• Legal basis

This proposal amends the Cybersecurity Act, which is based on Article 114 of the Treaty on the functioning of the European Union (TFEU). As in the case of the Cybersecurity Act, this proposal aims to avoid fragmentation of the internal market, namely by enabling the adoption of European cybersecurity certification schemes for managed security services. Member States have started to adopt national certification schemes for managed security services. There is thus a concrete risk of fragmentation of the internal market for these services, which the present proposal aims to address. Therefore, Article 114 TFEU is the relevant legal basis for this initiative.

• Subsidiarity (for non-exclusive competence)

The objective of enabling the adoption of European cybersecurity certification schemes for managed security and avoiding fragmentation of the internal market cannot be achieved at national level but only at Union level. Furthermore, managed security services, which are the targeted subject of the proposed amendment, are offered by providers active across the Union, as are their largest potential customers. Action at Union level is therefore both necessary and more effective than action at national level.

• Proportionality