In a hyperconnected world, is the EU cybersecurity framework connected?

Abstract

This article sheds light on the fast-evolving and ever more complex EU cybersecurity policy. It shows that horizontal and sector-specific regulation are being developed simultaneously. It identifies the gaps and investigates to what extent the new Cyber Resilience Act and other policy instruments might address them. It first reviews the stock of existing EU legislation before examining the relevant industry standards for cybersecurity and the Internet of Things. It also reviews stakeholders’ expectations for the Cyber Resilience Act and identifies the need for horizontal legislation, setting flexible but binding rules. We argue for horizontal standards (process-based) that are complemented by sector-specific (vertical) standards. Finally, we propose a governance and enforcement model to make the cybersecurity framework better coordinated and more adequate for tackling the ever-evolving cybersecurity threat landscape.