Leading the way : ENISA's CSIRT-related capacity building activities : impact analysis update 2015

Europe, like the rest of the world, is witnessing an unprecedented expansion in the cyber-security domain and an ever-growing community of CSIRTs (Computer Security Incident Response Team). In parallel, an evolving cyber threat landscape shows a sharp increase and levels of sophistication of cyber incidents and attacks. Against this backdrop, the relevance of ENISA (European Union Agency for Network and Information Security) and its role in networking and trust building, as well as capacity building to achieve high and effective levels of network and information security in the European CSIRT community, stands out. Undoubtedly, ENISA's support to achieve high and effective levels of network and information security within the European CSIRT community will remain an important cornerstone in the years to come. ENISA is uniquely positioned to spot the gaps and the needs of the community, and to lead the way towards sustained levels of cyber-security. This report represents the update of an impact assessment performed by Deloitte of ENISA's capacity building activities for CSIRTs in 2014. This updated assessment serves as a basis for a proposed roadmap to 2020. The impact of the ENISA support to the CSIRT community was assessed from a dual perspective - legislative and regulatory, as well as operational, with the key objectives to: - Update the policy analysis; - Gather additional input from practitioners, including specific input on the new duties; - Together with ENISA, propose concrete projects or actions towards the roadmap implementation. The legislative and regulatory perspective covers the objectives formulated in the ENISA regulation, the 2014 and 2015 ENISA Work Programmes, the Digital Agenda for Europe, the EU Cybersecurity Strategy and the proposed NIS Directive, as well as the EU Policy of Critical Information Infrastructure Protection (CIIP). The operational perspective includes an assessment of the impact of ENISA's CSIRT support looking at four activity pillars: - Baseline Capabilities for CSIRTs; - Capacity building in sharing good practice and CSIRTs training; - Supporting the CSIRTs in better collaboration with law enforcement agencies (LEAs); - Cyber crisis cooperation and exercises.