text: THE EU-CYBERSECURITY INDEX 2024: EU-LEVEL INSIGHTS AND NEXT STEPS

text: A more detailed explanation can be found in the methodological note here: https://www.enisa.europa.eu/topics/state-of-cybersecurity-in-the-eu 2 More on the use of indexes to measure cybersecurity in OECD (2024), “New perspectives on measuring cybersecurity”, OECD 3 https://www.oecd.org/en/publications/handbook-on-con- Digital Economy Papers, No. 366, OECD Publishing, Paris, https:// structing-composite-indicators-methodology-and-usdoi.org/10.1787/b1e31997-en er-guide_9789264043466-en.html

text: This area This area describes the describes the ability of the ability of society private sector to to recognise 23 27 prevent, detect, threats and and analyse

text: cyber threats incidents. Industry and incidents.

text: This area This area describes the describes the ability of a MS state of policy to carry out 23 13 development operations to and

text: implementation. resilience.

text: SMEs: Security MINIMUM Large enterprises: MINIMUM Incidents - Security Incidents

text: Disclosure of EU AVG - Disclosure of EU AVG

text: conﬁdential data conﬁdential data

text: Eurostat 1.28 Eurostat 5.17

text: SMEs: Security CSIRTs

text: Destruction 3.79 7.62

text: or corruption of data

text: ENISA - CSIRTs

text: by country map

text: Citizens: secure

text: internet use EU AVG

text: Eurobarometer 5.69 u

text: Enterprises using MINIMUM MINIMUM investments by

text: AI technologies 2.78 1.24 EU AVG essential/important EU AVG

text: for ICT security entities

text: Eurostat 7.22 ENISA-NIS 1.46

text: Investments Report

text: EU R&D

text: Source 10.31 Source 24.93

text: ENISA - CSIRTs EC - Horizon

text: by country map Dashboard

text: Enterprises: risk

text: assessment EU AVG

text: Eurostat 21.31

identifier: The EU Cybersecurity Index 2024

title: The EU Cybersecurity Index 2024

text: THE

text: EU-Cybersecurity

text: Index

text: EU-level insights and next steps CONTACT

text: For contacting the authors please use security-index@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu.

text: AUTHORS

text: ENISA

text: LEGAL NOTICE

text: This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to the

text: Regulation (EU) No 2019/881

text: . ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source. Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. ENISA maintains its intellectual property rights in relation to this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2025 Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence (https://creativecommons.org/ licenses/by/4.0/). This means that reuse is allowed, provided appropriate credit is given and any changes are indicated. For any use or reproduction of elements that are not owned by the European Union Agency for Cybersecurity, permission may need to be sought directly from the respective rightholders.

text: Catalogue number: TP-01-25-018-EN-N

text: ISBN: 978-92-9204-713-9

text: DOI: 10.2824/7714867

text: INTRODUCTION

text: The EU Cybersecurity Index (EU-CSI) is a tool, developed by Disclaimer: ENISA in collaboration with the Member States, to describe The data collection for the 2024 EU-CSI took place in a perithe cybersecurity posture of Member States and the EU. od before October 2024, e.g. the deadline of the transposition of the

text: Directive (EU) 2022/2555

text: on measures for a high common level of cybersecurity across the Union (“NIS2 Di- The intent of this publication is two-fold: rective”). We acknowledge that this is likely to lead to observations and results that may not reflect the respective status • Presenting key EU-level insights of the 2024 EU Cyberafter the transposition of this Directive. security Index (EU-CSI), which have been used, among other sources, to conduct the analysis of the first Report on the State of Cybersecurity in the Union published in December 2024. This publication only refers to EU-level data. National • Accounting for the work that ENISA and the Member data has limited disclosure. States have been carrying out, while setting the basis for the next edition of the EU-CSI in 2026.

text: WHAT IS THE EU NEXT CYBERSECURITY STEPS INDEX?

text: As per above, the EU-CSI is a tool to describe the cybersecu- The EU-CSI is developed and implemented by ENISA in colrity posture of Member States and the EU. Making the most laboration with Member States, as represented in the ENISA of the available data and information, the EU-CSI provides National Liaison Officers (NLO) Network according to the insights on the respective cybersecurity maturity and capa- guidelines and recommendations in the OECD/JRC’s handbilities while helping detect opportunities for peer-learn- book on constructing composite indicators . ing between Member States. It also serves as basis for the ENISA and the Member States are currently working to further quantitative and qualitative assessment of the level of marefine the EU-CSI to reflect the lessons learnt from 2024 and to turity of cybersecurity capabilities and resources across the integrate the feed-back received by Member States. Feed-back Union stipulated in the Article 18 of the NIS2 Directive. has been sought also through a public consultation. The EU-CSI is a composite index, with a hierarchical structure. Simplifying as much as possible , it comprises a set In particular, for the next edition, the current structure of qualitative and quantitative indicators that are scaled to would be simplified by optimising the list of indicators and a score from 0 to 100. These indicators, and their respec- the way how they are calculated, with further improvement tive scores, are grouped into cybersecurity areas that score of data sources and further alignment of the EU-CSI to the from 0 to 100. In turn, these areas, and their respective NIS2 Directive. scores, are grouped into a single overall score up to 100. The further refinement of the EU-CSI is part of the contin- An index score quantifies multidimensional concepts that uous effort to improve the available knowledge on the cycannot be measured directly, by integrating multiple factors bersecurity posture MS, which is essential to achieve a high into a single value. 0 is the lowest score: it means that for common level of cybersecurity across the Union and to supa specific indicator or an area the EU is achieving subopti- port the EU and Member States to increase their cybersecumal results. 100 is the highest score: it means that for that rity capabilities. specific indicator or an area the EU is achieving very good results . The data included in the EU-CSI were collected from the relevant authorities in the Member States, data reported to ENISA per applicable legal frameworks such as incident reporting, the Cybersecurity Threat Landscape report of ENI- SA, and from other publications of ENISA and the European Commission. The EU-CSI is a biennial index, which, in the current form, started in 2024. Accordingly, while the data have been collected in 2024, in some cases, where recent data were not available, older data sources were used. The next edition of the EU-CSI will be run in 2026.

text: Key insights EU-CYBERSECURITY INDEX IN 2024 The overall index value for the EU is 62.65 (out of 100). Almost all Member States score within 10.00 units of the EU average. The average deviation from the EU average is 3.76 units, indicating a general alignment across the Union in the indicators considered. The Member States’ overall index score deviations range from a minimum of q13.18 units below the EU average to a maximum of p7.45 units above the EU average. Capacity prevent EU AVG Market / EU AVG 64.51 62.36

text: The cybersecurity capacity area, which measures the abil- The cybersecurity market/industry area, which measures ity of society to recognise threats and prevent cybersecurity the private sector’s ability to prevent, detect, and analyse incidents score 64.51. The majority of Member States score cyber threats, score 62.36. Notably, all 27 EU Member States within a 10-point range of the EU average. The average devi- showing scores fell within a 10-point range of the EU averation of Member States’ scores from the EU average is 4.73 age. The average deviation of Member States’ scores from points, ranging from a minimum of q14.29 units to a max- the EU average is 2.78 points, ranging from a minimum of imum of p11.42 units. q7.06 units to a maximum of p7.54 units. The market/industry area exhibits the strongest alignment across the

text: EU compared to the other index areas.

text: Operations ensure EU AVG Policy EU AVG 57.63 66.09

text: The cybersecurity operations area, which measures Mem- The cybersecurity policy area, which measures the state ber States’ ability to conduct cybersecurity operations and of cybersecurity policy development and implementation, ensure resilience, score 57.63, falling below the overall in- attained the highest EU average score compared to the dex value. Despite this, a high degree of consistency is ob- other index areas, at 66.09. Despite this, it exhibits the lowserved among Member States, with the majority of Member est level of alignment among Member States, indicating States scoring within 10 points pf the EU average. The aver- significant variability, in particular with regards to vulneraage deviation of Member States’ scores from the EU average bility disclosure and supervisory measures for essential and is 6.24 units, ranging from a minimum of q11.72 units to a important entities. The average deviation of Member States’ maximum of p15.14 units. scores from the EU average is 9.45 units, ranging from a minimum of q27.28 units to a maximum of p17.45 units.

text: TOP-SCORING INDICATORS In the reporting period, Member States demonstrate high convergence in areas with the highest EU average scores. Specifically, the five indicators with the highest EU average score exhibit low average deviation. 2.42 10.93 98.02 93.83 Source MAXIMUM Source MAXIMUM

text: Most SMEs in the EU did not experience incidents leading Likewise, the large enterprises in EU that did not experito disclosure of confidential data (e.g. due to intrusion, ence incidents leading to disclosure of confidential data pharming, phishing, actions by own employees intentionally (e.g. due to intrusion, pharming, phishing, actions by own or unintentionally) with an average score of 98.02 units and, employees intentionally or unintentionally) demonstrate a an average deviation of 0.79 units. The minimum deviation high average score of 93.83, with Member State deviations is q2.42 units, whereas the maximum one is p1.28 units. averaging 2.81 units. These deviations range from a minimum of q10.93 to a maximum of p5.17 units.

text: Incidents - MINIMUM MINIMUM EU AVG presence EU AVG 94.99 Source 97.62 Source MAXIMUM MAXIMUM Eurostat 3.41 2.38

text: Similarly, the EU exhibits a high score of 94.99 for SMEs that The score for the indicator measuring CSIRTs in EU Member did not experience incidents leading to destruction or cor- States being FIRST members and TI listed/accredited/cerruption of data (e.g. due to infection of malicious software tified is 97.62, with an average deviation of 2.87 units. This or unauthorized intrusion, hardware or software failures), indicates that all Member States show score within a narrow with MS deviations averaging 1.22 units. The minimum de- range (within 10 units) of the EU average. The country with viation is q3.79 units and the maximum one is p3.41 units. the lowest value deviates from the EU average by q7.62 However, the high scores for the above indicators may be units and the country with highest value deviates by p2.38 inflated due to underreporting of security incidents by en- units. terprises, particularly SMEs, stemming from limited awareness, fear of reputational damage, or complex reporting requirements.

text: MINIMUM 7.36 u 93.29 Source MAXIMUM

text: This indicator refers to the way users in the EU behave when they use internet. The EU average for this indicator is at 93.29 units, while Member States exhibit an average deviation of 2.69 units. The minimum deviation is q7.36 units, while the maximum is p5.69 units.

text: LEAST-SCORING INDICATORS The five indicators with the lowest EU average score in the reporting period, designating areas for improvement are the following. 3.18 7.14 Source MAXIMUM Source MAXIMUM

text: Most of the enterprises in the EU do not utilise AI technol- Similarly, there is potential for increase in the cybersecuriogies for ICT security, with the relevant indicator showing ty investments by essential/important entities as part of an average score of 3.18. This low score is consistent across their overall IT budgets/spending. The EU average score Member States, with all 27 falling within 10.00 units of the for this indicator is 7.14, with an average deviation of 0.54, EU average and demonstrating an average deviation of ranging from a minimum of q1.24 units to a maximum of 1.67 units. The country with the lowest value deviates by p1.46 units. q2.78 units, while the country with highest value deviates by p7.22 units.

text: CSIRT(s) MINIMUM MINIMUM certiﬁcation 10.31 24.93 EU AVG funding EU AVG MAXIMUM MAXIMUM 27.19 30.90

text: The EU average score for CSIRT(s) certification is also low The indicator measuring the distribution of EU R&D fundat 10.31. The average deviation is 10.58 units, with a mini- ing awarded per country related to cybersecurity also mum deviation of q10.31 units and a maximum deviation reflects relatively low performance, with an EU average of of p27.19 units. These results underscore the need for tar- 24.93 units and an average deviation of 13.19 units. The geted efforts to improve both the score for this indicator minimum deviation is q24.93 units, while the maximum and the alignment among Member States. deviation reaches p30.90 units.

text: MINIMUM 26.89 32.01 Source MAXIMUM

text: Likewise, the indicator measuring enterprises conducting cybersecurity risk assessment has an average value of 32.01, with an average deviation of 9.76. The maximum deviation reaches p26.89, while the minimum deviation is q21.31.

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

text: ENISA

text: European Union Agency for Cybersecurity

text: Athens Office

text: Heraklion Office

text: 95 Nikolaou Plastira 700 13 Vassilika Vouton, Heraklion, Greece

text: Brussels Office

text: enisa.europa.eu

type: vagledning

utgivare: enisa


text: www.enisa.europa.eu European Union Agency For Network and Information Security

text: The European Cyber Security Challenge: Lessons Learned report

text: Cybersecurity competitions – the status in Europe, ENISA, November 2014. Retrieved from: here

text: Figure 2 - ECSC 2015 finalists

text: Figure 3 - ECSC 2016 finalists

text: Organisation team

text: Number Owner

text: ECSC National organiser

text: Timeframe Implementation actions

text: year before  Establish an ECSC project governance model including clear roles and responsibilities. next ECSC  Assess the need for external human resources.  Engage with pan-European ECSC community.

text: Attending countries

text: Number Owner

text: ECSC National organiser

text: ● The hosts for future editions should be established well in advance in order to facilitate proper planning and budgeting. ● Countries interested in attending the challenge should be given the opportunity to announce their intention at least one

text: year prior to the event.

text: ● The scope of the challenge in terms of attending countries should be defined (European vs EU+EFTA).

text: Timeframe Implementation actions

text: year before next  Establish a formal ECSC project plan. ECSC  Assess potential participating Member States.  Establish a ECSC attendance scope

text: Number Owner

text: ECSC National organiser

text: ● Rules concerning the content of the challenge should be established prior to each edition. Any changes to these rules should be made by the Steering Committee and should enter into force as of the next edition.

text: Timeframe Implementation actions

text: Budget and sponsorship

text: Number Owner

text: ECSC National organiser

text: ● The national organisers of the previous ECSCs and Steering Committee stress that external sponsorship is key to funding the event. ● The national organisers of previous challenges have received significant funding from both private and public partners. The organisations experienced a very reactive attitude from private organisations towards offering funding. This is the result of proactive communication about the challenge and informing the industry of the benefits of a potential sponsorship. ● In order to establish an attractive climate for investors, the national organisers established a sponsorship scheme that results in different benefits according to the funding amount. For example: 1) Gold sponsorship (full exposure, access to talent, additional marketing and advertising opportunities) 2) Silver sponsorship (medium exposure, access to talent) 3) Bronze sponsorship (limited exposure)  Sponsors that obtain access to talent should tailor their presence to the expectations of the audience. Traditional “HR boots” do not appeal to cyber security talent. The sponsors should be encouraged to explore innovative and nonconventional ways to interact with the talent. This will result in a high return-on-investment from the sponsors’ perspective, and a high satisfaction rate from the participants’ perspective.  Sponsors that provide conferences or presentations should tailor the content to the target audience.

text: Timeframe Implementation actions

text:  Establish an attractive sponsoring scheme for private organisations. The sponsoring scheme should ideally provide multiple levels of sponsorship based on the amount of funding to stimulate 1 year before next substantial contributions. ECSC  Reach out to national government and public organisations to promote the event and potentially obtain sponsorship and leadership commitment.  Consider the potential of entry fees for non-participants for the conference, job fair and spectating.

text: Number Owner

text: ECSC National organiser

text:  Ensure the stability and security of the platform during the challenge and take into account any unforeseen circumstances that might affect the continuity of the event. This includes regular and adequate testing by the service provider to build

text: capacity to prevent, detect and respond to incidents.

text:  Achieve a challenge design that meets the requirements as set out in the ECSC curricula that takes the expectations of the participants into account.  Be transparent about any decisions made by the Steering Committee or organisers that could affect the course of the challenge.  Clearly communicate the rules and agreements to participants on beforehand to avoid any ambiguity or misunderstanding.  Clearly communicate the agreements and expectations with regard to the presentations. The content of the presentations should meet the expectations of the participants.  Perform a capacity and quality assessment of the platform service provider in order to ensure the ability to meet the requirements and expectations of the ECSC.

text: Timeframe Implementation actions

text:  Assess the features and properties of the ECSC challenge platform according to the ECSC Curriculum.  Identify and contact ECSC challenge (CTF) platform providers. 1 year before next  Ensure the platform provider can meet the quality standards of ECSC in order to guarantee the ECSC continuity and security of the platform.  Closely follow-up with the platform provider during the platform deployment.  Establish a scoring scheme.  Raise the scoring scheme to the Steering Committee for approval.

text: Number Owner

text: ECSC National organiser

text: ● The national organiser should adequately document the activities related to the organisation of the European Cyber Security Challenge in order to optimise the process for the following editions. ● In order to scale the event, improving the maturity of the organisation process is crucial. The first step in improving the maturity is to document all steps leading to a successful event. This documentation stimulates a debate between national organisers, and the exchange of best practices. ● All relevant working documents and project management tools should be shared amongst the national organisers to optimise the process. The intention is to formalise the key decisions in structured way, leading to a framework that reduces the organisational efforts in the planning and organising of future ECSC events.

text: Timeframe Implementation actions

text:  Assess lessons learned from previous ECSC challenges. 1 year before  Establish a knowledge management team collaboration environment to store ECSC documentation. next ECSC  Identify and document ECSC organising processes.  Document lessons learned and opportunities for improvement.  Share lessons learned and opportunities for improvement with the ECSC stakeholder group.

text: Public relations and communication strategy

text: Number Owner

text: ECSC National organiser

text: ● Since creating awareness about the event is key to stimulate the scaling of the Challenge, national organisers, participating teams and ENISA should execute a consistent and optimised communication strategy in order to meet its full potential. ● The potential of social media should be leveraged to obtain maximum exposure amongst the target audience and the cybersecurity community. ● A PR timeline supports this objective by defining dates, channels and messages. The timeline implies a consistent timing of the publication of posts across multiple channels. ● A cross-Country PR timeline should be established in collaboration with all participating States and ENISA to maximise exposure and visibility by maintaining coherence in the communication strategy.

text: Timeframe Implementation actions

text:  Establish a common public relations and communications strategy, including social media, to ensure a consistent approach across all participating States and achieve maximum exposure and 1 year before next

text: visibility.

text: ECSC  Encourage and incentivise participants’ social media engagement with the #ECSC20XX-tag.  Capture, analyse and share online communication statistics in order to strengthen the ECSC

text: business case and attract sponsors.

text: Conferences, job fair and social event

text: Number Owner

text: ECSC National organiser

text: ● Although cybersecurity puzzles are the focus of the event, activities such as the conferences, job fair and social event add value to the ECSC. The link between these events and the actual challenge should be established and these activities should be embedded in the event. ● The ECSC should not be seen as another traditional cyber security conference, but rather focuses on the potential added value of the challenge where top cyber security talent from Europe are invited to compete, collaborate, meet and network with private sector organisations. ● The social event agenda and activities should reflect the interests of the participants. ● The conferences should be tailored to the target audience and add value to the development of technical knowledge. ● The job fair and recruiting activities should be embedded and aligned with the actual conference. Traditional “booth job fairs” should be reconsidered as they have limited effect on participants. The involved private organisations should be encouraged to propose innovative and non–conventional recruiting activities.

text: Timeframe Implementation actions

text:  Identify and engage with speakers and panellists for the conferences that reflect the interests of the

text: participants. The conferences should be tailored to the target audience and relate to their interests.

text:  Integrate the conferences in the ECSC so it is not perceived as a necessary side event but rather an 1 year before integral part of the overall experience. The conferences should add value to the technical expertise of next ECSC the participants rather than promote products, services or organisations.  Ensure a clear link between the cybersecurity challenge and the content of the conferences and social

text: event. These activities should appeal to the participants.

text:  Encourage private organisations to propose innovative and non-conventional job fair formats that

text: appeal to the participants. Focus on the mutual benefit for both organisations and students.

text: Jury and Steering Committee

text: Number Owner

text: ECSC National organiser

text: ● The Steering Committee should focus on its main function of being a decision making that serves the improvement of the ECSC. The efficiency of the Steering Committee is crucial in order to implement recommendations and increase the maturity and capacity of the event. ● The Steering Committee meetings should be highly effective and have a clear and agreed-upon agenda that is strictly followed to ensure all topics are covered and timing is respected. ● Decisions taken by the Steering Committee should be logged in a decision-making register that allows for reference in following meetings. This logbook will contain information about decisions, owners and actions. ● The Steering Committee meetings should not reflect upon already taken decisions. Should certain points require further discussion, this should be communicated to the Secretariat in advance. ● The Jury should be transparent about its decision towards participants and organisers.

text: Timeframe Implementation actions

text:  Define a clear agenda for every Steering Committee and avoid any deviation from the

text: foreseen timeframe in order to avoid delays and maintain efficient decision-making.

text:  Capture and document all decisions made during the Steering Committee meetings, including

text: decisions, actions and owners, in a decision-making log.

text: year before next ECSC  Transparently communicate the decisions made by the Steering Committee to all relevant stakeholders including participants and organisers.  Appoint a single point of contact (SPOC) of the platform provider to represent the provider during the ECSC event. This SPOC could join the Steering Committee in case an incident occurs or a representative of the service provider is required.

identifier: The European Cyber Security Challenge: Lessons Learned report

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: The European Cyber Security Challenge: Lessons Learned report

serie: rapporter

text: About ENISA

type: rubrik

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and EU citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

type: stycke

text: Contact

text: For media enquires about this paper, please use press@enisa.europa.eu.

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice

text: © European Union Agency for Network and Information Security (ENISA), 2017 Reproduction is authorised provided the source is acknowledged.

text: Table of Contents

text: Executive Summary 4

text: 1. Purpose of this document 5

text: 2. Methodology 6

text: 3. ECSC editions 7

text: ECSC 2014 7

text: ECSC 2015 8

text: ECSC 2016 8

text: 4. Lessons Learned 9

text: Public relations and communication strategy 9

text: Budget and sponsorship 9

text: Challenge 9

text: 1.1 Logistics 10

text: 1.2 Conferences, job fair and social event 11

text: 1.3 Jury and Steering Committee 11

text: 1.4 Scalability 11

text: 5. Recommendations 12

text: 6. Suggested work packages 15

text: Executive Summary

text: Both the growing need for IT security professionals and skills shortage are widely acknowledged. To help solve this, multiple countries have initiated national cybersecurity competitions for students, security professionals and even non-IT professionals, all with a common goal: find cyber talents and encourage all of them to pursue a career in cybersecurity. The European Cyber Security Challenge (ECSC) builds upon these competitions adding a pan-European layer.

text: The ECSC is an initiative of multiple European countries supported by the European Union Agency for Network and Information Security (ENISA) that aims at engaging cybersecurity talent across Europe and connecting high potentials.

text: This report contains a detailed list of the lessons learned from previous ECSCs, of which the key takeaways are:

text:  The quality of the ECSC is crucial in meeting the participants’ expectations. The scenario, stability and complexity of the platform used during the ECSC are key success factors in order to provide a challenging competition that attracts top cyber talent from all over Europe.  Public relations and communication activities are key in order to meet the objectives on participation and sponsorship.  The event agenda should be tailored to the participants needs and expectations, and include activities that relate to their interests and subject matter expertise.  Given the current growth objectives of the ECSC (plus five countries per year), solid back-office

text: processes regarding the organisation of the event are necessary to meet the rising quality expectations

text: from stakeholders. This includes, amongst others, a proper governance structure with clear roles, responsibilities, decision-making, agreed-upon principles and rules with regard to fair play and transparency.  Sharing lessons learned and recommendations between organisers and participating states is crucial in order to improve the quality of the event and implement best practices.

text: 1. Purpose of this document

text: The European Cyber Security Challenge is gaining momentum and increasing in scale. In order to meet the rising quality expectations of all stakeholders, including participants, organisers and sponsors, the capacity and maturity of the ECSC organisation should increase accordingly.

text: In order to achieve the target maturity, exchanging lessons learned and recommendations is crucial. This document aims at listing the observations and improvement areas as captured during previous ECSCs and at providing guidance for future editions.

text: 2. Methodology

text: Representative feedback has been captured from both organisers and participants by means of an online

text: survey and stakeholder interviews. The objective of capturing this feedback was to assess the overall experience of the attendees and to identify strengths and opportunities for improvement.

text: The online survey contained both open and closed questions. Open questions encouraged the respondents

text: to provide qualitative feedback, while the closed questions were included to obtain quantitative feedback

text: that enabled comparison and statistical analysis.

text: Stakeholder interviews were held on behalf of ENISA prior to and during the ECSC2017 event. Multiple conference calls have been set up between previous ECSC organising States to discover key success factors

text: and best practices. During the ECSC2017 event, stakeholder interviews were held to grasp the overall experience of the event and to capture any potential issues or improvement areas.

text: 3. ECSC editions

text: The ECSC has been strongly influenced by an ENISA study on the status of cyber security competitions in the EU in November 2014 . This study assessed the current state with regard to objectives, mission and vision, and maturity of existing cyber security challenges.

text: Pre-existing national competitions (Austrian, Swiss, Spanish, Romanian, United Kingdom), and private challenges were part of the study. The feedback of multiple stakeholders from both private and public domains were captured and included in the report, resulting in a document that includes guidelines for “a pan-European cyber challenge competition”.

text: The main conclusion of the study was that there was a fertile ground for the emergence of a European level challenge:

text: “the importance of the European Commission’s active involvement in getting on board policymakers in Member States, the expertise of the EU’s cybersecurity agency, ENISA, in involving the best experts in the field and the responsibility of public and private stakeholders in understanding that the target is set very high and that they should engage to the best of their ability.”

text: The emergence of the ECSC was thus the result of private and public stakeholders committing to a common goal: to place cybersecurity at the service of humankind, with a view to promoting a peaceful society concerned with the preservation of democratic values, freedom of taught, dignity and critical thinking.

text: The abovementioned is one of the principles of the European Cyber Security Charter.

text: The following section gives an overview of all ECSC events until 2016.

text: ECSC 2014

text: The ECSC2014 event was the first of its kind and the

text: initial pilot event; it took place from 3rd to 5th November 2014 in Fürstenfeld, Austria. The finals

text: took the form of a competition between teams from Austria, Germany and Switzerland, who competed against each other in different live challenges. After the event, the teams travelled to an awards

text: ceremony at the Museum of Military History in Vienna, in the presence of politicians, economists

text: and representatives of government bodies. Figure 1 - ECSC 2014 Team Austria

text: The ECSC 2014 platform and challenges included several challenges such as an APT Network Forensic Challenge, Java Hash Collisions, HQL injections and License Key Circumventions.

text: ECSC 2015

text: The ECSC2015 event took place on 21 October in Switzerland. Six teams from six different countries (Austria, Germany, Spain, Romania, UK and Switzerland) attended the event. This edition marked also the involvement of ENISA in the project.

text: This year's competition saw a new format in which

text: teams had to fix security holes in software

text: applications while attacking other teams' assets.

text: ECSC 2016

text: One hundred European cyber security talents, representing 10 EU Member States and EFTA countries, met in Düsseldorf for the ECSC2016 event from the 7th to the 9th of November.

text: All teams had to protect their own infrastructure while attacking that of the opposing teams, while deciphering hidden messages and solving hacking challenges.

text: Participants were able to meet and talk with representatives of academia

text: 4. Lessons Learned

text: The following lessons learned serve as guidelines for maintaining and increasing the quality of the ECSC with regard to logistics, technical challenges, communication, scalability, accommodation and budget.

text:  Since creating awareness about the event is key to stimulate the scaling of the Challenge, national organisers, participating teams and ENISA should define and execute a consistent and optimised communication strategy in order to meet its full potential.  The potential of social media should be leveraged to obtain maximum exposure amongst the target audience and the cybersecurity community.  A PR timeline supports this objective by defining dates, channels and messages. The timeline implies a consistent timing of the publication of posts across multiple channels.  A cross-country PR timeline should be established in collaboration with all participating States and

text: ENISA to maximise exposure and visibility by maintaining coherence in the communication strategy.

text: Budget and sponsorship

text:  The national organisers of the previous ECSCs and the ECSC Steering Committee stress that external

text: sponsorship is key to funding the event.

text:  The national organisers of previous challenges have received significant funding from both private and public partners. The organisations experienced a very proactive attitude from private organisations

text: towards offering funding. This is the result of proactive communication about the challenge and informing the industry of the benefits of a potential sponsorship.

text:  In order to establish an attractive climate for investors, the national organisers established a sponsorship scheme that results in different benefits according to the funding amount. For example:  Gold sponsorship (full exposure, access to talent, additional marketing and advertising opportunities)  Silver sponsorship (medium exposure, access to talent)  Bronze sponsorship (limited exposure)  Sponsors that obtain access to talent should tailor their presence to the expectations of the audience.

text: Traditional “HR booths” do not appeal to cyber security talent. The sponsors should be encouraged to explore innovative and non-conventional ways to interact with participants. This will result in a

text: Challenge

text: Design

text:  Participants expect a challenge that is encouraging them to push their limits and expect to face

text: situations that involve multiple aspects of cybersecurity such as capture-the-flags (CTF) and jeopardy.

text:  The design of the technical challenges should reflect a reasonable learning curve in accordance with

text: the level of the participants. The design should anticipate a divergent level of expertise by involving self-contained steps and real-time feedback in order to support contestants to reach the next steps.

text:  The challenges should reflect real-life scenarios that prepare the participants for their future career.

text:  The technical infrastructure of the challenge should be secure and resilient in order to guarantee availability during the competition. A loss of availability of the challenge platform drastically affects the

text: overall experience.

text:  The scoring mechanism should be transparent with regard to attribution and distribution of points

text: over the challenge.

text:  The challenge design should aim at maximizing the interaction between the teams in order to stimulate the competitive aspect of the challenge.  The design of the challenges should also take into account the continuous growth of the competition.

text: Service providers

text:  The service providers should guarantee the functionality and security of the challenge platforms and supporting systems.  The service providers should foresee measures in order to prevent, detect and respond to any incidents that could impact the availability and integrity of their systems. This includes, but is not limited to testing of infrastructure and platform and setting up back-up infrastructure.  The service providers should provide adequate support during the competition to participants and organisers in case of incidents in order to safeguard the continuity of the competition.  The host and the ECSC Steering Committee should closely follow-up with the service providers on the progress of the platform development and deployment in order to detect, prevent and respond to events that might affect the delivery of the platform.

text: Rules

text:  The rules should be clear, unambiguous and agreed-upon by all participating countries.  Clear communication about the rules to the teams is key to ensure the fairness of the competition.  Compliance to the rules should be monitored and taken into account in order to avoid malicious activities such as cheating or unfair competition.  Amendments to the rules should be backed-up by reasonable argumentation and discussed during the Steering Committee meetings at the earliest convenience.

text: Presentations

text:  The presentations held by the participants as part of the Challenge should be aligned with the

text: objectives of the challenge with regard to building expertise.

text:  Clear guidelines on the practicalities such as the submission should be provided from the Jury and organisers to the participants.

text: Logistics

text:  The location should be determined taking into account the overall connectivity and infrastructural

text: capacity. The selected venue and city should be able to provide accommodation capacity, reliable and

text: qualitative infrastructure, as well as efficient accessibility for participating teams from all over Europe.  Selecting the accommodation and location of events should reflect – and be tailored to – the

text: preferences of the participants.

text:  Taking into account the satisfaction of the sponsors in terms of exposure to talent, the location should

text: also consider the student and talent population within the region. Having multiple universities is an

text: asset that positively influences the exposure of private organisations towards students, and stimulates the attendance rate to the side conference and job fair.  Should a national organiser believe the ECSC date should be rescheduled, this should be formally brought up in a timely manner to the complete ECSC group to avoid overlap or conflicts with other national initiatives.

text:  In general, the earliest time to organise the ECSC event is October. Any deviation from the original planning should be discussed and decided upon with the formal input of all the members of the ECSC organisation.  When unforeseen logistical problems arise, the participants and organisers should be informed

text: immediately.

text: Conferences, job fair and social event

text:  Although cybersecurity puzzles are the focus of the event, activities such as the conferences, job fair

text: and social event add value to the ECSC. The link between these events and the actual challenge should be established and these activities should be embedded in the event.

text:  The ECSC should not be seen as another traditional cyber security conference, but rather focuses on

text: the potential added value of the challenge where top cyber security talent from Europe are invited to compete, collaborate, meet and network with private sector organisations.

text:  The social event agenda and activities should reflect the interests of the participants.  The conferences should be tailored to the target audience and add value to the development of technical knowledge.  The job fair and recruiting activities should be embedded and aligned with the actual conference. Traditional “booth job fairs” should be reconsidered as they have limited effect on participants. The involved private organisations should be encouraged to propose innovative and non–conventional recruiting activities.

text: Jury and Steering Committee

text:  The Steering Committee should focus on its main function of being a decision making body that

text: serves the improvement of the ECSC. The efficiency of the Steering Committee is crucial in order to

text: implement recommendations and increase the maturity and capacity of the event.  The Steering Committee meetings should be highly effective and have a clear and agreed-upon

text: agenda that is strictly followed to ensure all topics are covered and timing is respected.

text:  Decisions taken by the Steering Committee should be logged in a decision-making register that allows for reference in following meetings. This logbook will contain information about decisions, owners and actions.  The Steering Committee meetings should not reflect upon already taken decisions. Should certain points require further discussion, this should be communicated to the Secretariat in advance.  The Jury should be transparent about its decision towards participants and organisers.  The role of an independent jury and referees should be considered.

text: Scalability

text:  When organising the European Cyber Security Challenge, national organisers should consider the

text: scalability aspects of the event. The ultimate goal of the ECSC is to grow and expand every year with

text: regard to quantity and quality.  Establishing a robust framework that includes a clear governance structure, marketing and

text: communications plan, and other organisational, planning and logistic support is necessary to enable the ECSC to scale towards the future.

text:  The goal is to formalise the key decisions in a structured way, leading to a framework that reduces the organisational efforts in the planning and organising of future ECSC events.

text: 5. Recommendations

text: The following recommendations serve as guidelines for maintaining and increasing the quality of the ECSC based on the lessons learned as described in the previous chapter .

text: Organisation team (ECSC hosting country)

text:  The national organiser should establish a dedicated team to organise the ECSC. The team should describe clear roles and responsibilities in order to facilitate the correct ownership of tasks and project management. The team can consist of members of the national organisation body and external consultants or volunteers.  The organisation team should be in close contact with the pan-European ECSC community to ensure the implementation of best practices and a coherent communication strategy.  The host should be in close contact with the ECSC Steering Committee and ENISA during the

text: implementation of the project. Transparent status reporting is crucial.

text: Attending countries

text:  The hosts for future editions should be established well in advance in order to facilitate proper planning and budgeting.  Countries interested in attending the challenge should be given the opportunity to announce their

text: intention at least one year prior to the event.

text:  The scope of the challenge in terms of attending countries should be defined (European vs EU+EFTA).  All countries should ensure that in addition to their team’s players a number of additional (or backup) team members are chosen and also trained in order to take care of unforeseen events.

text:  Establish a common public relations and communications strategy, including social media, to ensure a consistent approach across all participating States and achieve maximum exposure and visibility.  Encourage and incentivise participants’ social media engagement with the #ECSC20XX tag.  Capture, analyse and share online communication statistics in order to strengthen the ECSC business case and attract sponsors.

text: Budget and sponsorship

text:  Establish an attractive sponsoring scheme for private organisations. The sponsoring scheme should ideally provide multiple levels of sponsorship based on the amount of funding to stimulate substantial contributions.  Reach out to national government and public organisations to promote the event and potentially obtain sponsorship and leadership commitment.  Consider the potential of entry fees for non-participants for the conference, job fair and spectating.

text: Challenge

text: adequate testing by the service provider to build capacity to prevent, detect and respond to incidents.

text: ambiguity or misunderstanding.

text: Logistics

text:  Determine the challenge venue by taking into account the overall connectivity, mobility and infrastructural capacity. The selected venue should be accessible in a comfortable manner by the

text: participating teams all over Europe.

text:  Decorate the venue to reflect the activity of the event and meet the participants’ interests.  Transparently communicate unforeseen events with regard to logistics to the participants and

text: organisers.

text: Conferences, job fair and social event

text:  Integrate the conferences in the ECSC so it is not perceived as a necessary side event but rather an integral part of the overall experience. The conferences should add value to the technical expertise of

text: the participants rather than promote products, services or organisations.

text:  Ensure a clear link between the cybersecurity challenge and the content of the conferences and

text: social event. These activities should appeal to the participants.

text:  Encourage private organisations to propose innovative and non-conventional job fair formats that appeal to the participants. Focus on the mutual benefit for both organisations and students.

text: Jury and Steering Committee

text:  Define a clear agenda for every Steering Committee and avoid any deviation from the foreseen

text: timeframe in order to avoid delays and maintain efficient decision-making.

text:  Transparently communicate the decisions made by the Steering Committee to all relevant stakeholders including participants and organisers.  Appoint a single point of contact (SPOC) of the platform and service providers to represent the

text: provider during the ECSC event. This SPOC could join the Steering Committee in case an incident

text: occurs or a representative of the service provider is required.

text: Scalability

text:  The national organiser should adequately document the activities related to the organisation of the

text: European Cyber Security Challenge in order to optimise the process for the following editions.

text:  In order to scale the event, improving the maturity of the organisation process is crucial. The first step

text: in improving the maturity is to document all steps leading to a successful event. This documentation

text: stimulates a debate between national organisers, and the exchange of best practices.  All relevant working documents and project management tools should be shared amongst the

text: national organisers to optimise the process. The intention is to formalise the key decisions in

text: structured way, leading to a framework that reduces the organisational efforts in the planning and organising of future ECSC events.

text: 6. Suggested work packages

text: The abovementioned lessons learned describe critical success factors and areas of improvement are translated into suggested work packages in this section. The work packages indicate the recommendations, implementation actions, owner and timeframe. These packages enable a clear view on open action points in order to increase the maturity of ECSC.

text: ENISA

text: European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Athens Office

text: 1 Vasilissis Sofias Marousi 151 24, Attiki, Greece

text: PO Box 1309, 710 01 Heraklion, Greece Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu