European Network and Information Security Agency (ENISA): duration

PURPOSE: to amend Regulation (EC) No 460/2004 establishing the European Network and Information Security Agency with a view to extending its mandate by 2 years.

PROPOSED ACT: Regulation of the European Parliament and of the Council.

BACKGROUND: in order to enhance the capability of the Community, the Member States and, as a consequence, the business community to prevent, address and respond to network and information security problems, the European Network and Information Security Agency (ENISA) was established in 2004 for a period of five years.

The Agency was set up with the main purpose of “ensuring a high and effective level of network and information security within the Community and in order to develop a culture of network and information security for the benefit of the citizens, consumers, enterprises and public sector organisations of the European Union, thus contributing to the smooth functioning of the internal market.”

• Article 25 of the Regulation establishing the Agency provides for the Commission to carry out an evaluation of the Agency by March 2007 in order to determine whether the duration of the Agency should be extended beyond 5 years. An independent evaluation was carried out by a panel of external experts, in accordance with terms of reference agreed with the ENISA Management Board, confirming that the original policy reasons for establishing the Agency and its original goals are still valid. In accordance with Article 25(3) of the Regulation establishing the Agency, the Management Board of the Agency issued recommendations following this evaluation. One of these was that the Regulation should be amended to extend the mandate of the Agency but that the scope of the Agency should not be materially changed.
• In addition, given that on 13 November 2007 the Commission proposed the establishment of a European Electronic Communications Market Authority (see COD/2007/0249) and that it should take over responsibility for the activities of ENISA from 14 March 2011, it is necessary to extend the mandate of the Agency to cover the two years between the scheduled expiry of the Agency (March 2009) and the date when the European Electronic Communications Market Authority will enter into force.

This proposal responds to this double requirement.

CONTENT: Since the mandate of the Agency will expire on 13 March 2009, in order to ensure continuity it will be necessary to adopt an interim measure for the two years between the scheduled expiry of the Agency and the date when the European Electronic Communications Market Authority will take over responsibility for its activities that fall within the scope of the Regulation establishing the Authority.

This proposal therefore aims to extend the duration of the mandate of the Agency until 13 March 2011, equivalent to an additional 2 years.