The Cyber Competences Act - a Vital EU Regulation Concerning Mandatory Certification of Critical Network and Information Systems’ Operators across the European Union

Cybersecurity is vitally important to all critical network and information systems (Critical N&IS). Effective information security comprises multiple layers of defense working together to protect Critical N&IS. When developing a proper cybersecurity, the only considered are especially technical layers, but effective penetration attacks often involve a mix of both the social and technical vectors of attack. The fact that the human error is one of the vital layers that could be a potential weakness for any system that incorporates humans needs a special attention and should be handled at the EU level. Given the increasing number of incidents created by insufficiently trained operators, a strategic necessity arises: the mandatory training and certification of Critical N&IS’ operators across the EU. This objective could be fulfilled through a new Regulation (The Cyber Competences Act) for laying down measures to complement achieving a high common level of cybersecurity within the European Union.