European Commission Proposes Cybersecurity Act 2 to Enhance EU Cybersecurity Framework

Introduction

On January 20, 2026, the European Commission unveiled a proposal for the Cybersecurity Act 2 (CSA2), aiming to modernize and streamline the European Union's cybersecurity framework. This initiative seeks to address emerging cyber threats, enhance supply chain security, and introduce new certification mechanisms to bolster the EU's digital resilience.

Background and Objectives of CSA2

The original EU Cybersecurity Act, enacted in 2019, established a framework for cybersecurity certification and granted the European Union Agency for Cybersecurity (ENISA) a permanent mandate. However, the rapidly evolving cyber threat landscape necessitated a more robust and adaptive approach. CSA2 is designed to:

• Introduce a horizontal framework for Information and Communication Technology (ICT) supply chain security.
• Enhance the EU cybersecurity certification framework.
• Strengthen ENISA's role in coordinating cross-border cybersecurity incidents.

By addressing these areas, CSA2 aims to fortify the EU's cybersecurity posture and ensure a cohesive response to cyber threats across member states.

Key Provisions of CSA2

1. ICT Supply Chain Security

CSA2 proposes the EU's first horizontal framework for ICT supply chain security. This framework mandates that organizations assess and mitigate risks associated with their supply chains, particularly focusing on components sourced from high-risk jurisdictions. The goal is to prevent vulnerabilities that could be exploited by malicious actors through supply chain attacks.

2. Enhanced Cybersecurity Certification

The proposal introduces the concept of "cyber-posture certificates," an entity-level certification under future European cybersecurity certification schemes. Organizations obtaining this certification would demonstrate compliance with NIS2 security risk-management requirements, potentially reducing the need for additional audits by national authorities.

3. Strengthened Role of ENISA

CSA2 seeks to expand ENISA's responsibilities, including:

• Conducting regular assessments and consultations on the need for additional implementing acts for entities operating in various sectors.
• Preparing cybersecurity risk analyses to assess the impact of incidents affecting cross-border services.
• Recommending joint supervisory activities by multiple competent authorities and participating directly upon request.

These measures aim to enhance coordination and consistency in the EU's cybersecurity efforts.

Implications for Organizations

Organizations operating within the EU must prepare for several implications arising from CSA2:

• Supply Chain Assessments: Companies will need to conduct thorough evaluations of their supply chains to identify and mitigate potential cybersecurity risks, especially concerning components from high-risk areas.
• Certification Requirements: Obtaining cyber-posture certificates may become a prerequisite for demonstrating compliance with EU cybersecurity standards, necessitating investments in security measures and documentation.
• Regulatory Compliance: Organizations must stay informed about evolving requirements and ensure alignment with both CSA2 and NIS2 directives to avoid penalties and maintain operational integrity.

Comparative Analysis with Other Frameworks

CSA2's introduction aligns with global trends in cybersecurity regulation. For instance, the U.S. Department of Defense's Cybersecurity Maturity Model Certification (CMMC) program, finalized in October 2025, establishes cybersecurity requirements for federal contractors and subcontractors. Both CSA2 and CMMC emphasize the importance of supply chain security and certification, reflecting a growing recognition of these areas as critical components of national and organizational cybersecurity strategies.

Next Steps and Recommendations

As CSA2 progresses through the legislative process, organizations should proactively:

• Monitor Developments: Stay updated on CSA2's status and any amendments to ensure timely compliance.
• Engage Stakeholders: Collaborate with legal, compliance, and IT teams to assess current cybersecurity practices and identify areas requiring enhancement.
• Invest in Training: Provide training for staff on new requirements and best practices to foster a culture of cybersecurity awareness.

By taking these steps, organizations can position themselves to meet CSA2's requirements effectively and contribute to a more secure digital environment within the EU.

Conclusion

The European Commission's proposal for Cybersecurity Act 2 represents a significant advancement in the EU's approach to cybersecurity. By addressing supply chain security, enhancing certification processes, and strengthening ENISA's role, CSA2 aims to create a more resilient and unified cybersecurity framework. Organizations must stay vigilant and proactive in adapting to these changes to ensure compliance and safeguard their operations against evolving cyber threats.

For more detailed information, refer to the European Commission's proposal on CSA2 and related analyses by cybersecurity experts.