+REGULATION (EU) 2019/881 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) (Text with EEA relevance)
---+TITLE I GENERAL PROVISIONS
------+Article 1 Subject matter and scope
---------+Article 1 1.
---------+Article 1 2.
------+Article 2 Definitions
---+TITLE II ENISA (THE EUROPEAN UNION AGENCY FOR CYBERSECURITY)
------+CHAPTER I Mandate and objectives
---------+Article 3 Mandate
------------+Article 3 1.
------------+Article 3 2.
------------+Article 3 3.
------------+Article 3 4.
---------+Article 4 Objectives
------------+Article 4 1.
------------+Article 4 2.
------------+Article 4 3.
------------+Article 4 4.
------------+Article 4 5.
------------+Article 4 6.
------------+Article 4 7.
------+CHAPTER II Tasks
---------+Article 5 Development and implementation of Union policy and law
---------+Article 6 Capacity-building
------------+Article 6 1.
------------+Article 6 2.
---------+Article 7 Operational cooperation at Union level
------------+Article 7 1.
------------+Article 7 2.
------------+Article 7 3.
------------+Article 7 4.
------------+Article 7 5.
------------+Article 7 6.
------------+Article 7 7.
---------+Article 8 Market, cybersecurity certification, and standardisation
------------+Article 8 1.
------------+Article 8 2.
------------+Article 8 3.
------------+Article 8 4.
------------+Article 8 5.
------------+Article 8 6.
------------+Article 8 7.
---------+Article 9 Knowledge and information
---------+Article 10 Awareness-raising and education
---------+Article 11 Research and innovation
---------+Article 12 International cooperation
------+CHAPTER III Organisation of ENISA
---------+Article 13 Structure of ENISA
---------+Section 1 Management Board
------------+Article 14 Composition of the Management Board
---------------+Article 14 1.
---------------+Article 14 2.
---------------+Article 14 3.
---------------+Article 14 4.
------------+Article 15 Functions of the Management Board
---------------+Article 15 1.
---------------+Article 15 2.
---------------+Article 15 3.
------------+Article 16 Chairperson of the Management Board
------------+Article 17 Meetings of the Management Board
---------------+Article 17 1.
---------------+Article 17 2.
---------------+Article 17 3.
---------------+Article 17 4.
---------------+Article 17 5.
---------------+Article 17 6.
------------+Article 18 Voting rules of the Management Board
---------------+Article 18 1.
---------------+Article 18 2.
---------------+Article 18 3.
---------------+Article 18 4.
---------------+Article 18 5.
---------------+Article 18 6.
---------+Section 2 Executive Board
------------+Article 19 Executive Board
---------------+Article 19 1.
---------------+Article 19 2.
---------------+Article 19 3.
---------------+Article 19 4.
---------------+Article 19 5.
---------------+Article 19 6.
---------------+Article 19 7.
---------+Section 3 Executive Director
------------+Article 20 Duties of the Executive Director
---------------+Article 20 1.
---------------+Article 20 2.
---------------+Article 20 3.
---------------+Article 20 4.
---------------+Article 20 5.
---------+Section 4 ENISA Advisory Group, Stakeholder Cybersecurity Certification Group and National Liaison Officers Network
------------+Article 21 ENISA Advisory Group
---------------+Article 21 1.
---------------+Article 21 2.
---------------+Article 21 3.
---------------+Article 21 4.
---------------+Article 21 5.
---------------+Article 21 6.
------------+Article 22 Stakeholder Cybersecurity Certification Group
---------------+Article 22 1.
---------------+Article 22 2.
---------------+Article 22 3.
---------------+Article 22 4.
------------+Article 23 National Liaison Officers Network
---------------+Article 23 1.
---------------+Article 23 2.
---------------+Article 23 3.
---------------+Article 23 4.
---------------+Article 23 5.
---------+Section 5 Operation
------------+Article 24 Single programming document
---------------+Article 24 1.
---------------+Article 24 2.
---------------+Article 24 3.
---------------+Article 24 4.
---------------+Article 24 5.
---------------+Article 24 6.
---------------+Article 24 7.
---------------+Article 24 8.
------------+Article 25 Declaration of interests
---------------+Article 25 1.
---------------+Article 25 2.
---------------+Article 25 3.
------------+Article 26 Transparency
---------------+Article 26 1.
---------------+Article 26 2.
---------------+Article 26 3.
---------------+Article 26 4.
------------+Article 27 Confidentiality
---------------+Article 27 1.
---------------+Article 27 2.
---------------+Article 27 3.
---------------+Article 27 4.
------------+Article 28 Access to documents
---------------+Article 28 1.
---------------+Article 28 2.
---------------+Article 28 3.
------+CHAPTER IV Establishment and structure of ENISA’s budget
---------+Article 29 Establishment of ENISA’s budget
------------+Article 29 1.
------------+Article 29 2.
------------+Article 29 3.
------------+Article 29 4.
------------+Article 29 5.
------------+Article 29 6.
------------+Article 29 7.
---------+Article 30 Structure of ENISA’s budget
------------+Article 30 1.
------------+Article 30 2.
---------+Article 31 Implementation of ENISA’s budget
------------+Article 31 1.
------------+Article 31 2.
------------+Article 31 3.
------------+Article 31 4.
------------+Article 31 5.
------------+Article 31 6.
------------+Article 31 7.
------------+Article 31 8.
------------+Article 31 9.
------------+Article 31 10.
------------+Article 31 11.
------------+Article 31 12.
---------+Article 32 Financial rules
---------+Article 33 Combating fraud
------------+Article 33 1.
------------+Article 33 2.
------------+Article 33 3.
------------+Article 33 4.
------+CHAPTER V Staff
---------+Article 34 General provisions
---------+Article 35 Privileges and immunity
---------+Article 36 Executive Director
------------+Article 36 1.
------------+Article 36 2.
------------+Article 36 3.
------------+Article 36 4.
------------+Article 36 5.
------------+Article 36 6.
------------+Article 36 7.
------------+Article 36 8.
------------+Article 36 9.
------------+Article 36 10.
---------+Article 37 Seconded national experts and other staff
------------+Article 37 1.
------------+Article 37 2.
------+CHAPTER VI General provisions concerning ENISA
---------+Article 38 Legal status of ENISA
------------+Article 38 1.
------------+Article 38 2.
------------+Article 38 3.
---------+Article 39 Liability of ENISA
------------+Article 39 1.
------------+Article 39 2.
------------+Article 39 3.
------------+Article 39 4.
------------+Article 39 5.
---------+Article 40 Language arrangements
------------+Article 40 1.
------------+Article 40 2.
---------+Article 41 Protection of personal data
------------+Article 41 1.
------------+Article 41 2.
---------+Article 42 Cooperation with third countries and international organisations
------------+Article 42 1.
------------+Article 42 2.
------------+Article 42 3.
---------+Article 43 Security rules on the protection of sensitive non-classified information and classified information
---------+Article 44 Headquarters Agreement and operating conditions
------------+Article 44 1.
------------+Article 44 2.
---------+Article 45 Administrative control
---+TITLE III CYBERSECURITY CERTIFICATION FRAMEWORK
------+Article 46 European cybersecurity certification framework
---------+Article 46 1.
---------+Article 46 2.
------+Article 47 The Union rolling work programme for European cybersecurity certification
---------+Article 47 1.
---------+Article 47 2.
---------+Article 47 3.
---------+Article 47 4.
---------+Article 47 5.
------+Article 48 Request for a European cybersecurity certification scheme
---------+Article 48 1.
---------+Article 48 2.
------+Article 49 Preparation, adoption and review of a European cybersecurity certification scheme
---------+Article 49 1.
---------+Article 49 2.
---------+Article 49 3.
---------+Article 49 4.
---------+Article 49 5.
---------+Article 49 6.
---------+Article 49 7.
---------+Article 49 8.
------+Article 49a Information and consultation on the European cybersecurity certification schemes
---------+Article 49a 1.
---------+Article 49a 2.
---------+Article 49a 3.
---------+Article 49a 4.
------+Article 50 Website on European cybersecurity certification schemes
---------+Article 50 1.
---------+Article 50 2.
------+Article 51 Security objectives of European cybersecurity certification schemes for ICT products, ICT services and ICT processes
------+Article 51a Security objectives of European cybersecurity certification schemes for managed security services
------+Article 52 Assurance levels of European cybersecurity certification schemes
---------+Article 52 1.
---------+Article 52 2.
---------+Article 52 3.
---------+Article 52 4.
---------+Article 52 5.
---------+Article 52 6.
---------+Article 52 7.
---------+Article 52 8.
------+Article 53 Conformity self-assessment
---------+Article 53 1.
---------+Article 53 2.
---------+Article 53 3.
---------+Article 53 4.
---------+Article 53 5.
------+Article 54 Elements of European cybersecurity certification schemes
---------+Article 54 1.
---------+Article 54 2.
---------+Article 54 3.
---------+Article 54 4.
------+Article 55 Supplementary cybersecurity information for certified ICT products, ICT services and ICT processes
---------+Article 55 1.
---------+Article 55 2.
------+Article 56 Cybersecurity certification
---------+Article 56 1.
---------+Article 56 2.
---------+Article 56 3.
---------+Article 56 4.
---------+Article 56 5.
---------+Article 56 6.
---------+Article 56 7.
---------+Article 56 8.
---------+Article 56 9.
---------+Article 56 10.
------+Article 57 National cybersecurity certification schemes and certificates
---------+Article 57 1.
---------+Article 57 2.
---------+Article 57 3.
---------+Article 57 4.
------+Article 58 National cybersecurity certification authorities
---------+Article 58 1.
---------+Article 58 2.
---------+Article 58 3.
---------+Article 58 4.
---------+Article 58 5.
---------+Article 58 6.
---------+Article 58 7.
---------+Article 58 8.
---------+Article 58 9.
------+Article 59 Peer review
---------+Article 59 1.
---------+Article 59 2.
---------+Article 59 3.
---------+Article 59 4.
---------+Article 59 5.
---------+Article 59 6.
------+Article 60 Conformity assessment bodies
---------+Article 60 1.
---------+Article 60 2.
---------+Article 60 3.
---------+Article 60 4.
------+Article 61 Notification
---------+Article 61 1.
---------+Article 61 2.
---------+Article 61 3.
---------+Article 61 4.
---------+Article 61 5.
------+Article 62 European Cybersecurity Certification Group
---------+Article 62 1.
---------+Article 62 2.
---------+Article 62 3.
---------+Article 62 4.
---------+Article 62 5.
------+Article 63 Right to lodge a complaint
---------+Article 63 1.
---------+Article 63 2.
------+Article 64 Right to an effective judicial remedy
---------+Article 64 1.
---------+Article 64 2.
------+Article 65 Penalties
---+TITLE IV FINAL PROVISIONS
------+Article 66 Committee procedure
---------+Article 66 1.
---------+Article 66 2.
------+Article 67 Evaluation and review
---------+Article 67 1.
---------+Article 67 2.
---------+Article 67 3.
---------+Article 67 4.
------+Article 68 Repeal and succession
---------+Article 68 1.
---------+Article 68 2.
---------+Article 68 3.
---------+Article 68 4.
---------+Article 68 5.
---------+Article 68 6.
------+Article 69 Entry into force
---------+Article 69 1.
---------+Article 69 2.
---+ANNEX
|
English -
European Union -
ICT -
Cybersecurity -
REGULATION (EU) 2019/881 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) (Text with EEA relevance)
REGULATION (EU) 2019/881 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
of 17 April 2019
on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act)
(Text with EEA relevance)
This Regulation shall be binding in its entirety and directly applicable in all Member States.
1. Panoramica
| Titolo |
Regolamentazione |
|
TITLE I GENERAL PROVISIONS
|
TITLE I GENERAL PROVISIONS
|
|
TITLE II ENISA (THE EUROPEAN UNION AGENCY FOR CYBERSECURITY)
|
TITLE II ENISA (THE EUROPEAN UNION AGENCY FOR CYBERSECURITY)
|
|
TITLE III CYBERSECURITY CERTIFICATION FRAMEWORK
|
TITLE III CYBERSECURITY CERTIFICATION FRAMEWORK
|
|
TITLE IV FINAL PROVISIONS
|
TITLE IV FINAL PROVISIONS
|
|
ANNEX
|
ANNEX
REQUIREMENTS TO BE MET BY CONFORMITY ASSESSMENT BODIES
Conformity assessment bodies that wish to be accredited shall meet the following requirements:
1.
A conformity assessment body shall be established under national law and shall have legal personality.
▼M1
2.
A conformity assessment body shall be a third-party body that is independent of the organisation or the ICT products, ICT services, ICT processes or managed security services that it assesses.
3.
A body that belongs to a business association or professional federation representing undertakings involved in the design, manufacturing, provision, assembly, use or maintenance of ICT products, ICT services, ICT processes or managed security services which it assesses may be considered to be a conformity assessment body, provided that its independence and the absence of any conflict of interest are demonstrated.
4.
The conformity assessment bodies, their top level management and the persons responsible for carrying out the conformity assessment tasks shall not be the designer, manufacturer, supplier, installer, purchaser, owner, user or maintainer of the ICT product, ICT service, ICT process or managed security service which is assessed, or the authorised representative of any of those parties. That prohibition shall not preclude the use of the ICT products assessed that are necessary for the operations of the conformity assessment body or the use of such ICT products for personal purposes.
5.
The conformity assessment bodies, their top level management and the persons responsible for carrying out the conformity assessment tasks shall not be directly involved in the design, manufacture or construction, the provision, the marketing, installation, use or maintenance of the ICT products, ICT services, ICT processes or managed security services which are assessed, or represent parties engaged in those activities. The conformity assessment bodies, their top level management and the persons responsible for carrying out the conformity assessment tasks shall not engage in any activity that may conflict with their independence of judgement or integrity in relation to their conformity assessment activities. That prohibition shall apply, in particular, to consultancy services.
▼B
6.
If a conformity assessment body is owned or operated by a public entity or institution, the independence and absence of any conflict of interest shall be ensured between the national cybersecurity certification authority and the conformity assessment body, and shall be documented.
7.
Conformity assessment bodies shall ensure that the activities of their subsidiaries and subcontractors do not affect the confidentiality, objectivity or impartiality of their conformity assessment activities.
8.
Conformity assessment bodies and their staff shall carry out conformity assessment activities with the highest degree of professional integrity and the requisite technical competence in the specific field, and shall be free from all pressures and inducements which might influence their judgement or the results of their conformity assessment activities, including pressures and inducements of a financial nature, especially as regards persons or groups of persons with an interest in the results of those activities.
9.
A conformity assessment body shall be capable of carrying out all the conformity assessment tasks assigned to it under this Regulation, regardless of whether those tasks are carried out by the conformity assessment body itself or on its behalf and under its responsibility. Any subcontracting to, or consultation of, external staff shall be properly documented, shall not involve any intermediaries and shall be subject to a written agreement covering, among other things, confidentiality and conflicts of interest. The conformity assessment body in question shall take full responsibility for the tasks performed.
10.
▼M1
At all times and for each conformity assessment procedure and each type, category or sub-category of ICT products, ICT services, ICT processes or managed security services, a conformity assessment body shall have at its disposal the necessary:
▼B
(a)
staff with technical knowledge and sufficient and appropriate experience to perform the conformity assessment tasks;
(b)
descriptions of procedures in accordance with which conformity assessment is to be carried out, to ensure the transparency of those procedures and the possibility of reproducing them. It shall have in place appropriate policies and procedures that distinguish between tasks that it carries out as a body notified pursuant to Article 61 and its other activities;
▼M1
(c)
procedures for the performance of activities which take due account of the size of an undertaking, the sector in which it operates, its structure, the degree of complexity of the technology of the ICT product, ICT service, ICT process or managed security service in question and the mass or serial nature of the production process.
▼B
11.
A conformity assessment body shall have the means necessary to perform the technical and administrative tasks connected with the conformity assessment activities in an appropriate manner, and shall have access to all necessary equipment and facilities.
12.
The persons responsible for carrying out conformity assessment activities shall have the following:
(a)
sound technical and vocational training covering all conformity assessment activities;
(b)
satisfactory knowledge of the requirements of the conformity assessments they carry out and adequate authority to carry out those assessments;
(c)
appropriate knowledge and understanding of the applicable requirements and testing standards;
(d)
the ability to draw up certificates, records and reports demonstrating that conformity assessments have been carried out.
13.
The impartiality of the conformity assessment bodies, of their top-level management, of the persons responsible for carrying out conformity assessment activities, and of any subcontractors shall be guaranteed.
14.
The remuneration of the top-level management and of the persons responsible for carrying out conformity assessment activities shall not depend on the number of conformity assessments carried out or on the results of those assessments.
15.
Conformity assessment bodies shall take out liability insurance unless liability is assumed by the Member State in accordance with its national law, or the Member State itself is directly responsible for the conformity assessment.
16.
The conformity assessment body and its staff, its committees, its subsidiaries, its subcontractors, and any associated body or the staff of external bodies of a conformity assessment body shall maintain confidentiality and observe professional secrecy with regard to all information obtained in carrying out their conformity assessment tasks under this Regulation or pursuant to any provision of national law giving effect to this Regulation, except where disclosure is required by Union or Member State law to which such persons are subject, and except in relation to the competent authorities of the Member States in which its activities are carried out. Intellectual property rights shall be protected. The conformity assessment body shall have documented procedures in place in respect of the requirements of this point.
17.
With the exception of point 16, the requirements of this Annex shall not preclude exchanges of technical information and regulatory guidance between a conformity assessment body and a person who applies for certification or who is considering whether to apply for certification.
18.
Conformity assessment bodies shall operate in accordance with a set of consistent, fair and reasonable terms and conditions, taking into account the interests of SMEs in relation to fees.
▼M1
19.
Conformity assessment bodies shall meet the requirements of the relevant harmonised standard as defined in Article 2, point (9), of Regulation (EC) No 765/2008 for the accreditation of conformity assessment bodies performing the certification of ICT products, ICT services, ICT processes or managed security services.
20.
Conformity assessment bodies shall ensure that testing laboratories used for conformity assessment purposes meet the requirements of the relevant harmonised standard as defined in Article 2, point (9), of Regulation (EC) No 765/2008 for the accreditation of laboratories that perform testing.
|
,
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Standard correlati
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Standard correlati
Ticket collegati
|