What does the new EU legislation on mandatory cyber security provide?

The new Cyber ​​Security Act makes digital device manufacturers and software developers more accountable: they will have to report vulnerabilities and attacks and try to prevent them better

 The European Commission has presented a new proposal relating to the Cyber ​​Resilience ActThe old regulation was approved in June 2019 and entered into force in September of the same year, but new tools are already needed to ensure the cybersecurity of businesses and consumers.

By introducing a new regulatory framework to the Cyber ​​Resilience Act, Europe intends to make companies that supply digital products design them more securely. Additionally, manufacturers will be required to provide security support and software updates to address vulnerabilities .

On the other hand, consumers will be offered more information on the IT security of the products they are going to buy, so as to make them more aware during the purchase phase.

The reason for this intervention, which regulates producers' responsibilities in more detail, is based on the ever-increasing volume of ransomware attacks which in 2021 alone amounted to 1 attack every 11 seconds and total damage estimated at 5.5 billion . euros all over the world.

New Cyber ​​Resilience Act: what changes for producers and consumers

The new Cyber ​​Resilience Act , as it was presented (and unless there are changes in the discussion between the Council and the European Parliament), bears greater responsibility for manufacturers regarding the design of hardware devices , but also of software .

In detail, there are four points that specifically address cybersecurity:

  • A package of cybersecurity regulations that will regulate the placing on the market of new digital products
  • Introduction of a package of standards describing the essential requirements for design, development and manufacturing and defining the obligations of companies and vendors
  • Definition of the essential requirements and obligations adopted by manufacturers of digital products to manage vulnerabilities throughout the life cycle. It will also be up to manufacturers to report vulnerabilities that have been the subject of attacks and what kind of incidents there have been
  • Package of rules and their application on market surveillance

Basically, and in a nutshell, if the new regulation passes, the manufacturers of devices and developers of apps, operating systems and software of all kinds will have to guarantee that they have designed the product or service in a way that is intrinsically safe and, moreover, , will have to ensure continuous security updates .

They will also need to ensure that they have a structure that can handle and fix any problems and bugs that arise after the software is released or the hardware is commercialized (so-called " zero-day " vulnerabilities).

Cyber ​​Resilience Act: what changes for consumers

With the identification and assignment of the responsibilities of the producers of the good design of electronic devices and software, consumers and companies are guaranteed, at least in theory, both a better protection of data and privacy , and greater transparency regarding the characteristics security of digital products.

Furthermore, as manufacturers will have to provide information on what they have done to make the product (or service, or software) secure, consumers should theoretically be able to choose between a safer and a less secure product / service / software, and between one with better or worse guarantees of assistance in the event of a hacker attack.

Cyber ​​Resilience Act: when it comes into effect

The new package of Cyber ​​Resilience Act laws will be discussed by both the European Parliament and the Council. Then when passed, the new Cyber ​​Resilience Act will be adopted by member states and manufacturers will have two years to comply.

For manufacturers, on the other hand, there will be only one year for the adoption of the obligation to report actively exploited vulnerabilities and incidents.

Post a Comment

Previous Post Next Post