The unveiling of the Cybersecurity Act 2 (CSA2) by the European Commission marked a pivotal moment in the European Union’s commitment to rise to the challenges of the increasingly perilous cybersecurity landscape.
Over the past decade, the EU has built one of the world’s most advanced cybersecurity regulatory frameworks, with the Cybersecurity Act (CSA) providing its operational and institutional foundation. Since then, the framework has expanded with sectoral legislation, including NIS2 Directive, DORA, Cyber Resilience Act and Cyber Solidarity Act.
In January, the European Commission proposed the Cybersecurity Act 2 (CSA2), the most significant revision of the EU’s cybersecurity legislation to date. Against the backdrop of growing cyber threats and the EU’s drive for greater competitiveness, resilience and simplification, CSA2 revises three core pillars of the EU cybersecurity ecosystem: ENISA’s mandate, the European Cybersecurity Certification Framework (ECCF), and the European Cybersecurity Skills Framework (ECSF), while introducing a new framework for ICT supply-chain security.
As the European Parliament and the Council of the EU, advance their respective positions, CSA2 is entering a decisive phase. Parliament’s Industry, Research and Energy Committee (ITRE) is considering amendments ahead of a committee vote expected in February 2027, while Member States are aiming to reach a general approach by the end of 2026.
Throughout this process, ISACA has engaged with policymakers and provided recommendations before and after the publication of the proposal, ensuring that the voice of cybersecurity practitioners is reflected in the debate. At this critical stage, ISACA also consulted a cross-section of our 40,000 European members to identify CSA2’s main challenges and opportunities. Here are four key takeaways from that consultation and what they could mean for cybersecurity professionals and organisations.
Four key takeaways
- Coordination across the ecosystem is essential. The EU’s decentralized cybersecurity landscape requires clearly defined responsibilities and effective cooperation among Member State authorities, ENISA and other EU bodies. CSA2 should reduce duplication and concentrate EU-level action where it delivers the greatest value.
- Skills are the foundation of cyber resilience. A capable workforce is essential to manage cyber risk and to implement EU legislation effectively. CSA2 should strengthen the ECSF and the Cyber Skills Academy while making skills and professional credentials more portable and interoperable across Member States.
- Adoption is the test of successful certification. The ECCF is a welcome initiative, but its complexity and limited uptake must be addressed. Certification should be practical, proportionate and aligned with market needs, an enabler of trust and differentiation rather than another layer of compliance.
- Governance, assurance and simplification must go together. Organizations need stronger governance and independent assurance across their operations and supply chains. Practical simplification of the cyber legislation is key to allowing resources to be focused on preventing, detecting and responding to threats.
Challenges and opportunities
ENISA’s mandate: Coordination across the ecosystem is essential
ENISA is part of a complex and decentralized EU cybersecurity ecosystem that includes national authorities such as Germany’s BSI, Spain’s INCIBE and France’s ANSSI, and other EU bodies like the European Cybersecurity Competence Centre (ECCC) and the Cybersecurity Service for the Union Institutions, Bodies, Offices and Agencies (CERT-EU). At the same time, ENISA and other cybersecurity agencies are being tasked with new responsibilities as cyber threats grow in scale and sophistication, stretching limited resources. Clear responsibilities and effective cooperation are therefore essential to prevent duplication and make the best use of expertise across the EU.
ISACA members generally agreed that ENISA should focus on areas where EU-level action adds the most value and builds on its existing expertise. Priorities include cross-border incident coordination, threat and vulnerability intelligence, practical implementation guidance and the development and maintenance of certification schemes. The EU Vulnerability Database and the CRA Single Reporting Platform demonstrate the value of common EU infrastructure. An area to strengthen is ENISA’s role in international forums, where it can promote EU tools such as the ECSF and ECCF schemes. Cooperation with non-EU agencies, mutual recognition and alignment with global standards would increase their adoption beyond the EU—turning the “Brussels effect” into practical interoperability.
The next Multiannual Financial Framework (MFF), currently under negotiation, will be critical to ensuring that ENISA has the resources and capacity needed to deliver on an expanding mandate. ENISA must be equipped both to support the effective implementation of EU cybersecurity legislation and to adapt to emerging cybersecurity challenges.
ECSF revision: Skills are the foundation of cyber resilience
ISACA members stressed one thing: skills are the foundation of cyber resilience. Yet the EU continues to face shortages of cybersecurity professionals and other technical fields, limiting organizations’ ability to manage risk and implement the EU cybersecurity laws. The challenge is not to create more qualifications, but to make existing skills, experience and credentials easier to understand and recognize across Member States and beyond.
CSA2 should improve existing tools such as the ECSF and the Cyber Skills Academy. The ECSF should serve as the EU’s common reference for cybersecurity roles while remaining flexible enough to reflect jobs that combine several profiles. Employers, practitioners and professional associations such as ISACA should help keep these profiles aligned with changing market needs and technologies. Our members particularly highlighted how AI is reshaping cybersecurity roles, tasks and competence requirements.
ISACA members argue that any public attestation scheme should recognise and leverage industry-recognised and accredited professional credentials, particularly those that have been mapped to ECSF role profiles. The priority should be practical capability, market recognition and workforce mobility, helping to create a genuine European Single Market for cybersecurity skills.
ECCF revision: Adoption is the test of successful certification
ISACA members support the ECCF, highlighting that it reduces national fragmentation. However, they note that the ECCF has not yet met expectations: only the EU Common Criteria (EUCC) scheme has been adopted, while schemes for cloud services and 5G remain stalled. Its development process is too slow and complex for fast-changing technologies and markets.
CSA2 is an opportunity to make the ECCF faster, more flexible and industry-driven. The proposed 12-month deadline for developing candidate schemes is welcome, provided it is supported by clear governance, early stakeholder engagement and sufficient technical expertise, our members said. Schemes should respond to demonstrated demand and be designed with the organizations expected to use them. Without market confidence and adoption, even a technically robust scheme will have limited value.
New schemes should build on existing standards, recognize previous audits where appropriate and support mutual recognition. ISACA members cautioned against the development of complex certification schemes that may prove difficult to implement in practice. This concern is also reflected in ISACA’s feedback on the EU Managed Security Services (EUMSS) candidate scheme, where the importance of building on existing frameworks and reducing unnecessary complexity was similarly highlighted.
Ultimately, adoption will determine whether a scheme succeeds. Voluntary certification needs clear incentives through procurement, regulatory recognition and market differentiation. ENISA should therefore promote, monitor and update schemes throughout their lifecycle, while involving industry from the outset.
Governance, assurance and simplification must go together
As cyber threats grow, governance must be supported by credible assurance, skilled professionals and sufficient organisational maturity to prevent, respond to and recover from cyber incidents. EU frameworks like the CSA2 should be interoperable with international standards, enabling organisations to implement controls once and reuse evidence across different requirements.
ISACA members welcomed the proposed organisational cybersecurity posture scheme and encouraged co-legislators to retain it in CSA2. ENISA should build this organizational scheme on existing similar standards like ISO/IEC 27001, existing national schemes and previous audits, assessing how people, processes, technology and supply chains work together. Competent, independent assessors and harmonised accreditation practices will be essential to ensure consistent assurance across Member States. The forthcoming European Product Act, expected to revise the Standardisation and Market Surveillance Regulations and the New Legislative Framework, will be central to this system. Co-legislators should ensure coherence between these reforms and CSA2 to prevent gaps, duplication and inconsistent interpretation.
Simplification is equally important. ISACA members reported difficulties with overlapping obligations, terminology, templates and deadlines. The proposed Single Entry Point (SEP) under the Digital Omnibus could help address this issue, but only if it is interoperable and complements existing national reporting tools.
Judge CSA2 by its practical impact
Ultimately, CSA2 should be judged by its practical impact: whether it improves coordination, strengthens organizational capabilities and workforce skills and reduces duplication. By drawing on proven standards and existing tools, the co-legislators can deliver a strengthened CSA2 that reflects today’s cybersecurity threats and realities. For cybersecurity professionals and organizations, the real measure of success will be whether those changes make it easier to build capability, demonstrate assurance and focus resources on managing cyber risk rather than navigating unnecessary complexity.
