EU Cybersecurity Crisis Management Blueprint

• The document is a proposal for a Council Recommendation regarding an EU Blueprint on cybersecurity crisis management, drafted in Brussels on February 24, 2025.
• The goal is to present the EU framework for managing cybersecurity crises clearly and simply.
• The recommendation aims to enable Union-level actors to understand how to interact and best use available mechanisms throughout a crisis.
• It will explain what constitutes a cyber crisis, what triggers a crisis mechanism at the EU level, and the use of mechanisms like the Cybersecurity Emergency Mechanism and the EU Cybersecurity Reserve.

Policy Context and Consistency

• The revised Blueprint aligns with time-tested cooperation principles, expanding them to the full crisis management lifecycle.
• Ensures compatibility with frameworks like IPCR, EU Cyber Diplomacy Toolbox, and the Law Enforcement Emergency Response Protocol (LERP).
• The Cyber Blueprint is a non-binding instrument identifying specific actions for relevant actors in a cyber crisis.

Large-Scale Cybersecurity Incident Definition

• A large-scale cybersecurity incident is defined as one causing disruption exceeding a Member State's response capacity or significantly impacting at least two Member States, based on Directive (EU) 2022/2555 (NIS 2 Directive).

Legal Basis and Subsidiarity

• The proposal is based on Article 292 TFEU, which governs the adoption of Recommendations.
• The proposal complements the existing cybersecurity legislative framework at the Union level. Coordinated Union-level responses will support Member States' responses through shared awareness, communication, and mitigating consequences.

Proportionality and Instrument Choice

• The proposal conforms to the principle of proportionality under Article 5(4) of the Treaty on the European Union.
• A Council Recommendation is an appropriate instrument, signaling Member State commitment and providing a basis for cooperation.

Stakeholder Consultations

• The Commission consulted Member States, relevant Union entities, and the private sector.

Key Considerations and Background

• Digital technology and global connectivity are essential to the Union's economy and critical infrastructure but increase cyber risks.
• Rising geopolitical tensions and conflicts contribute to the surge in the impact, volume, and sophistication of malicious cyber activities.
• Effective crisis management is crucial for economic stability, protecting governments, critical infrastructure, citizens, and businesses, as well as contributing to international security in cyberspace.
• IPCR (Integrated Political Crisis Response) activation involves consulting affected Member States, the Commission, and the High Representative (HR).

Union Cybersecurity Framework Development

• Since 2017, the Union has developed its cybersecurity framework through instruments, including Regulations (EU) 2019/881, (EU) 2024/2847, Directive (EU) 2022/2555 et al.
• Specific cybersecurity crisis measures include Commission Delegated Regulation (EU) 2024/1366.
• Directive 2013/40 provides a reference for the definition of criminal cyber activities and EU rules on cross-border access to electronic evidence.

Roles and Responsibilities

• Relevant Union actors with cyber crisis management roles include the Commission, EEAS (including SIAC), ENISA, CERT-EU, Europol (via EC3), EU-CyCLONe, the CSIRTs Network, SATCEN, the Galileo Security Monitoring Centre, and Union delegations.
• Actors work together within applicable laws to determine cooperation for implementing the EU cyber crisis management framework.

Cyber Blueprint Objectives

• An updated Cyber Blueprint aims to provide clear guidance on what constitutes a Union-level cyber crisis.
• It clarifies how the crisis management framework is triggered, the roles of actors and mechanisms involved, and the interaction between them.
• The Blueprint exists within the broader context of civilian-military and EU-NATO relations.

Crisis Response and Coordination

• This Recommendation complements other instruments such as the Integrated Political Crisis Response (IPCR), Commission’s ARGUS and CRM
• A Blueprint exists to coordinate Union level response to critical infrastructure disruptions, covering non-cyber physical resilience as well

Comprehensive Crisis Management

• Cross-sectoral crisis management should be reinforced for integrated responses, especially when cyber incidents cause real-life consequences.
• The Cybersecurity Directive (EU) 2022/2555, includes the security of critical digital infrastructure, including undersea communications cables.

Preparedness and Information Sharing

• Crisis preparedness require comprehensive all-hazards risk assessment, plus a common EU situational awareness
• Preparedness is defined as Union-level cyber exercises for testing procedures and cooperation mechanisms

Technical Aspects and Infrastructure

• European digital infrastructures have many technical dependencies.
• Implementation of the EU's 2024/2690 regulation to identify standards and deployment techniques in a timely fashion.
• Coordinated approaches are needed to detect supply chain malicious activity.
• EU relies on tech from high-risk suppliers requiring vulnerability reporting.

Union Framework and Cooperation

• CSIRTs, law enforcement, and the cyber hubs play a role for detecting incidents/threats/vulnerabilities, plus recovering from attacks
• Mutual Assistance actions supporting such established under Regulation (EU) 2025/38 Cybercrime deterrence requires cooperation to identify and prosecute offenders for a comprehensive understanding.

Crisis Communication and Military Synergies

• Clear public communication combats disinformation during crises.
• Secure internal channels required, including for classified levels.
• EU will establish more robust, whole-of-government civilian and military security, as per EU Policy on Cyber Defense.

International Cooperation

• Cooperation with international strategic partner countries and groups bolsters the Union's cyber capabilities.
• Must ensure situational awareness, coherence, and robust cooperation contributing to a global, open, sable, secure and resilient cyberspace.

Cyber Crisis Management Framework: Aims and Principles

• The document will establish a cyber crisis management framework across members, and EU level actors
• Member states will follow the cyber blueprint in line with Directive (EU) 2022/2555
• Proportionality, subsidiarity, cooperation and existing mechanisms are to be used. All shared procedures need to be agreed and documented.

Union-Level Cyber Crisis, Situational Awareness

• Verified intel and data from trend incidents is to become a common data awareness between parties
• Key sectors are Communications, energy, transport, finance, space and health
• Cooperation between the EU-Cyclne and the CSIRT networks is required. As is private sector information sharing and analysis

Harmonization of Response and Preparation

• EU is aiming to advance the cybersecurity arrangements of Directive (EU) 2022/2555 and EU cyber hubs to encourage collaboration
• EU members need to develop a common taxonomy on managing cybercrises, handling exchanges of information and security
• Exercises should be run based on scenarios concerning multi-sectoral crisis. These should account for EU level response mechanisms

DNS and Cyber Capacity

• Members must enhance Domain Name System (DNS) , ensure reliable DNS resolution during major crisis involving Union based DNS infrastructure (DNS4EU)
• National cyber hubs and cross-border cyber hubs are to share treat information

Addressing and Detecting Cyber Crises

• EU must implement cyber-threat detection strategies across digital infrastructures
• All actors, in accordance with their mandates, must contribute information on cyber risk
• The CSIRTs Network and EU-CyCLONe should establish procedural information, and ensure technical coordination

Responding To A Cyber Crisis

• Actors responding in close coordination with entities responding to hybrid threats
• Members and CSIRTs Network to reduce the compromise, restore systems and minimal disruption
• Council will then coordinate communications to prevent disinformation while in cooperation of EU-CyCLONe
• Economic levels like trade bans will need to be leveraged

Communications and Space Systems

• EU will ensure cordination with the Hybrid Toolbox
• Regarding the case of military dimension cyber activity, the corresponding state should inform the Union Cyber Commanders Conference for help
• Communications channels should all be secured, specifically concerning space systems.
• EU will establish methods for high level communication

Secure Information and Tools

• In order to prevent hybrid campaigns EU is establishing frameworks for response and communication to mitigate incidents
• Mechanisms in the Cyber Toolbox should be established for effective crises response.
• The High Representative and Commission the flow of information with EU and other relevant EU partners

Military and Cyber Crises

• In order to mitigate military and cyber crises
• EU-CyCLONe and EU Cyber Commanders Conference (plus CSIRTS Network) should cooperate, in order to encourage more aware civilian and military actors
• Union and NATO agreed to establish response and agreements