Managed security services [EU Legislation in Progress]

Written by Mar Negreiro (2nd edition, updated on 29.10.2024).

Managed security services are services carrying out or providing assistance for activities relating to customers’ cybersecurity risk management. They are gaining increasing importance in the prevention and mitigation of cybersecurity incidents. Yet they were not included in the scope of the EU cybersecurity certification framework in the 2019 Cybersecurity Act. As some Member States have begun adopting certification schemes for managed security services that are divergent or inconsistent, there is a need to avoid fragmentation in the internal market. The present proposal therefore includes targeted amendments to the scope of the Cybersecurity Act, seeking to enable managed security services schemes by means of Commission implementing acts.

In the European Parliament, the file has been assigned to the Committee on Industry, Research and Energy (ITRE). ITRE adopted its report on 25 October 2023. On 9 November 2023, the committee decision to enter into interinstitutional negotiations was confirmed by plenary. Trilogue negotiations started on 4 December 2023. On 6 March 2024, the EU co-legislators reached a provisional agreement on the file, which was adopted by Parliament in first reading on 24 April 2024. The text still needs to be formally adopted by the Council before it can enter into force.

Versions

• October 2023: Managed security services (2nd edition)