EU consultation marks latest step towards public-private partnership on cyber security

The European Commission has opened a consultation in which it has asked stakeholders for their views on a range of cyber security issues. It said it will use the feedback it receives to establish a new PPP on cyber security in 2016. It had announced its intention to establish the PPP in its digital single market (DSM) strategy earlier this year.

The PPP will be developed under a contract between the Commission and business groups and have access to EU funding to engage in "research and innovation activities of strategic importance to the [EU's] competitiveness in the field of cyber security," the Commission said.

"A PPP bringing together industrial and public resources would focus on innovation following a jointly-agreed strategic research and innovation roadmap. It would make the best possible use of available funds through better coordination with member states and a narrower focus on a small number of technical priorities," the Commission said.

"It should leverage funding from Horizon 2020 to deliver both technological innovation and societal benefits for users of technologies (citizens, SMEs, critical infrastructure), as well as provide visibility to European R&I excellence in cyber security and digital privacy. Furthermore cyber security is explicitly identified in the DSM strategy as a priority area in which there is a need to define missing technological standards," it said.

In the consultation stakeholders are asked to identify what they believe are "the most pressing cyber security challenges", what sectors or areas of business they believe to be "most at risk" from cyber attacks and whether organisations have access to "the necessary products/services" in Europe to "ensure security of the whole value chain".

In addition, respondents have been asked for their views on how legislation has or will influence the European cyber security market. New cyber security legislation was recently agreed upon by EU law makers, although the Network and Information Security Directive has still to be formally adopted.

Stakeholders have also been asked to share their views on the extent to which public procurement impacts on the cyber security market in Europe, as well as on whether there is sufficient access to finance and skills to support the development of cyber security businesses.

Alongside its consultation the Commission also published a roadmap (8-page / 324KB PDF) document outlining its vision towards a new PPP on cyber security. In it the Commission said it believes a fragmented approach to cyber security issues hampers the development of cyber security businesses in the EU.

"Industry and market fragmentation is a clear barrier for European companies to compete and grow their businesses across borders in Europe but also on a global scale," the Commission said. "While European companies tend to be strong and innovative, their size and capacity (mostly SMEs with few larger actors) are smaller in comparison to their US, Israeli, Chinese, South-Korean, Japanese or Russian counterparts as they experience difficulties in expanding beyond national borders."

"The difficulty to compete on the European and global levels often leads to mergers and acquisitions of European SMEs by non-European actors, weakening the European sector and leaving Europe also more vulnerable and technologically dependent on others. The barriers preventing European cyber security companies from scaling up their operations have also an unintended consequence of the outflow of highly qualified specialists, who leave the EU to look for better job and research opportunities on other markets," it said.

"Should Europe fail to stimulate a common cyber security market and to create opportunities to grow for its companies, it risks losing its cyber security industry all together as it might not be able to stand fierce global competition," the Commission said.

The Commission's consultation closes on 11 March 2016.