Coordinated preparedness testing and other preparedness actions

About this call

Expected Outcome:

The types of deliverables are presented in two parts.

The first part covers:

Enhanced cooperation, preparedness and cybersecurity resilience in the EU; preparedness support services.

Threat assessment and risk assessment services.

The second part covers:

Risk monitoring services

Better compliance, coordinated vulnerability disclosure and monitoring

Improved skills, via exercises and training courses, organisation of events, workshops. Stakeholder consultations and white papers.

Objective:

This action covers two actions from the Cyber Solidarity Act, dedicated to the Cybersecurity Emergency Mechanism, namely (1) coordinated preparedness testing of entities operating in sectors of high criticality across the Union and (2) other preparedness actions for entities operating in sectors of high criticality and other critical sectors.

Objectives

These actions aim to complement and not duplicate efforts by Member States and those at Union level to increase the level of protection and resilience to cyber threats, in particular for critical industrial installations and infrastructures, by assisting Member States in their efforts to improve their preparedness for cyber threats and incidents by providing them with knowledge and expertise.

Proposals should contribute to achieving at least one of the following objectives:

(part 1) Coordinated preparedness testing of entities operating in sectors of high criticality across the Union (including penetration testing and threat assessment) considering ICT as well as Operational Technology/Industrial Control Systems.

(part 2) Other preparedness actions for entities operating in sectors of high criticality and other critical sectors (i.e. vulnerability monitoring, exercises and training courses).

For details on the actions related to (part 1) and (part 2) covered under the current call for proposals, please consult the Call document accordingly.

Scope:

[Part 1 Coordinated preparedness testing ]

The provision of preparedness support services shall include the activities listed below, for entities in the sector or sub-sector as identified by the Commission in accordance with the Cyber Solidarity Act, from the Sectors of High Criticality listed in Annex I to Directive (EU) 2022/2555 and specified in the call for proposal document for each of the calls under this topic:

Support for testing for potential vulnerabilities:

Development of penetration testing scenarios. The proposed scenarios may cover Networks, Applications, Virtualisation solutions, Cloud solutions, Industrial Control systems, and IoT.

Support for conducting testing of essential entities operating critical infrastructure for potential vulnerabilities.

Support for the deployment of digital tools and infrastructures supporting the execution of testing scenarios and for conducting exercises such as the development of standardised cyber-ranges or other testing facilities, able to mimic features of critical sectors (e.g. energy sector, transport sector, etc.) or others affected by NIS 2 to facilitate the execution of cyber-exercises, in particular within cross-border scenarios where relevant.

Evaluation and/or testing of cybersecurity capabilities of MS entities and MS sectors (including capabilities to prevent, detect and respond to incidents and stress test of the entire sectors), evaluation and compliance activities aimed at increasing maturity, e.g. on the basis of established maturity models and/or relevant evaluation and compliance schemes.

Evaluation and/or testing of cybersecurity capabilities of entities in scope (including for the evaluation and management of risks concerning the supply chain).

Consulting services, providing recommendations on how to improve infrastructure security and capabilities.

Support for threat assessment and risk assessment, such as:

Threat Assessment process implementation and life cycle

Customised risk scenarios analysis.