union institutions in establishing and developing an EU Cybersecurity Crisis Response Framework integrating the objectives and modalities of cooperation suggested in the [Commission Recommendation on Coordinated Response to Large Scale Cybersecurity Incidents and Crisis from 13.9.2017].
Amendment 313 #
Proposal for a regulation
Article 7 – paragraph 8 – point e b (new)
Article 7 – paragraph 8 – point e b (new)
(e b) assisting Member States and Union Institutions in developing and adopting a common taxonomy and template for situational reports to describe technical causes and impacts of cybersecurity incidents to further enhance their technical and operational cooperation during crisis.
Amendment 316 #
Proposal for a regulation
Article 7 a (new)
Article 7 a (new)
Article 7 a Technical capabilities of the Agency For meeting the objectives described in Articles 5, 6 and 7 the Agency shall develop among others the following technical capabilities and skills: 1. The ability to analyse threat information data at large scale 2. The ability to conduct forensic analysis on devices and terminal equipment 3. The ability to analyse malware, indicators of compromise and other information related to a cybersecurity threat or incident 4. The ability to collect information on cybersecurity threats from open source as well as commercial sources 5. The ability to deploy technical equipment, tools and expertise remotely and on-site at the request of a Member State in case of Article 7 paragraph 5 and paragraph 8 To meet the technical capabilities described in this Article the Agency shall ensure that its recruitment processes reflect the diverse technical skills required. To meet the technical capabilities described in this Article and develop the relevant skills, the Agency shall cooperate with CERT EU and Europol in accordance to Article 7 paragraph 2.
Amendment 318 #
Proposal for a regulation
Article 8 – paragraph 1 – point a – introductory part
Article 8 – paragraph 1 – point a – introductory part
(a) support and promote the development and implementation of the Union policy on cybersecurity certification of ICT products and servic, services and processes, as established in Title III of this Regulation, by:
Amendment 325 #
Proposal for a regulation
Article 8 – paragraph 1 – point a – point 1
Article 8 – paragraph 1 – point a – point 1
(1) preparing candidate European cybersecurity certification schemes for ICT products and servic, services and processes in accordance with Article 44 of this Regulation;
Amendment 334 #
Proposal for a regulation
Article 8 – paragraph 1 – point a – point 3
Article 8 – paragraph 1 – point a – point 3
(3) compiling and publishing guidelines and developing good practices and cyber hygiene principles concerning the cybersecurity requirements of ICT products and, services, and processes in cooperation with national certification supervisory authorities and the industry;
Amendment 357 #
Proposal for a regulation
Article 9 – paragraph 1 – point g a (new)
Article 9 – paragraph 1 – point g a (new)
(g a) support closer coordination and exchange of best practices among Member States on cybersecurity education, training and skills development, cyber hygiene and awareness.
Amendment 370 #
Proposal for a regulation
Article 13 – paragraph 4
Article 13 – paragraph 4
4. The term of office of members of the Management Board and of their alternates shall be fourive years. That term shall be renewable.
Amendment 371 #
Proposal for a regulation
Article 15 – paragraph 1
Article 15 – paragraph 1
The Management Board shall elect by a majority of two-thirds of members its Chairperson and a Deputy Chairperson from among its members for a period of fourive years, which shall be renewable once. If, however, their membership of the Management Board ends at any time during their term of office, their term of office shall automatically expire on that date. The Deputy Chairperson shall ex officio replace the Chairperson if the latter is unable to attend to his or her duties.
Amendment 374 #
Proposal for a regulation
Article 18 – paragraph 3
Article 18 – paragraph 3
3. The Executive Board shall be composed of five members appointed from among the members of the Management Board amongst whom the Chairperson of the Management Board, who mayshall not also chair the Executive Board, and one of the representatives of the Commission. The Executive Director shall take part in the meetings of the Executive Board, but shall not have the right to vote.
Amendment 375 #
Proposal for a regulation
Article 18 – paragraph 4
Article 18 – paragraph 4
4. The term of office of the members of the Executive Board shall be fourive years. That term shall be renewable.
Amendment 376 #
Proposal for a regulation
Article 19 – paragraph 5 a (new)
Article 19 – paragraph 5 a (new)
5 a. The Executive Director shall be required to provide the relevant European Parliament Committees twice a year with a report on the state of cybersecurity in Europe. The Executive Director should also be invited by the Parliament to provide ENISA’s input on any EU legislative instrument imposing cybersecurity obligations.
Amendment 377 #
Proposal for a regulation
Article 19 – paragraph 5 b (new)
Article 19 – paragraph 5 b (new)
5 b. The Executive Director shall also be entitled to act as an institutional special adviser on cybersecurity policy to the President of the European Commission, with a mandate defined in Commission Decision C(2014) 541 of 06 February 2014.