Cross-Border Cyber Hubs — EU Programme (EOI)

About this call

Objective:

The general objective of “Cross-Border Cyber Hub platforms” is to strengthen capacities to analyse, detect and prevent cyber threats and to support the production of high-quality intelligence on cyber threats, notably through the exchange of data from various sources, public and private, as well as through the sharing of state of-the-art tools and jointly developing cyber detection, analysis, and prevention capabilities in a trusted environment. They should provide new additional capacity building upon and complementing existing SOCs and CSIRTs and other relevant actors.

The platforms should act as a central point allowing for broader pooling of relevant data and CTI, enabling the spreading of threat information on a large scale and among a large and diverse set of actors (e.g., CERTs/CSIRTs, ISACs, operators of critical infrastructures).

Cross-Border Cyber Hub platforms will contribute to enhancing and consolidating collective situational awareness and capabilities in detection and CTI, supporting the development of better performing data analytics, detection, and response tools, through the pooling of larger amounts of data, including new data generated internally by the consortia members.

The Cross-Border Cyber Hub platforms should achieve this general objective through the following specific objectives :

Producing high quality, actionable information and CTI through the use of state-of-the-art tools and advanced tools and technologies (for example artificial intelligence (AI), including machine learning (ML) tools) on the large data sets of collected CTI.

Contributing to better detection and response to threats. They should support quicker detection of cyber threats and incidents and more effective action plans and responses by relevant entities.

Contributing to collective situational awareness. The platforms should contribute to the strengthening of the EU’s common situational awareness and enhanced coordinated detection capabilities by sharing information at three levels: Within individual platforms. Participating actors in a cross-border platform must commit to sharing operationally relevant information between one another within the same consortium. Different levels of sharing and integration of data and tools can be envisaged, ranging from the exchange of intelligence feeds and indicators of compromise (IoC) to more contextualised or sophisticated information on threats, incidents, and vulnerabilities.

Between platforms. Conditions for exchanging information with other platforms are to be decided by each platform. The respective cooperation agreements should, in particular, specify information sharing principles and interoperability. The platforms should inform the Commission about the agreements concluded. As per the Cyber Solidarity Act, ENISA is tasked with developing guidelines on the interoperability of cross-border cyber hubs. Against this background, the selected consortia will be required to collaborate with ENISA on the aspect of interoperability.

With relevant EU entities and networks. Platforms should provide an adequate level of information, as well as early warnings, to responsible networks and entities at EU level, in defined situations (such as in case of large scale cybersecurity incidents relevant information and early warnings must be provided to Member States’ authorities and the Commission through EU-CyCLONe and the CSIRTs network) and subject to appropriate conditions, in order to support common situational awareness and effective crisis management and response.

Improving EU technological sovereignty. Platforms should enhance the EU’s cyber-threat knowledge base, support the development and improvement of the EU tools, and help create and structure a European ecosystem for sharing CTI.

Providing other services and activities. Such services and activities could include the sharing of tools (including commonly procured tools), the creation of one or more data lakes, the provision of cyber range services, and/or the training of cybersecurity analysts. Depending on the activities and conditions agreed by platforms, these services could be offered to the platform members, and, where possible, to the wider EU cybersecurity community, including EU industry and research and academia.

Contribution to the surveillance and protection of critical undersea infrastructure : Cross Border Cyber Hubs could also deploy solutions for the surveillance and protection of critical undersea infrastructure, such as submarine cables, and the detection of malicious activities around them, to improve the resilience and security of this infrastructure, which is critical for global communications. The response to such hybrid threats could also include situational awareness performed through the collection and analysis of in-situ, sea-based sensor data as well as relevant satellite imagery. For this activity, operational synergies with the EU Copernicus Space Programme and in particular with its Security Service are required.

Scope:

The purpose of this call for expressions of interest (CfEI) is to select entities in EU Member States and other eligible countries 1 willing to deploy and manage Cross-Border Cyber Hub platforms.

The selected consortia will engage in joint procurement with the ECCC to purchase the necessary tools, infrastructures and services to establish/enlarge/enhance the Cross-Border Cyber Hub platforms. For each joint procurement the EU will contribute up to 75% of the purchasing costs. The number of joint procurements to be conducted will depend on the number of successful applications selected following evaluation of this CfEI.

Separately, a platform has to apply to receive a grant to complement the joint procurement(s) 2 . The related grant will be awarded if the relevant requirements in the separate call for proposals are met and only if the application is successful at this call for expressions of interest. The EU will contribute up to 50% of eligible costs, such as staff costs or other eligible costs for setting up and running the cross-border platform, its interaction and cooperation with other stakeholders, with the exception of those tools, infrastructures and services that will be purchased through the joint procurement(s). The grant funding for the eligible costs of the cross-border platforms will come from the call for proposals on enlarging existing or launching new Cross-Border Cyber Hub platforms.

In the event of enlargement of an ongoing Cross-Border Cyber Hub, the new consortium will be composed of the coordinator of the ongoing grant plus the new entities that want to join the hosting consortium of the Cross-Border Cyber Hub. In the event of enhancement of an ongoing Cross-Border Cyber Hub, the new consortium will be the same as of the ongoing grant(s).

The deployment of these cross-border platforms is a pivotal component in a wider strategy and set of actions aimed at the stepping – up of monitoring and detection capabilities and the improvement of situational awareness at national, cross-border and EU level, and at paving the way for building a collaborative, interoperable and sustainable pan-European network of infrastructure. The network of infrastructure will link SOC entities at national level forming several Cross-Border Cyber Hub platforms, which will be able to build up shared capacities and exchange information among themselves. Such platforms would together constitute a pan-European network of infrastructure.

Cooperation and exchange of information will be encouraged among the various entities at all levels through the procurement of common equipment, software and services, the development of cooperation frameworks and of specific conditions to ensure a high level of interoperability among the supported projects and infrastructures, which will fit into a common, high-level blueprint architecture.

The purpose of this CfEI is to select entities that can provide the necessary facilities to host and operate cross border platforms for pooling data on cybersecurity threat between several Member States. The call for expressions of interest will also build up the planning and design of necessary tools, infrastructures and services to be jointly purchased.

Selection of consortia

1. Selection of new consortia

This CfEI intends to select one or more multi-country consortia led by public bodies from at least three Member States that would come together to create Cross-Border Cyber Hub platforms. More specifically, it aims at selecting consortia composed of multiple National Cyber Hubs which will set up and manage Cross Border Cyber Hub platforms. Members of a consortium must sign a consortium agreement among themselves outlining their various responsibilities, including the relevant information to be shared among the participants of the Cross-Border Cyber Hub platform.

For the purpose of this CfEI, a National Cyber Hub is understood to be a public body that acts as a central hub, having the operational capacity to act as a reference point and gateway to other public or private organisations that themselves have significant capacities to produce, share, receive and analyse cybersecurity related data (e.g., operators of critical infrastructures, cybersecurity companies, etc.), or organisations that benefit from the services of the National Cyber Hub.

One or more of the National Cyber Hubs that participate in a consortium will take on the responsibility for the hosting of the Cross-Border Cyber Hub platform infrastructure. One of them will be designated as ‘ coordinator ’ for the purpose of this CfEI. A Cross-Border Cyber Hub platform will be represented for legal purposes by the designated coordinator, or by the hosting consortium if it has legal personality. Hosting and usage agreements (HUAs) will be signed between the coordinators of the selected consortia, or the hosting consortium if it has legal personality, and the ECCC to decide on the operation and maintenance of the platforms’ tools and infrastructure.

As this CfEI can be viewed as a first phase for new consortia, it may be necessary to evolve the platform(s) in a subsequent phase (further on called phase 2), with the aim of better achieving the objectives listed under Section 2 above. It should also be possible for additional National Cyber Hubs to join the consortia in subsequent phases, based on an agreement with the existing partners, with the aim of increasing and reinforcing the capabilities of the platforms (for more information, see Section 2).

In addition to participating partners, Cross-Border Cyber Hub platforms should aim at involving a large number of contributors, i.e. entities willing to contribute to the objective of the platforms, in particular by sharing data and tools, but without a direct link to the governance and operation of the platforms. While the European Cybersecurity Alert System is a civilian project, the cyber defence community could benefit from stronger civilian detection and situational awareness capabilities developed for the protection of critical infrastructures.

2. Enlargement of existing consortia

Previous calls for expressions of interest were launched to select entities in EU Member States and other eligible countries, willing to deploy and manage Cross-Border Cyber Hub platforms. The selected consortia have already engaged in joint procurement agreements with the ECCC to purchase the necessary tools, infrastructures and services to establish the Cross-Border Cyber Hub platforms.