See Full Document Text
Official Journal EN
of the European Union L series
2024/2316 10.10.2024
RESOLUTION (EU) 2024/2316 OF THE EUROPEAN PARLIAMENT
of 11 April 2024
with observations forming an integral part of the decision on discharge in respect of the
implementation of the budget of ENISA (European Union Agency for Cybersecurity) for the
financial year 2022
THE EUROPEAN PARLIAMENT,
— having regard to its decision on discharge in respect of the implementation of the budget of ENISA (European Union
Agency for Cybersecurity) for the financial year 2022,
— having regard to Rule 100 of and Annex V to its Rules of Procedure,
— having regard to the Special Report No 5/2022 of the Court of Auditors;
— having regard to the report of the Committee on Budgetary Control (A9-0134/2024),
A. whereas, according to its statement of revenue and expenditure(1), the final budget of ENISA (the ‘Agency’) for the
financial year 2022 was EUR 39 207 625 representing an increase of 67,03 % compared to 2021; whereas the
increase in the Agency’s budget is mainly explained by additional tasks related to the pilot implementation of the
Cybersecurity Support Action programme; whereas the budget of the Agency derives mainly from the Union
budget;
B. whereas the Court of Auditors (the ‘Court’), in its report on the Agency’s annual accounts for the financial year 2022
(the ‘Court’s report’), states that it has obtained reasonable assurance that the Agency’s annual accounts are reliable
and that the underlying transactions are legal and regular;
Budget and financial management
1. Notes with appreciation that the budget monitoring efforts during the financial year 2022 resulted in a budget
implementation of current year commitment appropriations rate of 99,93 %, representing an increase of 0,42 %
compared to 2021; notes furthermore that the current year payment appropriations execution rate was 52,02 %
representing a decrease of 25,38 % compared to 2021;
2. Highlights that the amount of the Agency’s final budget is the result of an amendment of EUR 15 000 000adopted
by the management board on 5 August 2022due to the implementation of a cybersecurity support action aiming
to strengthen the Agency’s response in supporting Member States in accordance with its mandate; notes that the
majority of the commitments under the cybersecurity support action were signed late in the year, which explains
the relatively low payment rate (and the subsequent large carry-forward);
Performance
3. Commends the Agency for having implemented 100 % of its work programme in 2022; welcomes that the Agency
uses key performance indicators (KPIs) to assess its activities and the results in respect of the objectives of the work
programme; observes that certain outputs did not achieve their objectives in full due to the reprioritisation of
resources in order to provide the cybersecurity support action in response to the illegal and unprovoked invasion of
Russia against Ukraine; notes that some of the outputs that are more affected due to that reprioritisation were, inter
alia, outputs 4.2 ‘Develop and enhance standard operating policies, procedures, methodologies and tools for cyber
crisis’, and 5.3 ‘Initiate the development of a trusted network of vendors/suppliers’;
4. Is aware that the illegal and unprovoked invasion of Russia against Ukraine dominated the Union’s security agenda
in 2022; notes with satisfaction that the Agency stepped up its coordination and preparedness, and contributed to
the Union’s shared situational awareness by providing regular situational reports of cyber activity; highlights that
there was also intensified coordination and exchange of information with cybersecurity networks, such as the
European cyber crisis liaison organisation network (EU-CyCLONe), which consists of national cybersecurity crisis
management authorities, and numerous sectorial communities supported by the Agency; welcomes the efforts
carried out by the Agency to ensure channels of communication between political, operational and technical levels,
and enhanced cooperation with the computer security incident response teams’ network;
(1) OJ C 377, 30.9.2022, p. 2.
ELI: http://data.europa.eu/eli/res/2024/2316/oj 1/5EN
OJ L, 10.10.2024
5. Notes with satisfaction that in 2022 the Agency piloted the Union heat map, which aimed to provide a quick
overview of cyber incidents and cyber events affecting Union’s critical sectors as a result of the cyber activity related
to the Russian war of aggression against Ukraine; notes that those sectors contributed to the integrated situational
awareness and analysis report from the Commission, with 52 updates on the current situation and incidents in
regard to the Russian war of aggression against Ukraine, contributing to the Union’s crisis management mechanism;
6. Takes note of the fact that, according to the Court’s Special Report No 5/2022: ‘Cybersecurity of EU institutions,
bodies and agencies’, the number of cyberattacks on EU bodies is increasing sharply and the level of cybersecurity
preparedness within Union bodies varies and is overall not commensurate with the growing threats; observes that
since Union bodies are strongly interconnected, a weakness in one can expose others to security threats; highlights
that the Court recommends that the Agency together with Computer Emergency Response Team for the Union
should increase their focus on Union bodies that have less experience in managing cybersecurity by: (a) identifying
priority areas where Union institutions, bodies and agencies need most support, for example through maturity
assessments; and (b) implementing capacity-building actions, in line with their memorandum of understanding;
calls on the Agency to address the issues raised by the Court and report back to the discharge authority on any
measures taken on this matter;
7. Takes note of the fact that the Agency conducted various activities in 2022 to fulfil its role in supporting the Union;
notes that while the Agency was able to offer its support to several policy files, such as network and information
security, cyber resilience and digital operational resilience, resource constraints prevented the Agency from actively
supporting policy files with cybersecurity provisions, such as the European health data space, and other key policy
files, such as digital markets and the digital services; notes that other activities included informing policymakers
about the effectiveness of existing cybersecurity frameworks and providing support to critical sectors; notes
furthermore that the adoption of Directive (EU) 2022/2555 of the European Parliament and of the Council(2)
(NIS 2 Directive) stands out as a measure to address challenges and harmonise policies across the Union;
understands that the lack of harmonisation in the NIS 1 Directive implementation led to a fragmented policy
landscape, addressed by the NIS 2 Directive; is aware that the latter expands its scope introducing new horizontal
tasks for the Agency, such as the Union register for digital entities; highlights that the Agency adjusted its services
and resources with a new strategy to meet the evolving demands of the cybersecurity landscape;
Efficiency and gains
8. Notes that the Agency sought to increase its use of services shared with other agencies and/or the Commission,
including, for example, through interagency and interinstitutional procurement processes, and sharing services with
European Centre for the Development of Vocational Training (Cedefop) and the European Cybersecurity
Competence Centre (ECCC); notes furthermore that in 2022, the Agency signed a service-level agreement with the
newly established European Cybersecurity Industrial, Technology and Research Competence Centre, for the
provision to the centre of data protection officer and accountant services, to be implemented in 2023;
9. Takes note of the steps taken by the Agency to move away from the traditional headcount methodology to a strategic
workforce planning to anticipating and addressing staffing gaps in order to build an agile workforce and allocate
resources to priority areas;
10. Welcomes the Agency’s contribution to the promotion of shared services among agencies through several networks
in the areas of procurement, human resources, ICT, risk management, performance management, data protection,
information security and accounting; points out the horizontal benefits of working together and adapting best
practices and that joint initiatives bring together diverse perspectives, reduce duplication of effort, enhance learning
and strengthen relationships between the participants; encourages the Agency to find internal procedures that could
be streamlined via new IT tools;
11. Notes with satisfaction the involvement of the Agency in the pilot exercise within the EU Agencies Network intended
to support Union agencies to increase their preparedness for the upcoming new cybersecurity regulation;
12. Recalls the importance of increasing the digitalisation of the agency in terms of internal operation and management
but also in order to speed up the digitalisation of procedures; stresses the need for the agency to continue to be
proactive in this regard in order to avoid a digital gap between the agencies;
(2) Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level
of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive
(EU) 2016/1148 (NIS 2 Directive) (OJ L 333, 27.12.2022, p. 80).
2/5 ELI: http://data.europa.eu/eli/res/2024/2316/ojEN
OJ L, 10.10.2024
Staff policy
13. Notes that on 31 December 2022, the establishment plan was 89,02 % implemented, with 73 temporary agents
appointed out of 82 authorised under the Union budget (compared to 76 authorised posts in 2021); notes that, in
addition, 27 contract agents, 10 seconded national experts, 10 interim staff and 16 contractors worked for the
Agency in 2022;
14. Notes with concern the lack of gender balance within the Agency’s senior and middle management with 12 out of 17
being men (71 %); considers that the gender balance within the Agency’s senior and middle management needs to be
improved; recalls the importance of ensuring gender balance and calls on the Agency to take this aspect into
consideration with regard to future appointments within its senior and middle management; takes note of the
gender distribution within the Agency’s management board, with 41 out of 55 (75 %) being men; acknowledges
that the composition of the management board depends to a large extent on Member State nominations; insists that
the Commission and the Member States take into account the importance of ensuring gender balance when
nominating their members to the Agency’s management board; notes the balanced gender distribution within the
Agency’s staff overall, with 57 men (52 %) and 53 women (48 %); notes the steps taken by the Agency with the aim
to tackle issues in relation to gender balance which includes the revision of its recruitment policy with a view to
encouraging applications from women; notes furthermore that the Agency has planned in its corporate strategy to
obtain EU Agency’s Network Certificate of Excellence in Diversity and Inclusion by the end of 2025;
15. Notes that the Agency has a policy on protecting the dignity of the person and preventing psychological and sexual
harassment, and that the Agency is part of the interagency task force of confidential counsellors; looks forward to
receiving their report and recommendations; notes that there were no reported cases of harassment in 2022 and
encourages the Agency to continue and develop the work to prevent cases in the future as well;
16. Raises concerns about the geographical imbalance within the Agency’s senior and middle management and other
staff, with a 40,9 % representation of Greek nationals; insists that improvements have to be made; asks the Agency
to report back on this to the discharge authority;
17. Notes with concern that during the development of the 2023 work programme, the Agency identified a resource
shortfall of EUR 734 000and two FTEs in operations, and EUR 2,5 million in corporate services; notes furthermore
that a thorough evaluation of human resource needs for 2023-2025 revealed a significant gap, particularly in critical
areas of activity and without additional posts, the Agency may need to prioritise and adjust future work programs to
offset the resource shortfall; takes note of the fact that the Agency’s management board has also expressed the need
to increase staffing posts for the Agency to be able to fully deliver its mandate in a sustainable manner;
18. Welcomes the Agency’s efforts to integrate persons with disabilities setting accessible infrastructure and support
services;
19. Notes that in 2022 the Agency continued with its complementary support to staff in vouchers, internet
reimbursement and fit@work programme and developed its code of conduct, outlining Agency’s expectation
regarding members of staff behaviour and conduct;
Procurement
20. Notes, with concern, that the Court found two cases where the Agency had awarded low-value contracts (below
EUR 15 000) without issuing an evaluation report and an award decision duly approved and signed by the
authorising officer which contravenes points 30.3 and 30.4 of Annex I to the Financial Regulation; recalls in this
regard that the Court made a similar observation in their 2021 report and the Agency’s reply stating that it had
already taken the necessary steps to address this concern; insists on the importance to implementing procedures to
ensure full compliance with the Financial Regulation; calls on the Agency to address the issues raised by the Court
and report any developments in that regard to the discharge authority;
ELI: http://data.europa.eu/eli/res/2024/2316/oj 3/5EN
OJ L, 10.10.2024
21. Takes note that according to the Court, during 2022, the Agency offered its managers a professional appraisal
performed by an external provider, designated by the Agency; notes that in three cases, the Agency paid the
provider directly for these services, while in the remaining 23 cases, it reimbursed its managers, who had paid the
provider themselves; observes that the total amount paid by the Agency for the 26 appraisals was EUR 120 276;
regrets that the Agency selected the provider without launching an open procurement procedure, and for this
reason the Court concluded that those payments were irregular; calls on the Agency to address the issues raised by
the Court and report back to the discharge authority on any measures taken on this matter;
22. Insists that the objective of public procurement rules is to enable procuring entities to obtain the goods and services
they need at best price, while ensuring fair competition between tenderers and compliance with the principles of
transparency, proportionality, equal treatment and non-discrimination; calls on the Agency to further improve its
public procurement procedures, ensuring full compliance with the applicable rules, so that they achieve the best
possible value for money;
Prevention and management of conflicts of interest and transparency
23. Notes the Agency’s existing measures and ongoing efforts to secure transparency, prevention and management of
conflicts of interest, and notes that the CVs of the members of the management board, and their declaration of
commitment and declarations of interests are being published on its website, although some of the CVs are missing;
24. Notes that the Agency has not reported any cases of conflict of interest in 2022; further notes the Agency’s adoption
of its management board Decision 15/2021 on the prevention of conflicts of interest and the update of the
templates for the declarations; insists on the importance of having procedures in place for monitoring compliance
with the rules related to ‘revolving doors’ and actively monitoring the professional activity of their senior members
of the staff, including those who have left the agency within the last two years, in order to be able to detect
undeclared ‘revolving doors’ situations;
25. Takes note that the calendar of the meetings between the Agency’s management and external stakeholders is publicly
available on its website;
26. Recalls the importance for the Agency to develop greater visibility in the media, internet, and social media in order
to make its work known to the citizens;
Internal control
27. Notes that the internal audit service conducted in 2021 an audit on strategic planning programming and
performance management and issued its final audit report in April 2022, with three important recommendations
notes further the Agency’s agreement with the audit observations and having taken the necessary steps to address
those concerns;
28. Observes that according to the Court the Agency has no pre-determined model assessment, namely guidelines, to
help the evaluation committee to assess the tenders; notes that this entails the risk that the tenders may not be
evaluated consistently by each member of the evaluation committee; calls on the Agency to address this issue raised
by the Court and report back to the discharge authority;
29. Takes note that in 2022, the Agency performed ex post controls of financial transactions made during 2021 financial
year as per Article 45(8) and (9) of Commission Delegated Regulation (EU) 2019/715(3); draws attention to the fact
that three weaknesses were identified, leading to three recommendations on financial transactions, none of which
was deemed critical; observes that to address the main weakness, weekly monitoring of time to payment was
introduced in 2022 to alert the relevant financial staff to urgent transactions remaining to be processed, to comply
with the legal framework on payment time limits;
(3) Commission Delegated Regulation (EU) 2019/715 of 18 December 2018 on the framework financial regulation for the bodies set up
under the TFEU and Euratom Treaty and referred to in Article 70 of Regulation (EU, Euratom) 2018/1046 of the European Parliament
and of the Council (OJ L 122, 10.5.2019, p. 1).
4/5 ELI: http://data.europa.eu/eli/res/2024/2316/ojEN
OJ L, 10.10.2024
30. Notes that in 2022, the assessment of the effectiveness of the internal control systems of the Agency was based on
the indicators of the framework, and also additional information from specific (risk) assessment reports, audit
findings and other relevant sources; observes that the assessment of the Agency’s internal controls indicates
reasonable assurance in facilitating effective and efficient operations, ensuring quality reporting, and compliance
with regulations but some improvements are needed in relation to certain principles to increase effectiveness and
ensure proper implementation of the internal controls; calls on the Agency to report back to the discharge
authority on its follow-up action on the improvements assessment;
Other comments
31. Notes that the Agency has implemented important measures in order to increase cyber security protection, such as
secure email solution (SECEM2), red team exercise and follow-up fixes and hardening, decommissioning of legacy
systems, update of internal cybersecurity policy framework;
32. Welcomes the fact that the Agency’s management board added to the Agency’s Single Programming Document
2022-2024 the goal for the Agency to achieve climate neutrality across all its operations by 2030; notes that with
the adoption of the Agency’s corporate strategy, the EMAS certification and green public procurement are key
objectives of the Agency; takes note of the fact that the certification process is expected to be completed in the
course of 2024;
33. Refers, for other observations of a cross-cutting nature accompanying its decision on discharge, to its resolution of
11 April 2024(4)on the performance, financial management and control of the agencies.
(4) Texts adopted, P9_TA(2024)0280.
ELI: http://data.europa.eu/eli/res/2024/2316/oj 5/5