European UnionCyber Solidarity Act, European Cybersecurity Alert System, Cybersecurity Emergency Mechanism and Incident Review Mechanism
Regulation (EU) 2025/38, Arts. 3 to 21
In force since .
A sector security regimes rule binding government bodies.
- Private right of action
- No
- Obligation class
- Governance, Security
As of .
What it requires
- It binds the Member States, the Commission, ENISA and the Union bodies it names, and a private managed security service provider meets its criteria in the procurement for the EU Cybersecurity Reserve (Article 17(2)); it has applied since .
- A Member State that decides to participate in the European Cybersecurity Alert System designates or establishes a National Cyber Hub (Article 4(1)) and ensures a high level of cybersecurity, including confidentiality, data security and physical security, of the network (Article 8(1)).
- The members of a Hosting Consortium ensure that their National Cyber Hubs share relevant information among themselves within the Cross-Border Cyber Hub, in accordance with the written consortium agreement (Article 6(1)).
- A user of the EU Cybersecurity Reserve takes all appropriate measures to mitigate the effects of the incident for which it requests support (Article 15(2)).
- ENISA, at the request of the Commission or EU-CyCLONe and with the approval of the Member States concerned, reviews and assesses a specific significant or large-scale cybersecurity incident and delivers an incident review report (Article 21(1)).
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- RS.MI-01Incidents are contained
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- At what point does an incident become a significant, large-scale or large-scale-equivalent cybersecurity incident, the only kinds of incident for which a user may use EU Cybersecurity Reserve services under Article 16(8), and who determines that?
What this law does
Article 3(1) of Regulation (EU) 2025/38 establishes the European Cybersecurity Alert System as a pan-European network of National Cyber Hubs and Cross-Border Cyber Hubs that join on a voluntary basis. Article 4(1) requires a Member State that decides to participate in the European Cybersecurity Alert System to designate or, where applicable, establish a National Cyber Hub.
Article 8(1) requires Member States participating in the European Cybersecurity Alert System to ensure a high level of cybersecurity, including confidentiality and data security, as well as physical security of the network. Article 6(1) requires the members of a Hosting Consortium to ensure that their National Cyber Hubs share relevant information among themselves within the Cross-Border Cyber Hub, in accordance with the written consortium agreement.
Article 12(1) has the Cybersecurity Emergency Mechanism support the voluntary coordinated preparedness testing of entities operating in sectors of high criticality. Article 12(7) requires the Member State authority responsible for the coordinated preparedness testing, where appropriate, to review the follow-up of the measures that a voluntarily participating entity could integrate into a remediation plan.
Article 14(3) names the users of the EU Cybersecurity Reserve as the cyber crisis management authorities and CSIRTs of the Member States, CERT-EU, and the competent authorities of third countries associated with the Digital Europe Programme. Article 15(2) requires a user of the EU Cybersecurity Reserve, to receive support, to take all appropriate measures to mitigate the effects of the incident for which the support is requested.
Article 17(2), point (j), has the contracting authority require a provider in the EU Cybersecurity Reserve, once a European cybersecurity certification scheme for managed security services is in place, to be certified under it within 2 years from the date of application of the scheme.
Article 21(1) requires ENISA, at the request of the Commission or EU-CyCLONe and with the approval of the Member States concerned, to review and assess cyber threats, known exploitable vulnerabilities and mitigation actions with respect to a specific significant cybersecurity incident or large-scale cybersecurity incident. ENISA then delivers an incident review report to EU-CyCLONe, the CSIRTs network, the Member States concerned and the Commission.
Article 21(3) bars the report from including any details about actively exploited vulnerabilities that remain unpatched. Article 26 provides that the Regulation enters into force on the twentieth day following that of its publication in the Official Journal of the European Union.