CyphrQ
Menu

What Does ENISA Do? The EU Cybersecurity Agency Explained

ENISA is the EU Agency for Cybersecurity. What it does under the Cybersecurity Act, how EU certification schemes (EUCC, EUCS) work, and its reports.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

8 min read

ENISA is the European Union Agency for Cybersecurity. It advises EU institutions and Member States, supports cross-border incident cooperation, publishes threat reports, and prepares the EU's cybersecurity certification schemes. It is an expert and coordination body. It does not fine companies, and its own description of its work does not give it enforcement powers.

What is ENISA?

ENISA says on its What we do page that it was established in 2004 and later strengthened by the EU Cybersecurity Act. That law is Regulation (EU) 2019/881, dated 17 April 2019. It describes the agency's aim as achieving a high common level of cybersecurity across Europe.

Think of ENISA as the EU's cybersecurity centre of expertise. National regulators and CSIRTs (the national incident response teams) act inside their own countries. ENISA works across them: it gathers evidence, drafts guidance and helps the Member States line up.

What does ENISA do under the Cybersecurity Act?

From ENISA's own list, its work falls into a handful of areas:

  • Policy advice: contributing opinions, analyses and advice to EU cyber policy.
  • Certification: building the cybersecurity certification schemes that make ICT products, services and processes easier to trust.
  • Cooperation: working with Member States, EU bodies and stakeholders.
  • Knowledge and capacity: sharing knowledge, building skills and raising awareness.
  • Operational support: helping with preparedness for cross-border incidents and crises.
  • Foresight: looking at what new technologies will change.

Three things ENISA does not do, as far as its own pages say: it does not regulate, it does not fine, and the page I read does not state that it issues certificates itself. For the legal duties that fall on your organisation, you look to laws such as NIS2 and to your national authority. My NIS2 scope and reporting explainer covers that side. ENISA is the agency that supports the system behind them, with technical guidance and analysis.

Is ENISA the same as NIS2, the Cyber Resilience Act or a regulator?

No. They sit at different layers:

What it is Role of ENISA
Cybersecurity Act (2019/881) The law that gives ENISA its permanent mandate and creates the certification framework Named agency; drafts candidate certification schemes
NIS2 Directive A law obliging certain organisations to manage risk and report incidents Supports Member States; its EU vulnerability database is described as provided for by NIS2
National authorities Supervise and enforce in each country Work with ENISA, but keep enforcement powers

Keep the layers apart and the EU landscape becomes much easier to read. ENISA appears in all of them, but it is the author of advice and schemes, not the enforcer.

How does EU cybersecurity certification under the Cybersecurity Act work?

The Cybersecurity Act sets up one framework for EU-wide cybersecurity certification schemes. ENISA's certification framework page says the framework lays down the procedure for creating schemes, and that each scheme specifies one or more assurance levels: basic, substantial or high.

The ENISA topic page on certification describes the system as voluntary, with the goal of empowering the EU Digital Single Market. Certification, as ENISA describes it, means a formal evaluation of products, services or processes by an independent and accredited body, followed by a certificate showing conformity. The Regulation's structure puts the preparation of candidate schemes in Article 49, the assurance levels in Article 52 and conformity self-assessment in Article 56. Read those articles in the EUR-Lex text before relying on my summary.

So who does what? In outline: the European Commission asks for a scheme, ENISA prepares a candidate scheme, and the Commission adopts it as an implementing act. Accredited conformity assessment bodies then evaluate products against it. I have not read the article text on who issues certificates in detail, so check the Regulation for the exact split between bodies and national authorities.

What are the EUCC and EUCS certification schemes?

EUCC is the first scheme. ENISA's announcement of 31 January 2024 says the European Commission adopted the implementing regulation for it. ENISA's framework page now says plainly: "The 'EUCC' scheme is published." It covers ICT products such as hardware, software and components, and is based on the international Common Criteria scheme.

In practice: EUCC builds on the SOG-IS Common Criteria framework, which ENISA says is already used across 17 EU Member States. The announcement says vendors can convert existing SOG-IS certificates into EUCC certificates after meeting added or updated requirements, and that EUCC will in time replace national schemes previously under SOG-IS. It offers two assurance levels depending on the risk of the intended use. The announcement says certificates under EUCC will be published by ENISA, and that conformity assessment bodies can be accredited and notified to assess against it.

EUCS is the proposed cloud services scheme. The status as ENISA's framework page states it today: schemes under development include the "EUCS", covering cloud services, and the "EU5G", addressing 5G. It also lists EUDI Wallets and EU Managed Security Services (EUMSS) as under development. In other words, ENISA's official page does not describe EUCS as adopted. I did not find a newer official status notice, so check ENISA's certification pages for the latest before you plan around it.

What is the ENISA Threat Landscape report?

The ENISA Threat Landscape is the agency's annual overview of cyber threats facing the EU. The 2025 edition was published on 1 October 2025 and covers 1 July 2024 to 30 June 2025. ENISA's page says it analyses 4,875 incidents.

In practice, a figure like that is only useful if you know what it counts. These are incidents in a defined 12-month window that ENISA analysed, not every attack in Europe. Quote the period and the count together whenever you use it.

One more detail worth knowing: ENISA's page records a version 1.3 revision dated 22 September 2026. Its note says the publication was updated with corrected figures (typographical and graphic design errors) and updated links. If you cite the report, cite the current version, and check any copy in an old slide deck.

What is the EU Vulnerability Database (EUVD)?

The European Vulnerability Database is ENISA's service that, by ENISA's account, pulls CVE data, vendor advisories and CISA's Known Exploited Vulnerabilities catalogue into one place. If you need to know how the CVE records feeding it are built, see how to read a CVE record.

Going deeper: for security and IT teams

Use the Threat Landscape as a prioritisation input, not a verdict. Read the methodology section of the current PDF before you quote it. Note the reporting window (1 July 2024 to 30 June 2025 for the 2025 edition), the 4,875-incident base and the v1.3 corrections. When you compare year to year, check that the categories and counting method are the same. A board slide that says "ENISA says" without the period and version is the kind of claim an auditor can challenge.

Reading an EUCC claim from a supplier. A product described as "EUCC certified" should come with a certificate you can look up. ENISA says certificates under EUCC are published by ENISA, so ask the supplier for the certificate reference and check the listing. Then ask:

  • Which exact product version, build and configuration does the certificate cover?
  • What assurance level was it evaluated at? EUCC has two levels; ask which.
  • Which evaluation body assessed it, and is that body accredited and notified for EUCC?
  • Is it a converted SOG-IS certificate, and what additional requirements were assessed for the conversion?
  • What does the Security Target (the document defining what was evaluated) say about the environment the product assumes? A certificate describes tested behaviour under stated assumptions, not general safety.

Cloud procurement while EUCS is not adopted. Do not write "EUCS certified" into requirements for a scheme ENISA still lists as under development. Ask for evidence that exists today: an audit report or certificate against a published standard, and a scope statement showing which services and regions are covered. My SOC 2 versus ISO 27001 comparison shows how to read those. Keep a line in your vendor policy to revisit once an adopted scheme exists.

Map ENISA material to your own controls. Use ENISA guidance as supporting evidence for risk assessments under NIS2-style obligations, but record the obligation itself from the law and your national transposition, not from ENISA's guidance. Evidence an auditor will accept: a dated risk register entry that cites the report version, a supplier record holding the certificate and its scope, and a review date.

Using EUVD alongside CVE feeds. Because the EUVD aggregates CVE, vendor advisories and the KEV catalogue, treat it as one more lookup rather than a replacement for your scanner's feed. Test it with a handful of CVEs you already track and confirm the exploitation status matches CISA's KEV entries before you wire anything into automation. I have not tested the EUVD interfaces myself, so I make no claim about their data formats.

Questions for your team: Which of our suppliers claim a Common Criteria or EUCC certificate, and have we seen the scope? Which reports do we cite in board papers, and at what version? Do we have a review date for cloud certification requirements?

Learn more

Key takeaways

  • ENISA is the EU's cybersecurity agency: established in 2004, with its mandate set by the Cybersecurity Act (Regulation (EU) 2019/881).
  • It advises, coordinates and prepares certification schemes. Its own pages do not give it enforcement or fining powers.
  • EUCC is published and is the first EU scheme, built on Common Criteria. EUCS, for cloud services, is listed by ENISA as under development.
  • The Threat Landscape 2025 covers 1 July 2024 to 30 June 2025 and analyses 4,875 incidents; cite the current version (v1.3).
  • The EUVD aggregates CVE data, vendor advisories and the KEV catalogue.
  • When a supplier cites an EU scheme, ask for the certificate, the version covered and the assurance level.

Sources