EU mulls wider scope for cybersecurity certification scheme - paper


FILE PHOTO: European Union flags fly outside the European Commission in Brussels, Belgium November 8, 2023. REUTERS/Yves Herman/File Photo

BRUSSELS (Reuters) - The European Union is considering broadening the scope of proposed cybersecurity labelling rules that would affect not just Amazon, Alphabet's Google and Microsoft but also banks and airlines, according to the latest draft of the rules.

The EU move to set up such a system comes as Big Tech looks to the government cloud market to drive growth in the coming years while a potential boom in artificial intelligence after the viral success of OpenAI's ChatGPT could also boost demand for cloud services.

The latest proposal from EU cybersecurity agency ENISA concerns an EU certification scheme (EUCS) which vouches for the cybersecurity of cloud services and determines how governments and companies in the bloc select a vendor for their business.

The document retains key provisions contained in earlier drafts such as a requirement that U.S. tech giants set up a joint venture with an EU-based company to qualify for the EU cybersecurity label.

Another provision states that cloud service must be operated and maintained from the EU, while all cloud service customer data must be stored and processed in the EU, with EU laws taking precedence over non-EU laws regarding the cloud service provider.

These obligations apply to the highest security level, of which there are four. The latest draft sets out the possibility for these tough requirements to be extended to the third highest security level.

EU countries are now reviewing the latest draft after which the European Commission will adopt a final scheme.

Tech lobbying group CCIA said broadening the scope would affect a bigger swath of industries.

"Perhaps the most striking part of this new draft is that ENISA now suggests the requirements that discriminate against foreign cloud providers could also be extended to lower levels of assurance," said Alexandre Roure, CCIA Europe's public policy director.

"That would include banks, but also airlines, utility companies, and heavily regulated sectors," he said.

The European Banking Federation (EBF), together with the European Savings Banks Group (ESBG), the Association for Financial Markets in Europe (AFME), the European Payment Institutions Federation (EPIF), and Insurance Europe on Tuesday criticsed the sovereignty requirements.

(Reporting by Foo Yun Chee; editing by Jonathan Oatis)

Follow us on our official WhatsApp channel for breaking news alerts and key updates!

   

Next In Tech News

'World of Warcraft' still going strong as it celebrates 20 years
Northvolt CEO steps down, says group needs up to $1.2 billion
Bitcoin at record highs, sets sights on $100,000
Ukraine urges gamers not to enter Chernobyl exclusion zone
Kioxia's market value set at $4.9 billion in IPO
Apple readies more conversational Siri in bid to catch up in AI
China’s richest man berates PDD, ByteDance for months of misery
WhatsApp rolling out transcription for voice messages in multiple languages
The sky's the limit for Bluesky
Two decades of Nintendo's top-selling DS console

Others Also Read