ENISA Seeks Feedback on EU Managed Security Services Certification Scheme
Summary
ENISA is consulting on a draft EU certification scheme for managed security services. It proposes common baseline requirements and service-specific criteria, initially focused on incident response, and supports services provided under the EU Cybersecurity Reserve.
Key points
- ENISA developed the candidate scheme at the European Commission’s request under the EU Cybersecurity Act.
- The draft uses a horizontal layer of baseline requirements and a vertical layer of service-specific requirements.
- Baseline requirements cover service and platform design, deployment, availability, operations, and continuous improvement.
- The current draft focuses on the Incident Management Lifecycle and its Incident Response service profile, with three assurance levels: basic, substantial, and high.
- Providers delivering services under the EU Cybersecurity Reserve will need EUMSS certification within two years once the scheme is in place.
- ENISA invited public feedback through 13 September 2026.
Article Details
- Event Type
- Public consultation on ENISA’s candidate European certification scheme for Managed Security Services (EUMSS).
- Impact
- The draft proposes common baseline requirements, three assurance levels, and service-specific requirements, currently focused on Incident Response. It is intended to harmonise certification, support cross-border service provision, and reinforce EU crisis-response capabilities. Providers delivering services under the EU Cybersecurity Reserve will need EUMSS certification within two years after the scheme is in place.