Fostering cybersecurity in Europe through regulation

This paper discusses the first results of one of the four EU H2020 pilot projects launched to prepare the European Cybersecurity Competence Network. As demonstrated by the recent agreement between the European Parliament, the Council and the European Commission on the Cybersecurity Act, reinforcing cybersecurity is a primary goal for Europe. Nevertheless, from a legal standpoint, this result is not achieved through a general regulation. In Europe, several acts contribute in defining the cybersecurity legal framework. Against this background, this paper identifies the various provisions which, in different EU regulations and directives, contribute to create this framework. This analysis makes it possible to define the common security and data protection building blocks which characterize the EU regulatory patchwork. In this light, two of the main outcomes of this paper are (1) an overview of the potential overlaps concerning the existing legal obligations in the field of cybersecurity –e.g. notifications, certifications– and (2) the first outline of a general, comprehensive and cross-cutting map of legal obligations and procedures concerning cybersecurity. Although a clear map of these legal obligations is ever more important for the business community and public sector operators, the main goal of the authors is not limited to the analysis of the legal framework. The paper also focuses on the existing correlation between the legal framework and technology development in cybersecurity.