Towards an Efficient and Coherent Regulatory Framework on Cybersecurity in the EU: The Proposals for a NIS 2.0 Directive and a Cyber Resilience Act

in Applied Cybersecurity & Internet Governance (2022), 1(1),

Cybersecurity regulation in the EU has long been implemented in a piece- meal fashion resulting in a fragmented regulatory landscape. Recent developments triggered the EU to review its approach which has ... [more ▼]

Cybersecurity regulation in the EU has long been implemented in a piece- meal fashion resulting in a fragmented regulatory landscape. Recent developments triggered the EU to review its approach which has not resulted in the envisaged high level of cyber resilience across the Union. The paper addresses the EU’s limited mandate to regulate cybersecurity and outlines how the internal market rationale serves as a basis to harmonise cybersecurity legislation in the EU Member States. In that regard, the recent Proposal for a NIS 2.0 Directive (adopted by the European Parliament in November 2022) and the Proposal for a Cyber Resilience Act (published in September 2022) highlight how the EU seeks to align legislation and reduce complexity between different, often sectoral regulatory approaches to cybersecurity, while at the same time extending regulation in a view to achieve a high level of cybersecurity across the EU. As regards the latter, the paper also outlines how the Cyber Resilience Act will complement the NIS 2.0 Directive in order to close existing regulatory gaps. [less ▲]

One step ahead: mapping the Italian and German cybersecurity laws against the proposal for a NIS2 directive

in International Cybersecurity Law Review (2022)

With the COVID-19 pandemic accelerating digital transformation of the Single Market, the European Commission also speeded up the review of the first piece of European Union (EU)-wide cybersecurity ... [more ▼]

With the COVID-19 pandemic accelerating digital transformation of the Single Market, the European Commission also speeded up the review of the first piece of European Union (EU)-wide cybersecurity legislation, the NIS Directive. Originally foreseen for May 2021, the Commission presented the review as early as December 2020 together with a Proposal for a NIS2 Directive. Almost in parallel, some Member States strengthened (or adopted) national laws beyond the scope of the NIS Directive to respond adequately to the fast-paced digital threat landscape. Against this backdrop, the article investigates the national interventions in the field of cybersecurity recently adopted by Italy and Germany. In order to identify similarities and divergences of the Italian and German national frameworks with the European Commission’s Proposal for a NIS2 Directive, the analysis will focus on selected aspects extrapolated from the Commission Proposal, namely: i) the enlarged scope; ii) detailed cybersecurity risk-management measures; iii) more stringent supervisory measures; and, iv) stricter enforcement requirements, including harmonised sanctions across the EU. The article concludes that the national cybersecurity legal frameworks under scrutiny already match the core of the proposed changes envisaged by the NIS2 Proposal. [less ▲]

A Cybersecurity Incident: Who You Gonna Call?

Scientific Conference (2022, May 25)

Every Student Can Learn, Just not on the Same Day: An Analysis of Data Protection and Cybersecurity Challenges for E-Learning Platforms in the COVID19 Crisis

in European Journal of Law and Technology (2022), 13(1),

To Report, or Not to Report, that Is the Question! The Struggle in Determining a Report-Worthy Cyber Incident

Scientific Conference (2022, April 13)

SMART: a Technology Readiness Methodology in the Frame of the NIS Directive

E-print/Working paper (2022)

Cybersecurity is Gaining Momentum – NIS 2.0 Is on its Way

in European Data Protection Law Review (2021), (4), 580-585

Wenn Sicherheitsinteressen kollidieren – Technische und rechtliche Implikationen einer verpflichtenden Zugriffsmöglichkeit auf verschlüsselte Daten durch Behörden

E-print/Working paper (2021)

Study to support the review of Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union (NIS Directive), No. 2020-665

Report (2021)

Don’t Tell Them now (or at all) – Responsible Disclosure of Security Incidents under NIS Directive and GDPR

in International Review of Law, Computers and Technology (2021), 35(2),