Resolution (EU) 2024/2316 of the European Parliament of 11 April 2024 with observations forming an integral part of the decision on discharge in respect of the implementation of the budget of ENISA (European Union Agency for Cybersecurity) for the financial year 2022

Official Journal EN of the European Union L series 2024/2316 10.10.2024 RESOLUTION (EU) 2024/2316 OF THE EUROPEAN PARLIAMENT of 11 April 2024 with observations forming an integral part of the decision on discharge in respect of the implementation of the budget of ENISA (European Union Agency for Cybersecurity) for the financial year 2022 THE EUROPEAN PARLIAMENT, — having regard to its decision on discharge in respect of the implementation of the budget of ENISA (European Union Agency for Cybersecurity) for the financial year 2022, — having regard to Rule 100 of and Annex V to its Rules of Procedure, — having regard to the Special Report No 5/2022 of the Court of Auditors;

— having regard to the report of the Committee on Budgetary Control (A9-0134/2024), A. whereas, according to its statement of revenue and expenditure(1), the final budget of ENISA (the ‘Agency’) for the financial year 2022 was EUR 39 207 625 representing an increase of 67,03 % compared to 2021; whereas the increase in the Agency’s budget is mainly explained by additional tasks related to the pilot implementation of the Cybersecurity Support Action programme; whereas the budget of the Agency derives mainly from the Union budget;

B. whereas the Court of Auditors (the ‘Court’), in its report on the Agency’s annual accounts for the financial year 2022 (the ‘Court’s report’), states that it has obtained reasonable assurance that the Agency’s annual accounts are reliable and that the underlying transactions are legal and regular;

Budget and financial management

1. Notes with appreciation that the budget monitoring efforts during the financial year 2022 resulted in a budget implementation of current year commitment appropriations rate of 99,93 %, representing an increase of 0,42 % compared to 2021; notes furthermore that the current year payment appropriations execution rate was 52,02 % representing a decrease of 25,38 % compared to 2021;

2. Highlights that the amount of the Agency’s final budget is the result of an amendment of EUR 15 000 000adopted by the management board on 5 August 2022due to the implementation of a cybersecurity support action aiming to strengthen the Agency’s response in supporting Member States in accordance with its mandate; notes that the majority of the commitments under the cybersecurity support action were signed late in the year, which explains the relatively low payment rate (and the subsequent large carry-forward);

Performance

3. Commends the Agency for having implemented 100 % of its work programme in 2022; welcomes that the Agency uses key performance indicators (KPIs) to assess its activities and the results in respect of the objectives of the work programme; observes that certain outputs did not achieve their objectives in full due to the reprioritisation of resources in order to provide the cybersecurity support action in response to the illegal and unprovoked invasion of Russia against Ukraine; notes that some of the outputs that are more affected due to that reprioritisation were, inter alia, outputs 4.2 ‘Develop and enhance standard operating policies, procedures, methodologies and tools for cyber crisis’, and 5.3 ‘Initiate the development of a trusted network of vendors/suppliers’;

4. Is aware that the illegal and unprovoked invasion of Russia against Ukraine dominated the Union’s security agenda in 2022; notes with satisfaction that the Agency stepped up its coordination and preparedness, and contributed to the Union’s shared situational awareness by providing regular situational reports of cyber activity; highlights that there was also intensified coordination and exchange of information with cybersecurity networks, such as the European cyber crisis liaison organisation network (EU-CyCLONe), which consists of national cybersecurity crisis management authorities, and numerous sectorial communities supported by the Agency; welcomes the efforts carried out by the Agency to ensure channels of communication between political, operational and technical levels, and enhanced cooperation with the computer security incident response teams’ network;

(1) OJ C 377, 30.9.2022, p. 2.

ELI: http://data.europa.eu/eli/res/2024/2316/oj 1/5EN OJ L, 10.10.2024

5. Notes with satisfaction that in 2022 the Agency piloted the Union heat map, which aimed to provide a quick overview of cyber incidents and cyber events affecting Union’s critical sectors as a result of the cyber activity related to the Russian war of aggression against Ukraine; notes that those sectors contributed to the integrated situational awareness and analysis report from the Commission, with 52 updates on the current situation and incidents in regard to the Russian war of aggression against Ukraine, contributing to the Union’s crisis management mechanism;

6. Takes note of the fact that, according to the Court’s Special Report No 5/2022: ‘Cybersecurity of EU institutions, bodies and agencies’, the number of cyberattacks on EU bodies is increasing sharply and the level of cybersecurity preparedness within Union bodies varies and is overall not commensurate with the growing threats; observes that since Union bodies are strongly interconnected, a weakness in one can expose others to security threats; highlights that the Court recommends that the Agency together with Computer Emergency Response Team for the Union

should increase their focus on Union bodies that have less experience in managing cybersecurity by: (a) identifying priority areas where Union institutions, bodies and agencies need most support, for example through maturity assessments; and (b) implementing capacity-building actions, in line with their memorandum of understanding;

calls on the Agency to address the issues raised by the Court and report back to the discharge authority on any measures taken on this matter;

7. Takes note of the fact that the Agency conducted various activities in 2022 to fulfil its role in supporting the Union; notes that while the Agency was able to offer its support to several policy files, such as network and information security, cyber resilience and digital operational resilience, resource constraints prevented the Agency from actively supporting policy files with cybersecurity provisions, such as the European health data space, and other key policy files, such as digital markets and the digital services; notes that other activities included informing policymakers about the effectiveness of existing cybersecurity frameworks and providing support to critical sectors; notes furthermore that the adoption of Directive (EU) 2022/2555 of the European Parliament and of the Council(2) (NIS 2 Directive) stands out as a measure to address challenges and harmonise policies across the Union;

understands that the lack of harmonisation in the NIS 1 Directive implementation led to a fragmented policy landscape, addressed by the NIS 2 Directive; is aware that the latter expands its scope introducing new horizontal tasks for the Agency, such as the Union register for digital entities; highlights that the Agency adjusted its services and resources with a new strategy to meet the evolving demands of the cybersecurity landscape;

Efficiency and gains

8. Notes that the Agency sought to increase its use of services shared with other agencies and/or the Commission, including, for example, through interagency and interinstitutional procurement processes, and sharing services with European Centre for the Development of Vocational Training (Cedefop) and the European Cybersecurity Competence Centre (ECCC); notes furthermore that in 2022, the Agency signed a service-level agreement with the newly established European Cybersecurity Industrial, Technology and Research Competence Centre, for the provision to the centre of data protection officer and accountant services, to be implemented in 2023;

9. Takes note of the steps taken by the Agency to move away from the traditional headcount methodology to a strategic workforce planning to anticipating and addressing staffing gaps in order to build an agile workforce and allocate resources to priority areas;

10. Welcomes the Agency’s contribution to the promotion of shared services among agencies through several networks in the areas of procurement, human resources, ICT, risk management, performance management, data protection, information security and accounting; points out the horizontal benefits of working together and adapting best practices and that joint initiatives bring together diverse perspectives, reduce duplication of effort, enhance learning and strengthen relationships between the participants; encourages the Agency to find internal procedures that could be streamlined via new IT tools;

11. Notes with satisfaction the involvement of the Agency in the pilot exercise within the EU Agencies Network intended to support Union agencies to increase their preparedness for the upcoming new cybersecurity regulation;

12. Recalls the importance of increasing the digitalisation of the agency in terms of internal operation and management but also in order to speed up the digitalisation of procedures; stresses the need for the agency to continue to be proactive in this regard in order to avoid a digital gap between the agencies;

(2) Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive

(EU) 2016/1148 (NIS 2 Directive) (OJ L 333, 27.12.2022, p. 80).

2/5 ELI: http://data.europa.eu/eli/res/2024/2316/ojEN OJ L, 10.10.2024 Staff policy

13. Notes that on 31 December 2022, the establishment plan was 89,02 % implemented, with 73 temporary agents appointed out of 82 authorised under the Union budget (compared to 76 authorised posts in 2021); notes that, in addition, 27 contract agents, 10 seconded national experts, 10 interim staff and 16 contractors worked for the Agency in 2022;

14. Notes with concern the lack of gender balance within the Agency’s senior and middle management with 12 out of 17 being men (71 %); considers that the gender balance within the Agency’s senior and middle management needs to be improved; recalls the importance of ensuring gender balance and calls on the Agency to take this aspect into consideration with regard to future appointments within its senior and middle management; takes note of the gender distribution within the Agency’s management board, with 41 out of 55 (75 %) being men; acknowledges that the composition of the management board depends to a large extent on Member State nominations; insists that the Commission and the Member States take into account the importance of ensuring gender balance when nominating their members to the Agency’s management board; notes the balanced gender distribution within the Agency’s staff overall, with 57 men (52 %) and 53 women (48 %); notes the steps taken by the Agency with the aim to tackle issues in relation to gender balance which includes the revision of its recruitment policy with a view to encouraging applications from women; notes furthermore that the Agency has planned in its corporate strategy to obtain EU Agency’s Network Certificate of Excellence in Diversity and Inclusion by the end of 2025;

15. Notes that the Agency has a policy on protecting the dignity of the person and preventing psychological and sexual harassment, and that the Agency is part of the interagency task force of confidential counsellors; looks forward to receiving their report and recommendations; notes that there were no reported cases of harassment in 2022 and encourages the Agency to continue and develop the work to prevent cases in the future as well;

16. Raises concerns about the geographical imbalance within the Agency’s senior and middle management and other staff, with a 40,9 % representation of Greek nationals; insists that improvements have to be made; asks the Agency to report back on this to the discharge authority;

17. Notes with concern that during the development of the 2023 work programme, the Agency identified a resource shortfall of EUR 734 000and two FTEs in operations, and EUR 2,5 million in corporate services; notes furthermore that a thorough evaluation of human resource needs for 2023-2025 revealed a significant gap, particularly in critical areas of activity and without additional posts, the Agency may need to prioritise and adjust future work programs to offset the resource shortfall; takes note of the fact that the Agency’s management board has also expressed the need to increase staffing posts for the Agency to be able to fully deliver its mandate in a sustainable manner;

18. Welcomes the Agency’s efforts to integrate persons with disabilities setting accessible infrastructure and support services;

19. Notes that in 2022 the Agency continued with its complementary support to staff in vouchers, internet reimbursement and fit@work programme and developed its code of conduct, outlining Agency’s expectation regarding members of staff behaviour and conduct;

Procurement

20. Notes, with concern, that the Court found two cases where the Agency had awarded low-value contracts (below EUR 15 000) without issuing an evaluation report and an award decision duly approved and signed by the authorising officer which contravenes points 30.3 and 30.4 of Annex I to the Financial Regulation; recalls in this regard that the Court made a similar observation in their 2021 report and the Agency’s reply stating that it had already taken the necessary steps to address this concern; insists on the importance to implementing procedures to ensure full compliance with the Financial Regulation; calls on the Agency to address the issues raised by the Court and report any developments in that regard to the discharge authority;

ELI: http://data.europa.eu/eli/res/2024/2316/oj 3/5EN OJ L, 10.10.2024

21. Takes note that according to the Court, during 2022, the Agency offered its managers a professional appraisal performed by an external provider, designated by the Agency; notes that in three cases, the Agency paid the provider directly for these services, while in the remaining 23 cases, it reimbursed its managers, who had paid the provider themselves; observes that the total amount paid by the Agency for the 26 appraisals was EUR 120 276;

regrets that the Agency selected the provider without launching an open procurement procedure, and for this reason the Court concluded that those payments were irregular; calls on the Agency to address the issues raised by the Court and report back to the discharge authority on any measures taken on this matter;

22. Insists that the objective of public procurement rules is to enable procuring entities to obtain the goods and services they need at best price, while ensuring fair competition between tenderers and compliance with the principles of transparency, proportionality, equal treatment and non-discrimination; calls on the Agency to further improve its public procurement procedures, ensuring full compliance with the applicable rules, so that they achieve the best possible value for money;

Prevention and management of conflicts of interest and transparency

23. Notes the Agency’s existing measures and ongoing efforts to secure transparency, prevention and management of conflicts of interest, and notes that the CVs of the members of the management board, and their declaration of commitment and declarations of interests are being published on its website, although some of the CVs are missing;

24. Notes that the Agency has not reported any cases of conflict of interest in 2022; further notes the Agency’s adoption of its management board Decision 15/2021 on the prevention of conflicts of interest and the update of the templates for the declarations; insists on the importance of having procedures in place for monitoring compliance with the rules related to ‘revolving doors’ and actively monitoring the professional activity of their senior members of the staff, including those who have left the agency within the last two years, in order to be able to detect undeclared ‘revolving doors’ situations;

25. Takes note that the calendar of the meetings between the Agency’s management and external stakeholders is publicly available on its website;

26. Recalls the importance for the Agency to develop greater visibility in the media, internet, and social media in order to make its work known to the citizens;

Internal control

27. Notes that the internal audit service conducted in 2021 an audit on strategic planning programming and performance management and issued its final audit report in April 2022, with three important recommendations notes further the Agency’s agreement with the audit observations and having taken the necessary steps to address those concerns;

28. Observes that according to the Court the Agency has no pre-determined model assessment, namely guidelines, to help the evaluation committee to assess the tenders; notes that this entails the risk that the tenders may not be evaluated consistently by each member of the evaluation committee; calls on the Agency to address this issue raised by the Court and report back to the discharge authority;

29. Takes note that in 2022, the Agency performed ex post controls of financial transactions made during 2021 financial year as per Article 45(8) and (9) of Commission Delegated Regulation (EU) 2019/715(3); draws attention to the fact that three weaknesses were identified, leading to three recommendations on financial transactions, none of which was deemed critical; observes that to address the main weakness, weekly monitoring of time to payment was introduced in 2022 to alert the relevant financial staff to urgent transactions remaining to be processed, to comply with the legal framework on payment time limits;

(3) Commission Delegated Regulation (EU) 2019/715 of 18 December 2018 on the framework financial regulation for the bodies set up under the TFEU and Euratom Treaty and referred to in Article 70 of Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council (OJ L 122, 10.5.2019, p. 1).

4/5 ELI: http://data.europa.eu/eli/res/2024/2316/ojEN OJ L, 10.10.2024

30. Notes that in 2022, the assessment of the effectiveness of the internal control systems of the Agency was based on the indicators of the framework, and also additional information from specific (risk) assessment reports, audit findings and other relevant sources; observes that the assessment of the Agency’s internal controls indicates reasonable assurance in facilitating effective and efficient operations, ensuring quality reporting, and compliance with regulations but some improvements are needed in relation to certain principles to increase effectiveness and ensure proper implementation of the internal controls; calls on the Agency to report back to the discharge authority on its follow-up action on the improvements assessment;

Other comments

31. Notes that the Agency has implemented important measures in order to increase cyber security protection, such as secure email solution (SECEM2), red team exercise and follow-up fixes and hardening, decommissioning of legacy systems, update of internal cybersecurity policy framework;

32. Welcomes the fact that the Agency’s management board added to the Agency’s Single Programming Document 2022-2024 the goal for the Agency to achieve climate neutrality across all its operations by 2030; notes that with the adoption of the Agency’s corporate strategy, the EMAS certification and green public procurement are key objectives of the Agency; takes note of the fact that the certification process is expected to be completed in the course of 2024;

33. Refers, for other observations of a cross-cutting nature accompanying its decision on discharge, to its resolution of 11 April 2024(4)on the performance, financial management and control of the agencies.

(4) Texts adopted, P9_TA(2024)0280.

ELI: http://data.europa.eu/eli/res/2024/2316/oj 5/5