At the request of the European Commission, ENISA (EU agency dedicated to enhancing cybersecurity in Europ) has developed a candidate certification scheme for Managed Security Services.\u00a0ENISA has found that cybersecurity investment increasingly focuses on technology and outsourcing rather than internal cybersecurity teams. The EUMSS scheme will address current diversity and fragmentation in the approach and requirements that apply to the delivery of managed security services in EU Member States.<\/p>\n\n\n\n
ENISA Executive Director,\u00a0Juhan Lepassaar<\/strong>, said:\u00a0\u201cCommon baselines can guarantee a level of confidence in services offered. This scheme can offer Member States trust in the services that reinforce their prevention and response capabilities, especially in the context of the EU Cybersecurity Reserve.”<\/p>\n\n\n\n A close up to the draft scheme<\/strong><\/p>\n\n\n\n The draft of the EUMSS scheme builds on existing European cybersecurity certification practices and assessment methodologies.<\/p>\n\n\n\n The scheme follows a layered approach, consisting of a horizontal and a vertical layer. <\/p>\n\n\n\n The horizontal layer outlines a common set of baseline requirements applicable to all Managed Security Services to be certified under this scheme. These baseline requirements apply as a mandatory prerequisite for each certified service profile. These are the same for all three established assurance levels (i.e. ‘basic’, ‘substantial’, and ‘high’) and cover the following domains: <\/p>\n\n\n\n The vertical layer defines service-specific requirements applicable to particular managed security services and the services profiles included in these services. The present version of the scheme focuses on the \u2018Incident Management Lifecycle\u2019 vertical and more specifically to the \u2018Incident Response\u2019 service profile.<\/p>\n\n\n\n Reinforcing trust in the EU Cybersecurity Reserve<\/strong><\/p>\n\n\n\n The development of the scheme can further support the EU Cybersecurity Reserve<\/a>, as providers delivering services under the umbrella of the EU Cybersecurity Reserve have to be certified in accordance with the EUMSS within 2 years once the scheme is in place. <\/p>\n\n\n\n The draft scheme is designed to provide a harmonised and proportionate framework that supports cross-border service provision and Union-level crisis response capabilities. <\/p>\n\n\n\n The context behind the development of the scheme<\/p>\n\n\n\n