National Cyber Hubs — EU Programme (EOI)

About this call

Objective:

The general objective of “National Cyber Hubs” is to act as reference points and gateways to other public and private organisations at national level for participation in the European Cybersecurity Alert System and to ensure that cyber threat information from public and private entities is shared and collected at national level in an effective and streamlined manner.

National Cyber Hubs are public entities given the role at national level to act as clearinghouses for detecting, gathering, aggregating and storing data on cybersecurity threats, analysing this data, and sharing and reporting cyber threat intelligence (CTI), reviews and analyses. They provide a central operational capacity and support other SOCs at national level (e.g., by offering guidance or training, making available data or analysis of this data, coordinating joint detection and monitoring actions, providing incident response services methodologies towards the mitigation of identified threats, vulnerabilities and/or misconfiguration weaknesses). They will play a central role at national level and can act as a hub within a context of SOCs in the different countries.

The platforms should act as a central national point allowing for broader pooling of relevant data and CTI, enable the large scale dissemination of threat information on a large scale and among a large and diverse set of actors (e.g., CERTs/CSIRTs, ISACs, operators of critical infrastructures).

National Cyber Hubs will contribute to enhancing and consolidating collective situational awareness and capabilities in detection and CTI. They will support the development of better performing data analytics, detection, and response tools, through the pooling of larger amounts of data.

The National Cyber Hubs should achieve this general objective through the following specific objectives:

Producing high quality, actionable information and CTI through the use of state-of-the art tools and advanced tools and technologies (for example artificial intelligence (AI), including machine learning (ML) tools) on the large data sets of collected CTI. Contributing to better detection and response to threats. They should support quicker detection of cyber threats and incidents and more effective action plans and responses by relevant entities.

Contributing to collective situational awareness. The platforms should contribute to the strengthening of the EU’s common situational awareness and enhanced coordinated detection capabilities by sharing information at three levels: At national level. Close and coordinated cooperation between public and private entities is central to strengthening the EU’s resilience in the cybersecurity sphere. National Cyber Hubs could strengthen cooperation and information sharing between public and private entities and, as part of this, request and receive specific information where appropriate and in accordance with national and EU law. Different levels of sharing and integration of data and tools can be envisaged, ranging from the exchange of intelligence feeds and indicators of compromise (IoC) to more contextualised or sophisticated information on threats, incidents, and vulnerabilities.

Between National Cyber Hubs. National Cyber Hubs must share information with other National Cyber Hubs and commit to applying to participate in a cross-border Cyber Hub within the next 2 years. Conditions for exchanging information with other platforms are to be established. As per de political agreement on the Cyber Solidarity Act to be published in autumn 2024, entities participating in the European Cybersecurity Alert System should ensure a high-level of interoperability among themselves including, as appropriate, as regards data formats, taxonomy, data handling and data analysis tools, and secure communications channels, a minimum level of application layer security, situational awareness dashboard and indicators.

With relevant EU entities and networks . Platforms should provide an adequate level of information to responsible networks and entities at EU level, in defined situations (such as in case of major incidents) and subject to appropriate conditions, in order to support common situational awareness and effective crisis management and response. In particular, platforms should support the exchange of relevant data and information with relevant sectoral and cross-sectoral communities, including relevant industry information sharing and analysis centers (‘ISACs’). If the National Cyber Hub is not the competent authority designated or established by the relevant Member State under Directive (EU) 2022/2555, it is crucial that it coordinates with that competent authority in respect of such data requests and receipt.

Improving EU technological sovereignty. The platforms should enhance the EU’s cyber-threat knowledge base, support the development and improvement of EU tools, and help create and structure a European ecosystem for sharing CTI.

Providing other services and activities. Such services and activities could include the sharing of tools (including commonly procured tools), the creation of one or more data lakes, the provision of cyber range services, and/or the training of cybersecurity analysts. These services could be offered, for example, to the SOC network at national level, national critical infrastructures in the public and private sectors, CSIRTs, ISACs and where possible, to the wider EU cybersecurity community, including EU industry and research and academia.

Contribution to the surveillance and protection of critical undersea infrastructure : Cross Border Cyber Hubs could also deploy solutions for the surveillance and protection of critical undersea infrastructure, such as submarine cables, and the detection of malicious activities around them, to improve the resilience and security of this infrastructure, which is critical for global communications. The response to such hybrid threats could also include situational awareness performed through the collection and analysis of in-situ, sea-based sensor data as well as relevant satellite imagery. For this activity, operational synergies with the EU Copernicus Space Programme and in particular with its Security Service are required.

Scope:

The purpose of this call for expressions of interest (CfEI) is to select entities in EU Member States and other eligible countries 1 , intending to participate in the European Cybersecurity Alert System and willing to deploy and manage National Cyber Hubs.

The single entity, designated or established as the National Cyber Hub, selected following this CfEI will engage in and manage a joint procurement with the ECCC to purchase the necessary tools, infrastructures and services to create or strengthen the National Cyber Hub. For each joint procurement the EU will contribute up to 50% of the purchasing costs. The number of joint procurements to be conducted will depend on the number of successful applications from National Cyber Hubs selected following evaluation of this CfEI.

Separately, a platform has to apply to receive a grant to complement the joint procurement(s) 2 . The related grant will be awarded if the relevant requirements in the separate call for proposals are met and only if the application in response to this call for expressions of interest is successful. The EU will contribute up to 50% of eligible costs, such as staff costs or other eligible costs for enhancing existing or setting up and running the National Cyber Hub, its interaction and cooperation with other stakeholders, with the exception of those tools, infrastructures and services that will be purchased through the joint procurement(s). The grant funding for the eligible costs of the National Cyber Hubs will come from the call for proposals on National Cyber Hubs.

The deployment of these national platforms is a pivotal component in a wider strategy and set of actions aimed at the stepping – up of monitoring and detection capabilities and the improvement of situational awareness at national, cross-border and EU level, and at paving the way for building a collaborative, interoperable and sustainable pan-European network of infrastructure. The network of infrastructure will link Cyber Hubs designated at national level forming several cross-border Cyber Hubs, which will be able to build up shared capacities and exchange information among themselves. Such platforms would together constitute a pan-European network of infrastructure.

Cooperation and exchange of information will be encouraged among the various entities at all levels through the procurement of common equipment, software and services, the development of cooperation frameworks and of specific conditions to ensure a high level of interoperability among the supported projects and infrastructures, which will fit into a common, high-level blueprint architecture.

In this regard, National Cyber Hubs must share information with other stakeholders in a mutually beneficial exchange of information and commit to applying to participate in a cross-border Cyber Hub within the next 2 years from the date on which the tools, infrastructures and services were acquired, or which it received grant funding, whichever occurred sooner, with a view to exchanging information with other National Cyber Hubs.

Selection of National Cyber Hubs

The purpose of this CfEI is to select entities in the Member States that can provide the necessary facilities to enhance existing or host and operate the National Cyber Hub. The call for expression of interest will also build up the planning and design of necessary tools, infrastructures and services to be jointly purchased.

1. Selection of New National Cyber Hubs

This CfEI intends to select entities designated or established by the Member States as National Cyber Hub .

For the purpose of this CfEI, a national SOC is understood to be a public body that acts as a central hub, having the operational capacity to act as a reference point and gateway to other public or private organisations that themselves have significant capacities to produce, share, receive and analyse cybersecurity related data (e.g., operators of critical infrastructures, cybersecurity companies), or organisations that benefit from the services of the national SOC. The National Cyber Hub may be a CSIRT, or where applicable, a national cyber crisis management authority or other competent authority designated or established under Directive (EU) 2022/2555, or another entity.

Hosting and usage agreements will be signed between the selected National Cyber Hubs and the ECCC regulating the usage of the tools, infrastructures and services.

While the applicants under this CfEI are the entities designated or established by the Member States as National Cyber Hub, identification and engagement of the relevant stakeholders should be envisaged. To this end, National Cyber Hubs should aim at involving a large number of contributors, i.e. entities willing to contribute to the objective of the platforms, in particular by sharing data and tools, but without a direct link to the governance and operation of the platforms. The relevant contributors for a National Cyber Hub could be, among others: sectoral SOCs, national decision and policy makers as well as other governmental and non-governmental organisations, law enforcement, academic, research and innovation communities, private sector including the sectors of essential and important entities according to the NIS2 Directive. While the European Cybersecurity Alert System is a civilian project, the cyber defence community could benefit from stronger civilian detection and situational awareness capabilities developed for the protection of critical infrastructures.

2. Enhancement of existing National Cyber Hub

Previous calls for expressions of interest were launched to select entities in EU Member States and other eligible countries, willing to deploy and manage National Cyber Hub platforms. The selected consortia have already engaged in joint procurement agreements with the ECCC to purchase the necessary tools, infrastructures and services to establish/enhance the Cross-Border Cyber Hub platforms.

As the previous CfEIs launched may be viewed as a first phase for the selected beneficiaries, it may be necessary to evolve the platform(s) in a subsequent phase, with the aim of better achieving the objectives listed under Section 2 above. In this regard, existing consortia can increase and reinforce the capabilities of the platforms.