Cybersecurity & Resilience
EU Cybersecurity Act: what it regulates — and how it applies in Germany so far
Key takeaways
- The Act strengthens ENISA as an EU agency and introduces EU-wide cybersecurity certification schemes with defined assurance levels for ICT products, services and processes.
- Certification is voluntary in principle, but often becomes de facto mandatory through procurement, customer requirements or interaction with adjacent EU laws.
- In Germany, the BSI coordinates national certification and supervisory functions as the National Cybersecurity Certification Authority (NCCA), interfacing with accreditation and EU working structures.
- EU schemes (e.g. EUCC development, cloud/5G/related tracks) increasingly shape how vendors and buyers discuss evidence — especially alongside NIS2 and CRA conversations.
- Delivery requires cross-functional talent across secure development, certification logistics, procurement governance and audit-facing documentation.
The EU Cybersecurity Act (Regulation (EU) 2019/881) is a foundational EU piece: it anchors a permanent mandate for ENISA and creates a harmonised EU cybersecurity certification framework for ICT products, services and processes. For enterprises, the practical question is rarely the PDF alone — it is how certification language enters RFPs, release gates, cloud and OT procurement, and who coordinates product, security, legal and sourcing.
Not legal advice — involve qualified counsel for definitive positions.
Primary references:
- ENISA cybersecurity publications and EU cyber certification regulatory context
- Germany: BSI — EU Cyber Security Act overview and NCCA role
- Industry positioning: German industry associations (e.g. Bitkom) publish commentary on Cybersecurity Act revision — compare with official EU and BSI sources above.
Two pillars: ENISA permanence + certification infrastructure
ENISA provides policy support, situational awareness and coordination — a stable EU counterpart to national authorities like Germany’s BSI.
The certification framework defines how independent evaluation bodies assess offerings against EU schemes, issuing certificates with defined assurance levels (basic → substantial → high). The goal is portable recognition across Member States — especially valuable when fragmented national labels slowed markets.
Words you will see in enterprise architecture and legal reviews
- Scheme: the ruleset governing evaluation scope and rigour.
- Assurance level: depth and strength of evaluation — not a synonym for “security culture”.
- Voluntary vs required: legally voluntary can still be mandatory-in-practice via contracts.
- Evidence stacks: certificates are one artefact among logs, SDLC artefacts and supplier attestations.
Germany: BSI as NCCA
As National Cybersecurity Certification Authority, the BSI organises how European schemes land nationally — including supervision of conformity assessment behaviour (within the legal framework) and coordination with accreditation bodies. For multinational firms, German and EU tracks are parallel timelines that must be harmonised in programme management, not left to individual engineers alone.
Typical use patterns:
- Vendors seeking EU-wide acceptance for appliances, software appliances, secure elements.
- Financial and critical operators referencing certification language in security addenda.
- Public buyers mapping scheme coverage to framework agreements.
Revision dynamics
The EU is revisiting elements of the Cybersecurity Act — potential impacts on scheme rollout efficiency and alignment with neighbouring regimes such as the Cyber Resilience Act. Roadmaps from associations (e.g. Bitkom statements) help test procurement assumptions beyond today’s catalogue.
Deep dive: CRA + NIS2 interplay
The CRA focuses on digital product lifecycle security; the Cybersecurity Act framework supports certification infrastructure. Purchasing teams should not treat them as interchangeable checklists.
NIS2 remains organisation-centric — for a Germany-focused operational primer see our NIS2 article.
Executive checklist
Make certification a programme, not a PDF hunt
- Map portfolio SKUs/services that need cross-border assurance in 12–36 months.
- Pick scheme + assurance target with engineering — not procurement alone.
- Plan remediation cycles; evaluations surface real findings.
- Extend requirements to critical suppliers and MSSPs.
- Bind certificates into incident learning — not shelf artefacts.
Conclusion
The Cybersecurity Act is EU cybersecurity infrastructure: ENISA permanence plus credible certification grammar. In Germany that grammar lands through BSI/NCCA practice — and in boardrooms through RFP clauses that demand understandable evidence.
For hiring security and assurance leadership under regulatory pressure: cybersecurity recruitment — broader tech hiring via IT recruitment.
FAQ
- Yes — for example roles spanning Common Criteria / EUCC paths, supplier qualification, audit preparation and product security leadership. We align 12–24 month outcomes with clients, map stakeholders (procurement, product, security, legal) and run active searches including passive candidates; shortlists focus on demonstrable evidence work, not certificate badges alone.
- No. Schemes typically evaluate defined objects and assurance levels; an ISMS remains central for organisational control coverage and operating maturity. In practice both layers coexist.
- NIS2 focuses on organisational security measures and supply-chain governance; certificates can support evidence but do not replace scoping, risk management or reporting duties. See our NIS2 overview article linked below.