identifier: Considerations on ICT security certification in EU - Survey Report

nummer: certification-survey

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Considerations on ICT security certification in EU - Survey Report

serie: rapporter

text: Survey Report

type: rubrik

text: FINAL AUGUST 2017 www.enisa.europa.eu European Union Agency For Network and Information Security Considerations on ICT security certification in EU

text: Final | August 2017

type: stycke

text: About ENISA The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and EU citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. Contact For queries in relation to this paper, please use isdp@enisa.europa.eu For media enquires about this paper, please use press@enisa.europa.eu. Legal notice Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Copyright Notice © European Union Agency for Network and Information Security (ENISA), 2017 Reproduction is authorised provided the source is acknowledged. ISBN: 978-92-9204-225-7, DOI: 10.2824/090677 02 Considerations on ICT security certification in EU

text: Final | August 2017

text: Table of Contents Executive Summary 4 1. Background 5 2. Analysis of results 6 Current Situation in ICT Security Certification 7 Future Evolution of ICT security certification across EU 8 Sectors and Technologies 9 Policy Options and Envisioned Features 10 Roles and Competencies of Policy Stakeholders 12 3. Conclusions 14 Annex A: Questionnaire Responses 15 03 Considerations on ICT security certification in EU

text: Final | August 2017

text: Executive Summary Quite often implementing European legislative initiatives relies on the availability of trustworthy information technology which means that the technology options used must be duly scrutinised and standardised prior to being put in good use.Over the last years, ENISA has engaged in a number of activities in pursuit of supporting the Commission and the Member States in identifying a way forward on the certification of ICT security products and services, which on the one hand seeks to boost competition and on the other to promote mutual recognition or harmonisation of certification practices up to a certain level. This online EU-wide survey on the topic of ICT Security Certification has been singled out as a suitable instrument to consult with stakeholders and seek structured feedback against the currently envisaged policy options. On the background, in April 2017 the Commission presented a set of tentative policy approaches as follows:  Option 0 - Do nothing: No EU policy initiative or action – baseline scenario  Option 1 - Soft law approach: Commission to encourage and support national or industry initiatives  Option 2 - Extension of SOGIS agreement: Legislative proposal making MS participation to the SOG-IS agreement mandatory  Option 3 - European certification framework: EU-wide framework with its own scope, functioning and governance rules This survey has been broadly publicised, albeit within the confined boundaries of the certification stakeholders’ community, along with a number of prospective respondents from competent Member State agencies, vendors, manufacturers and consumer associations that were all invited to participate. The survey was structured across five main thematic pillars, namely i) current situation and open issues, ii) future evolution, iii) sectors and technologies, iv) policy options and envisioned features and v) roles and competencies for the policy stakeholders. Survey respondents reflected and responded on the need to design and deploy ICT security certification at the EU level as the current ICT security certification landscape incommodes mutual recognition across Member States. The aspects of costs, duration, transparency and support during the lifecycle of a product’s certification were also highlighted as present barriers featured in the current landscape, along with different security baselines and levels of assurance concerning the criticality or the impact of each sector, such as Internet of Things and Industrial Control Systems. To meet the expectation of reducing internal market fragmentation and improving trust in the security of ICT products and services in the EU, the respondents were mostly in favour of a general European certification general framework. Following the analysis of the responses it has become clear that there is no one-size-fits-all approach to certification and labelling. The respondents agreed that the processes and tools used for security certification should be improved to ensure the required flexibility to adapt to different market situations, particularly by allowing different level of assurances according to market needs. For high assurance sectors SOG-IS MRA was perceived as a suitable paradigm to build upon and create a platform to consult further among participants while for lower assurance sectors, self-certification could complement the overall framework. Overall, any procedures implemented need to mitigate risk and allow for forthcoming technologies to take root in the EU ; the prevailing approach should be supported by an adequate amount of resources, in order to ensure appropriate coordination and support, at the level of EU Institutions and Bodies, notably at the level of the EUROPEAN Commission with support from an EU Agency such as ENISA. 04 Considerations on ICT security certification in EU

text: Final | August 2017

text: 1. Background Trustworthiness and security of information technology products can be enhanced by putting in place a certification framework. In the EU, a common scheme would support the recognition of security certification across Member States, an essential pillar towards achieving trust and security required to promote the Digital Single Market. The European Commission, has emphasized on the need to develop a proposal for a European ICT security certification framework as stated in Commissions’ COM(2016) 410 . ENISA, within the scope of its Programming Document 2017-2019 , has continued supporting the European Commission and the Member States in their efforts to identify a way forward on ICT security products certification, which on one hand seeks to boost competition and on the other to promote mutual recognition or harmonisation of certification practices up to a certain level. The Agency, has engaged in a number of activities in pursuit of this goal. This online EU-wide survey on the topic of ICT Security Certification has been deemed being a suitable instrument to consult with stakeholders and seek structured feedback against set policy options. On the background, in April 2017 the Commission presented a set of tentative policy approaches as follows:  Option 0 - Do nothing: No EU policy initiative or action – baseline scenario  Option 1 - Soft law approach: Commission to encourage and support national or industry initiatives  Option 2 - Extension of SOGIS agreement: Legislative proposal making MS participation to the SOG-IS agreement mandatory  Option 3 - European certification framework: EU-wide framework with its own scope, functioning and governance rules These four options have been reflected in the survey. With this survey ENISA and the European Commission have aimed to actively consult with industry representatives and experts from Member States on the subject-matter area, complementing the outcomes and findings of studies and consultation workshops organized. This survey serves the purpose of consulting with stakeholders to come up with an approach that serves the interests of the bulk of stakeholders across the EU. While quantitative research aims to quantifying attitudes, opinions or other defined variables in order to generalize input from a sample population, while qualitative research is focused on explaining the reasons, the opinions, and the options ofa sample population ’s behavior. This report relies on a combination of both research strategies was followed and a self-completion questionnaire was used to support the survey outcomes. The survey comprises 14 closed questions, the majority of which are based on multiple choice questions; the participants were also asked to provide comments and feedback in relation to ICT security certification on open-ended subquestions. This survey was carried outin Q2 2017. https://ec.europa.eu/transparency/regdoc/rep/1/2016/EN/1-2016-410-EN-F1-1.PDF https://www.enisa.europa.eu/publications/corporate/enisa-programming-document-2017-2019 https://www.enisa.europa.eu/events/ict-security-certification-april-2017/workshop-on-a-european-ict-securitycertification-framework 05 Considerations on ICT security certification in EU

text: Final | August 2017

text: 2. Analysis of results This survey has been broadly publicised, albeit within the boundaries of the certification stakeholders’ community, and a number of prospective respondents was invited to join and respond; specifically invitations to respond were sent to 28 agencies from Member States, 24 vendors and manufacturers from the private sector, and 4 consumer associations. The questions presented to the respondents are available under Annex A. To facilitate the presentation of the results the survey questions have been grouped across five thematic areas, namely:  Current Situation and open issues are covered by questions 2, 3 and 4  Future evolution are covered by questions 5 and 6  Sectors and technologies are covered by questions 7 and 8  Policy Options and envisioned features are covered by questions 9 through to 13  Roles and competencies for the policy stakeholders are covered by question 14 The full set of questions can be found in Annex A and the question with the responses given in Annex B. In total 33 participants provided full responses; the following tables display the survey results that derived from the number of responses collected for each answer option per question. A concise overview of the respondents’ composition is presented hereinafter: 18% National authority / Agency Manufacturer / provider of ICT of ICT products and services 3% 0% 43% User / Customer / Consumer of ICT products and services 9% Manufacturer of testing equipment Security certification laboratory Other (Please specify) 27%

text: Figure 1: Respondents’ composition

text: 06 Considerations on ICT security certification in EU

text: Final | August 2017

text: TYPE OF ORGANISATION RESPONSES

text: National authority / Agency 14 Manufacturer / provider of ICT of ICT products (both hardware and software) and services 9 User / Customer / Consumer of ICT products (both hardware and software) and services 3 Manufacturer of testing equipment 0 Security certification laboratory 1 Other (Please specify) 6

text: Table 1: Type of organisation

text: Current Situation in ICT Security Certification All survey participants agreed on the need to design and deploy ICT security certification, although some suggested that it should be limited to the Member States’ or to the industry sectorial level concerned. All respondents agreed on the need to leverage on certification to mitigate cybersecurity risks. The majority of the participants (57,5%) is aware of multiple existing ICT security certification schemes across EU Member States for the same product or service and they provided examples thereto.

text: AWARENESS OF THE EXISTENCE OF MULTIPLE ICT SECURITY CERTIFICATION RESPONSES SCHEMES ACROSS EU MEMBER STATES FOR THE SAME PRODUCT/SERVICE

text: Yes 19 No 12 Don’t know 2

text: Table 2: Multiple ICT security certification schemes across EU Member States for the same product/service

text: Some of the examples provided by the respondents include the following:  National ICT Security Certification Schemes,  SOG-IS MRA  Certification against International Standards  Sector specific certification schemes  Market driven certification schemes A smaller percentage (36,3%) of the respondents suggest that they were not aware of multiple ICT security schemes across EU, but they expressed their preparedness to accept one; at least, the survey reveals, these respondents have acknowledged the need to have ICT security certification schemes at large. Examples provided by the respondents include:  Privacy and Personal Data protection 07 Considerations on ICT security certification in EU

text: Final | August 2017

text:  IoT  Industrial Control Systems  Telecom,  Health  Aerospace  Cloud security  ICT products and services When dealing with ICT security certification procedures, the respondents indicated that the main problems they encounter are the following:  Costs (mentioned by 72,7% of respondents)  Duration of the process (supported by 57,5% of respondents)  Lack of mutual recognition of certificates across Member States (supported by 51,5% of respondents)  Lack of a dedicated scheme to cyber -certify a specific product/service (supported by 45,4% of respondents)  Lack of certification support for the lifecycle of the product (e.g., incremental certification for software and hardware changes/updates) (supported by 39,3% of respondents)  Lack of transparency in the certification process (supported by 36,3% of respondents)

text: TOTAL PROBLEMS WHEN DEALING WITH ICT SECURITY CERTIFICATION PROCEDURES RESPONSES

text: Lack of mutual recognition of certificates across Member States 17

text: Cost 24

text: Duration of the process 19

text: Lack of transparency 12

text: Lack of a dedicated scheme to cyber-certify a specific product/service 15

text: Lack of certification support for the lifecycle of the product 13

text: Table 3 : Problems when dealing with ICT security certification procedures

text: Future Evolution of ICT security certification across EU Almost all respondents, 90,9%, agreed that mutual recognition of ICT security certification schemes is desirable at European level. There was 81,8% of the respondents who agreed also that certification and labelling can be effective tools to increase transparency about the level of security assurances of ICT products/services, and enhance trust across the Digital Single Market. However, it was noted that a ranking of assurance levels with clear information is required as oversimplifying could introduce additional risks. In addition, certification and labelling should denote only baseline security requirements and should not deferment innovation or increase complexity. 08 Considerations on ICT security certification in EU

text: Final | August 2017

text: NEED FOR A MUTUAL ICT SECURITY RECOGNITION MECHANISM OF CERTIFICATES RESPONSES ACROSS ALL MS

text: The current situation is satisfactory 1 Mutual recognition is desirable at European level 30 The current situation is satisfactory; mutual recognition is desirable at European level 2 Don't know 0

text: Table 4 : Need for a mutual ICT recognition mechanism of certificates across all Member Statess

text: CERTIFICATION AND LABELLING CAN BE EFFECTIVE TOOLS TO INCREASE TRANSPARENCY ABOUT THE LEVEL OF SECURITY ASSURANCES OF ICT RESPONSES PRODUCTS/SERVICES, AND ENHANCE TRUST ACROSS THE DIGITAL SINGLE MARKET.

text: Agree 27 Disagree 6 Don’t know 0

text: Table 5 : Certification and labeling ars effective tools to increase transparency

text: The need for greater efforts to promote ICT security certification was highlighted by 66,6% of the respondents who made specific reference to industry sectors while 21,2% stated that ICT security certification is a pure market issue and there is no need for additional support.

text: RECOURSES TO CERTIFICATION AND LABELLING IN THE ICT SECTOR ARE SUFFICIENTLY WIDESPREAD OR GREATER EFFORT IS NEEDED TO PROMOTE ICT RESPONSES SECURITY CERTIFICATION IN SPECIFIC SECTORS

text: This is a pure market issue and there is no need for additional support 7 No, greater efforts are required in specific sector 22 Don’t know 4

text: Table 6: Promotion of ICT security certification in specific sectors

text: Sectors and Technologies The majority of the respondents (75,7%) identified the need for ICT security and labelling in the Internet of Things-domain, due to the imminent ubiquity of IoT, issues of vulnerabilities and the required interoperability across different platforms. 09 Considerations on ICT security certification in EU

text: Final | August 2017

text: NEED FOR ICT SECURITY CERTIFICATION AND LABELLING IN THE INTERNET OF RESPONSES THINGS DOMAIN

text: Yes 25

text: No 6

text: Don’t know 2

text: Table 7: Need for ICT security and labelling in the Internet of Things domain

text: Similarly, 66,6% of the respondents, identified the need for ICT security certification in the Industrial Control System (ICS)-domain, due to the criticality of processes they support and the level of cyber threats they are exposed to.

text: NEED FOR ICT SECURITY CERTIFICATION IN THE INDUSTRIAL CONTROL SYSTEM (ICS)- RESPONSES DOMAIN

text: Yes 22

text: No 7

text: Don’t know 4

text: Table 8: Need for ICT security and labelling in the Industrial Control System (ICS) domain

text: Policy Options and Envisioned Features To reach the objective of reducing internal market fragmentation and improving trust in the security of ICT products and services in the EU, 33,3% of the respondents opted for creating a European certification general framework, laying down the essential rules for mutual recognition of certificates issued in accordance with the framework. The “Soft law approach", encouraging, supporting and to the extent possible coordinating the adoption and use of certification initiatives at European level was supported only by 18,1% while 12,1% of the respondents were in favour of extending the SOG-IS MRA to all Member States and make it mandatory. Lastly, 12,1% opted for regulating the security of I CT products and services and specify essential security requirements for such products to be placed on the market. The remaining respondents indicated that a mixed approach, from all the aforementioned options, should be the preferred path of action instead. They argued that mutual recognition of existing certification schemes and labelling programs can promote a robust Digital Single Market and support EU digital economy while an entirely new certification framework would not scale with the dynamicsecurity landscape.

text: ACTIONS FOR REDUCING INTERNAL MARKET FRAGMENTATION AND IMPROVING RESPONSES TRUST IN THE SECURITY OF ICT PRODUCTS AND SERVICES IN THE EU

text: Considerations on ICT security certification in EU

text: Final | August 2017

text: "Soft law approach", encouraging, supporting and to the extent possible coordinating 6 the adoption and use of certification initiatives at European level Extending the SOG-IS MRA to all Member States: legislative proposal making MS 4 participation to the SOGIS agreement mandatory Creating a European certification general framework, laying down the essential rules for mutual recognition of certificates issued in accordance with the framework Regulating the security of ICT products and services, specifying essential security 4 requirements for such products to be placed on the market None of the above 8

text: Table 9: Possible options for reducing internal market fragmentation and improving trust

text: In all, 45,4% of the respondents were in favour of exploiting the current SOG-IS MRA as the basis to build an EU-wide certification framework, while 21,2% stated otherwise and 33,3% did not answer either positive or negative on the role of SOG-IS MRA.

text: SOG-IS MRA COULD BE A BASIS TO BUILD AN EU-WIDE CERTIFICATION FRAMEWORK RESPONSES

text: Yes 15 No 7 Don’t know 11

text: Table 10: SOG-IS MRA role within an EU-wide certification framework

text: On self-certification schemes, 66,6% of the respondents agreed that these schemes could present a viable option to boost the level of cyber-security for selected product’ domains, especially for low assurance level products and should be considered as an integral part of the future EU certification framework, drawing also experience from existing market driven initiatives. Nevertheless, 24,2% of the respondents disagree that self-certification should be considered, as it does not provide for any assurance, there is no control and it is not sufficient unless there is a third party validating conformance.

text: SELF-CERTIFICATION SCHEMES COULD BE CONSIDERED A VIABLE OPTION TO BOOST RESPONSES THE LEVEL OF CYBER-SECURITY FOR SELECTED PRODUCT’ DOMAINS

text: Yes 22 No 8 Don’t know 3

text: Table 11: Self-certification schemes

text: Final | August 2017

text: The overwhelming majority of the respondents, i.e. 90,9%, indicated that the processes and tools used for security certification should be improved to ensure the required flexibility by allowing different level of assurance.

text: PROCESSES AND TOOLS USED FOR SECURITY CERTIFICATION SHOULD BE IMPROVED TO ENSURE THE REQUIRED FLEXIBILITY TO ADAPT TO DIFFERENT MARKET RESPONSES SITUATIONS, PARTICULARLY BY ALLOWING DIFFERENT LEVEL OF ASSURANCES ACCORDING TO MARKET NEEDS

text: Yes 30

text: No 1

text: Don’t know 2

text: Table 12: Flexibility to allow different assurance levels

text: Introducing a common label across the EU was accepted by 66,6% of the respondents. Such a label would indicate that the products have been certified within a certification scheme in accordance with EU rules and provide visual notice that product’s features comply with specific requirements. Nevertheless, the respondents who were not in favour of a common label, proposed a specific sectoral labelling (e.g. SOGIS) or consider that it could be difficult for complex systems and/or it could also result in a false sense of security.

text: INTRODUCTION OF A COMMON LABEL SIGNALLING CERTIFIED PRODUCTS RESPONSES

text: Yes 22

text: No 8

text: Don’t know 3

text: Table 13: Introduction of a common label signalling certified products

text: Roles and Competencies of Policy Stakeholders The majority of the respondents, 78,7%, envisage a role for existing European Commission bodies and agencies (e.g. JRC, ENISA, ACER) in a possible future EU certification and labelling security framework. Among the respondents who did not see a role for existing EU Commission's bodies and agencies, supporting actions such as determining a minimum level of security per category of technology, issuing voluntary guidelines for both industry and consumers, were envisioned, without identifying key EU bodies or agencies.

text: ACTIVE ROLES FOR EXISTING EU COMMISSION'S BODIES AND AGENCIES (E.G. JRC, RESPONSES ENISA, ACER) IN A POSSIBLE FUTURE CERTIFICATION AND LABELLING FRAMEWORK.

text: Yes 26

text: Final | August 2017

text: No 4 Don’t know 3

text: Table 14: Roles and Competencies for existing EU Commission's bodies and agencies

text: Respondents envisaging a role for existing EU Commission's bodies and agencies indicated that:  A central organization at EU level is needed to warrant that a robust system is in place with defined rules, references and tools. Such a referencecentral organization could also induce recognition by Member States.  CEN/CENELEC should be involved in a future scheme with the contribution of ENISA to support technical, organisational and stakeholders’ management tasks.  EU agencies, with respective competences such as ACER and ENISA, could participate in the development of guidelines, criteria, etc., to be applied in a certification and labelling system, and promote its adoption across various stakeholders.  JRC and ENISA could serve as a monitoring body to guarantee compliance with the proposed way forward. ENISA could mandate expert groups with the definition of flexible certification approaches in respective sectors.  EU bodies could provide administrative support while supporting definition of the scheme, interacting with EU standardization bodies. Considerations on ICT security certification in EU

text: Final | August 2017

text: 3. Conclusions ICT security certification plays an important role in increasing trust and security in products and services and all survey participants reflected on the necessity to design and deploy ICT security certification at a European Level. This broad consensus was also prevalent in the consultation workshops organized by ENISA and the Europen Commission during 2016 as ICT security certification has been regarded as one of the means to enhance trust across the digital single market. This survey confirms that doing nothing is no policy option for the EU; pro-activity at the policy level is favoured by respondents who see the European Commisison as a driver for change and a greater role of the EU in the area of certification of products meets stakeholder’s expectations. Currently, the ICT security certification landscape comprises of SOG-IS MRA, national and sectorial schemes along to internal standards, which incommodes a wide-ranging recognition of certificates across Member States. Respondents also highlighted the aspects of costs, duration, transparency and support during the lifecycle as existing barriers to current setting while highlighting that depending on the criticality or the impact of each sector, such as Internet of Things and Industrial Control Systems, more attentive efforts are needed. To meet the expectation of reducing internal market fragmentation and improving trust in the security of ICT products and services in the EU, the respondents were mostly in favour of creating a European certification general framework. Notably a number of respondents were also in favour of extending the SOG-IS MRA to all Member States or encouraging, and supporting the adoption and use of certification initiatives at European level. The respondents agreed that the processes and tools used for security certification should be improved to ensure the required flexibility to adapt to different market situations, particularly by allowing different level of assurances according to market needs. There is no one-size-fits-all approach to certification and a scheme based on labelling, and flexibility is likely to be more permitting of greater transparency in this area. Any certification scheme needs to appropriately mitigate risk and be commercially oriented to allow for market forces shape benefit from forthcoming technologies i.e. the security for a handset used for emergency services should be at a higher standard than consumer devices, and therefore at a higher cost. For high assurance sectors SOG-IS MRA was perceived as a suitable framework to build upon and set up a framework to consult further among participants while for lower assurance sectors, self-certification could complement the overall framework. Lastly, respondents underlined the importance to allocate adequate resources in order to ensure due maintenance of such a framework while coordination and support roles were suggested or existing EU Institutions and Bodies, including the European Commission and an agency like ENISA. Considerations on ICT security certification in EU

text: Final | August 2017

text: Annex A: Questionnaire Responses

text: Q.1 TYPE OF ORGANISATION: RESPONSES

text: National authority / Agency 14 Manufacturer / provider of ICT of ICT products (both hardware and software) and services 9 3 User / Customer / Consumer of ICT products (both hardware and software) and services 0 Manufacturer of testing equipment Security certification laboratory 1 Other (Please specify) 6

text: Q.2 ARE YOU AWARE OF THE EXISTENCE OF MULTIPLE ICT SECURITY CERTIFICATION SCHEMES ACROSS RESPONSES EU MEMBER STATES FOR THE SAME PRODUCT/SERVICE?

text: Yes (Please answer question 2a) 19 No (Please answer question 2b) 12 Don't know 2

text: Q.2A IF YES, PLEASE ADD FURTHER DETAILS CONCERNING RESPONSES PRODUCT/SCHEME/COUNTRY/MANDATORY-VOLUNTARY NATURE, ETC.:

text: Q.2B IF NOT, DO YOU SEE THE EMERGENCE OF MULTIPLE NATIONAL OR SECTORIAL CERTIFICATION SCHEMES AS A LIKELY SCENARIO IN THE FUTURE, ESPECIALLY IN VIEW OF THE GROWING RESPONSES CYBERSECURITY RISKS?

text:  Yes (please answer question 2c) 12  2 No  Don't know 2

text: While most respondents did not splify their background some of the respondents, according to information they submitted themselves, include the following: an ISO/IEC17065 accredited body, a National standardization body, CERT.LV, Eurosmart, ZVEI, DIGITALEUROPE, Manufacturer IACS equipment and software, NXP Semiconductors. Considerations on ICT security certification in EU

text: Final | August 2017

text: Q.2C IF YES, PLEASE ADD DETAIL ON TYPE OF PRODUCT/SERVICE/SECTOR. RESPONSES

text: Q.3 HAVE YOU ENCOUNTERED ANY OF THE FOLLOWING PROBLEMS WHEN DEALING WITH ICT TOTAL SECURITY CERTIFICATION PROCEDURES? PLEASE THICK BOX(ES) AS APPROPRIATE (MORE CHOICES POSSIBLE): RESPONSES

text:  Lack of mutual recognition of certificates across Member States 17

text:  24 Cost

text:  19 Duration of the process

text:  Lack of transparency 12

text:  Lack of a dedicated scheme to cyber-certify a specific product/service 15

text:  Lack of certification support for the lifecycle of the product (e.g., incremental certification for software and 13 hardware changes/updates)

text: Q.4 CURRENTLY, THERE IS NO EU-WIDE ICT CERTIFICATION FRAMEWORK ALLOWING FOR MUTUAL/CROSS RECOGNITION OF NATIONAL SCHEMES. DO YOU SEE THE NEED FOR A MUTUAL RESPONSES RECOGNITION MECHANISM OF CERTIFICATES ACROSS ALL MS? PLEASE THICK BOX(ES) AS APPROPRIATE (MORE CHOICES POSSIBLE):

text:  The current situation is satisfactory 1

text:  30 Mutual recognition is desirable at European level

text: 2 The current situation is satisfactory; mutual recognition is desirable at European level

text:  0 Don't know

text: Q.5 DO YOU THINK THAT CERTIFICATION AND LABELLING CAN BE EFFECTIVE TOOLS TO INCREASE TRANSPARENCY ABOUT THE LEVEL OF SECURITY ASSURANCES OF ICT PRODUCTS/SERVICES, AND RESPONSES ENHANCE TRUST ACROSS THE DIGITAL SINGLE MARKET?

text:  27 Yes

text:  6 No

text:  Don't know 0

text: Final | August 2017

text: Q.6 DO YOU CONSIDER THAT RECOURSE TO CERTIFICATION AND LABELLING IN THE ICT SECTOR ARE SUFFICIENTLY WIDESPREAD OR RATHER THAT IT SHOULD BE FURTHER ENCOURAGED OR SUPPORTED? RESPONSES DO YOU BELIEVE THAT GREATER EFFORT TO PROMOTE ICT SECURITY CERTIFICATION IS NEEDED IN SPECIFIC SECTORS?

text: 7 This is a pure market issue and there is no need for additional support

text:  No, greater efforts are required in specific sector 22

text:  Don't know 4

text: Q.7 DO YOU SEE A SPECIFIC ROLE FOR CERTIFICATION AND LABELLING IN THE INTERNET OF THINGS- RESPONSES DOMAIN?

text:  25 Yes

text:  6 No

text:  Don't know 2

text: Q.8 DO YOU SEE A SPECIFIC ROLE FOR CERTIFICATION AND LABELLING IN INDUSTRIAL CONTROL RESPONSES SYSTEM (ICS)-DOMAIN?

text:  22 Yes

text:  7 No

text:  Don't know 4

text: Q.9 WHICH OF THE FOLLOWING ACTIONS DO YOU CONSIDER APPROPRIATE AND PROPORTIONATE TO ACHIEVE THE OBJECTIVE OF REDUCING INTERNAL MARKET FRAGMENTATION AND IMPROVING TRUST RESPONSES IN THE SECURITY OF ICT PRODUCTS AND SERVICES IN THE EU?

text:  "Soft law approach", encouraging, supporting and to the extent possible coordinating the adoption and use 6 of certification initiatives at European level  Extending the SOG-IS MRA to all Member States: legislative proposal making MS participation to the SOGIS 4 agreement mandatory  Creating a European certification general framework, laying down the essential rules for mutual 11 recognition of certificates issued in accordance with the framework  Regulating the security of ICT products and services, specifying essential security requirements for such 4 products to be placed on the market

text:  8 None of the above (Please explain)

text: Final | August 2017

text: Q10. DO YOU THINK THAT THE CURRENT SOG-IS MRA COULD BE A BASIS TO BUILD AN EU-WIDE RESPONSES CERTIFICATION FRAMEWORK?

text:  15 Yes  No 7  Don’t Know 11

text: Q.11 DO YOU THINK THAT SELF-CERTIFICATION SCHEMES COULD BE CONSIDERED A VIABLE OPTION RESPONSES TO BOOST THE LEVEL OF CYBER-SECURITY FOR SELECTED PRODUCT’ DOMAINS?

text:  22 Yes 8 No Don’t Know 3

text: Q.12 DO YOU THINK THAT THE PROCESSES AND TOOLS USED FOR SECURITY CERTIFICATION SHOULD BE IMPROVED TO ENSURE THE REQUIRED FLEXIBILITY TO ADAPT TO DIFFERENT MARKET SITUATIONS, PARTICULARLY BY ALLOWING DIFFERENT LEVEL OF ASSURANCES ACCORDING TO MARKET NEEDS (E.G. RESPONSES MORE STRINGENT TESTING/ASSESSMENT STANDARDS FOR MORE SENSITIVE PRODUCTS/APPLICATIONS AND LESS STRINGENT FOR LESS SENSITIVE PRODUCTS/APPLICATIONS)?

text:  Yes 30  No 1  Don’t Know 2

text: Q.13 WOULD YOU BE IN FAVOUR OF THE INTRODUCTION OF A COMMON LABEL SIGNALLING THAT THE PRODUCTS HAVE BEEN CERTIFIED WITHIN A CERTIFICATION SCHEME IN ACCORDANCE WITH EU RESPONSES RULES?

text:  Yes 22  No 8  3 Don’t Know

text: Q.14 DO YOU SEE A ROLE FOR EXISTING EU COMMISSION'S BODIES AND AGENCIES (E.G. JRC, ENISA, RESPONSES ACER) IN A POSSIBLE FUTURE CERTIFICATION AND LABELLING FRAMEWORK?

text:  Yes 26  No 4

text: Final | August 2017

text:  3 Don’t Know

text: ENISA

text: Athens Office

text: 1 Vasilissis Sofias Marousi 151 24, Attiki, Greece TP-01-17-890-EN-N PO Box 1309, 710 01 Heraklion, Greece ISBN: 978-92-9204-225-7 DOI: 10.2824/090677 Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu


text: MAY 2019

text: MAY 2019

text: MAY 2019

text: MAY 2019

text: Source: https://www.forbes.com/sites/stevemorgan/2015/12/20/cybersecurity%E2%80%8B-%E2%80%8Bmarket-reaches- 75-billion-in-2015%E2%80%8B%E2%80%8B-%E2%80%8Bexpected-to-reach-170-billion-by-2020/#66f1983c10c3

text: MAY 2019

text: Typically, "pivot" refers to change/correction of the business model due to sub-par results or in order to discover additional growth 3 Source: https://www.entrepreneur.com/article/271290 http://www.startupcommons.org/startup-development-phases.html https://startupxplore.com/en/blog/types-startup-investing/

text: MAY 2019

text: Also named as series A, B funding rounds 5 Also known as series C funding round 6 http://europeanstartupmonitor.com/fileadmin/esm_2016/report/ESM_2016.pdf Boston local initiatives http://www.xconomy.com/boston/2016/04/20/boston-cybersecurity-map-shows-deep-diverse-localsector/ 8 https://www.cbinsights.com/blog/periodic-table-cybersecurity-start-ups/ 9 https://whatsthebigdata.com/2016/09/19/cybersecurity-market-map/ 10 https://www.wavestone.com/app/uploads/2017/07/Radar-des-startups-cybersecurite-en-France-2017.pdf 11 Bessemer Venture Partners https://www.bvp.com/sites/default/files/files/strategyresource/Israel%20Cybersecurity%20Landscape%20January%202017.pdf 12 http://www.bpifrance-lehub.fr/mapping-french-start-ups-in-cybersecurity/ 13 http://cybersecurityventures.com/cybersecurity-500/ 14 Investors often support more product-focused companies vs. service-oriented. https://ipacso.eu/about/projectipasco/ipacso-advisory-board/33-ipacso-innovation-process-themes/market/market-analysis/trends-and-challenges/218investment-trends.html 15 From the Wavestone radar panel of European start-ups (about 200+ start-ups) 16 For example, some start-ups have a product-oriented business model but propose additional consulting or monitoring services.

text: MAY 2019

text: Investors often support more product-focused companies vs. service-oriented. https://ipacso.eu/about/projectipasco/ipacso-advisory-board/33-ipacso-innovation-process-themes/market/market-analysis/trends-and-challenges/218investment-trends.html 18 From the Wavestone radar panel of European start-ups (about 200+ start-ups) 19 Forrester, The Top Security Technology Trends To Watch, 2017, Tools And Technology: The S&R Practice Playbook by Merritt Maxim, Jeff Pollard, Amy DeMartine, Nick Hayes, Joseph Blankenship, Josh Zelonis, Andras Cser, April 2017

text: MAY 2019

text: See https://www.cbinsights.com/research/cybersecurity-ai-startups-threat-trends/ 22 Graphical User Interface

text: MAY 2019

text: MAY 2019

text: http://www.businessdictionary.com/definition/equity-capital.html 25 These grants are monetary awards that do not obligate the entrepreneur financially. The start-up will receive the grant as a subsidy to launch the business. If there are no financial obligations associated, other duties must be observed e.g. to maintain accurate bookkeeping, use the funding as directed etc. A grant may derive its funding from both government and private sector sources in the form of a joint venture. 26 They are established most of the time by governments to encourage investments in specific sectors. Start-ups can benefit from a cut on R&D costs, on social charges and on corporate taxes. Investors who invest in start-ups and innovation can also benefit from cuts in charges which can lead to turning the investment riskless, as the funds invested would have been otherwise spent in paying taxes.

text: MAY 2019

text: MAY 2019

text: Note: crowdfunding does not appear in Figure 5 above as our study led us to understand that crowdfunding is difficult to implement for a BtoB business model, which is the model of the majority of cybersecurity start-ups. The BtoB model consists of selling goods to other companies (and not directly to the consumer), this makes it difficult to raise sufficient interest in the public at large. Cybersecurity start-ups also offer solutions to technical problems that are hard to promote to the general population, which is why crowdfunding is not successful in that domain. http://www.journaldunet.com/economie/finance/1195462-ico-initial-coin-offering/ https://www.nytimes.com/2017/06/23/business/dealbook/coin-digital-currency.html

text: This type of fundraising is similar to crowdfunding where a company sells tokens on a dedicated platform and then, investors will benefit from the company via dividend payments.

text: MAY 2019

text: This supports building trust with private investors by explaining the cybersecurity market, as technical products and services are more difficult to understand - funding channels do not often have the cybersecurity experts in their team necessary to fully understand the NIS ecosystem. 31 https://ec.europa.eu/digital-single-market/en/cybersecurity-industry 32 http://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1496330315823&uri=CELEX:52017DC0228 33 http://ec.europa.eu/research/sam/pdf/sam_cybersecurity_report.pdf 34 https://ec.europa.eu/programmes/horizon2020/h2020-sections 35 There are national contact-points (NCP) in EU member states to provide guidance and practical support and information for parties wanting to apply for Horizon 2020 funding. 36 http://ec.europa.eu/research/participants/portal/desktop/en/support/national_contact_points.html 37 https://ec.europa.eu/digital-single-market/en/policies/start-up-europe http://start-upeuropeclub.eu/about-us/ 38 https://ec.europa.eu/research/eic/

text: Source: ENISA conference "Funding mechanisms for cybersecurity SMEs" presented by EU Commission in March 2017

text: MAY 2019

text: MAY 2019

text: MAY 2019

text: MAY 2019

text: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM:2016:733:FIN , https://www.bcgperspectives.com/content/articles/alliances-joint-ventures-growth-state-of-european-venturecapital/?chapter=2

text: MAY 2019

identifier: Challenges and opportunities for EU cybersecurity start-ups

title: Challenges and opportunities for EU cybersecurity start-ups

text: CHALLENGES AND OPPORTUNITIES FOR EU CYBERSECURITY START-UPS MAY 2019 0

text: CHALLENGES AND OPPORTUNITIES FOR EU CYBERSECURITY START-UPS

text: ABOUT ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: AUTHORS

text: Dr. Athanasios Drougkas, Christina Skouloudi

text: CONTACT

text: For contacting the authors please use resilience@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu.

text: ACKNOWLEDGEMENTS

text: Emmanuel Gras, CEO & Co-founder, ALSID Olivier Guérin, Project Leader, ANSSI Simo Kohonen, CEO & Co-founder, Aves NetSec Antonio VIRZÌ, CEO, biid Chris Woods, CEO & Co-founder, Cybersparta Randhir Shinde, CEO & Co-founder, Galaxkey Louis Copey, Associate, Point Nine Capital Ingo Sauer, Senior Information Security Consultant, CMO, Auxilium Cyber Security GmbH Martin Pozdena, Senior Information Security Consultant, Auxilium Cyber Security GmbH Alexandre Kaykac, Manager, Bpifrance Le Hub Michael Francoise, Programme Manager, CyLon Luigi Rebuffi, Secretary General, ECSO Danilo D’Elia, Policy Manager, ECSO Alberto Pelliccione, CEO, ReaQta Thierry Rouquet, CEO, Sentryo Raul Popa, Co-founder, CEO & Data Scientist, TypingDNA Maximilien Oursel, Associate Director, Pléiade Venture Alexis Robert, Tech Partner, Kima Ventures Antoine Hron, Head of Start-up support, LuxInnovation Richard Seewald, Founder & Managing Partner, Evolution Equity Nick Coleman, Global Head Cyber Security Intelligence, IBM

text: CHALLENGES AND OPPORTUNITIES FOR EU CYBERSECURITY START-UPS LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Network and Information Security (ENISA), 2019 Reproduction is authorised provided the source is acknowledged.

text: ISBN 978-92-9204-289-9, DOI 10.2824/466160

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 4 2. NIS START-UPS IN THE EU 5

text: 2.1 GROWTH PHASES FOR NIS START-UPS 5

text: 2.2 NIS START-UPS MAIN OFFERS 6

text: 2.3 EMERGING TOPICS FOR NIS START-UPS 8

text: 3. FUNDING AND INVESTMENT CHANNELS 10

text: 3.1 OVERVIEW 10

text: 3.2 PRIVATE FUNDING AND INVESTMENT 12

text: 3.3 MEMBER STATE PUBLIC FUNDING 13

text: 3.4 EU FUNDING MECHANISMS 13

text: 3.5 MORE-THAN-MONEY SUPPORT 14

text: 4. OPPORTUNITIES AND OBSTACLES 15 5. RECOMMENDATIONS FOR START-UPS 18 CHALLENGES AND OPPORTUNITIES FOR EU CYBERSECURITY START-UPS

text: 1. INTRODUCTION

text: The importance of innovation to ensuring economic growth in the European Union is such that facilitating, favouring and fostering it is critical. In this respect, start-ups and young companies play a key role. For them, the Network and Information Security (NIS) sector is a particular area of focus.

text: The cybersecurity sector has a strong annual growth rate, as the worldwide market for

text: 1 The

text: information security is expected to reach €145 billion by 2020.

text: cybersecurity sector has a

text: This growth trend was confirmed by many stakeholders of the sector that were engaged for this study and justifies the attention given to this market. This study intends to provide useful strong annual

text: growth rate, as

text: information to NIS start-ups and SMEs in order to support their growth.

text: the worldwide market for

text: Information for this study was collected via desk research and interviews with 20 experts, including 10 founders of NIS start-ups and 10 contributors of funding channels or national information

text: security is

text: or European bodies such as Venture Capital, incubators, accelerators, public institutions etc.

text: expected to reach €145

text: The target audience of this report comprises NIS start-ups and SMEs, as well as entrepreneurs interested in entering the NIS domain. This report intends to help such companies in: billion by 2020.

text:  understanding the start-up landscape from a technological and market perspective and determining what is currently established in the EU related to NIS products and services;  gaining insight into the investment and funding channels available for NIS start-ups from both the public and private sector;  identifying the main challenges they may face in their endeavour and ways in which they can address them  building knowledge of the opportunities for growth of the EU NIS start-up market within the context of current EU policy frameworks, at all stages of evolution for start-ups.

text: 2. NIS START-UPS IN THE EU

text: 2.1 GROWTH PHASES FOR NIS START-UPS

text: An understanding of the different growth phases for a start-up is essential to the task of identifying the disparate challenges faced by NIS start-ups during these phases. As well as variance by phase of growth, these challenges may also vary depending on the level of development of the start-up from the initial idea, on the number of pivots performed and on the number of funding iterations required to support growth.

text: Based on both desk research and information given by experts that we interviewed for this study we have defined the successive start-up growth phases from Idea to IPO (Initial Public Offering) illustrated in Figure 1, mapped to the evolution of the start-up revenue plotted against time.

text: Figure 1: NIS start-ups growth phases linked with the start-up project life cycle

text: The idea or inception phase corresponds to the start of a project to create a product or service accompanied by an entrepreneurial ambition to target this product at a relatively big market.

text: The seed stage is the formalisation of the initial idea. Vision and mission are determined, and a first version of the business plan is built even though not yet mature, key milestones are foreseen to measure and validate important indicators such as growth or customer interest.

text: At the end of seed stage is the valley of death, a period when the start-up is still not profitable but needs to make more investments to allow its growth and its transition to early stage.

text: During the early stage the start-up has measurable growth in users, revenues and market

text: share. Customers are present in the whole country and further expansion is planned.

text: At the later growth stage , or scaling phase, the start-up focuses on KPIs (Key Performance

text: Indicators) to measure growth in users, revenues and/or market share in a big or fast-growing

text: target market.

text: The break-even point corresponds to the point when the revenues match the spending

text: needs and the start-up is starting to make profit.

text: Overall, there is a collective agreement on the definition of the different stages of start-up

text: growth throughout the world, even though some differences in vocabulary can occur in Europe

text: and other countries (e.g. the US).

text: 2.2 NIS START-UPS MAIN OFFERS

text: To be able to draw trends and conclusions about the NIS start-up landscape in the EU, several 6,7,8,9,10,11,12,13 start-up maps and studies were included in the review . A key objective was to

text: MAIN OFFERS

text: identify the topics addressed by start-ups and to determine whether the offerings are primarily Estimates have product or service-based. showed that

text: approximately ¾ of Product refers to a tangible offer that can be provided by start-ups, e.g. a software or a physical NIS start-ups offer platform. products with the

text: majority of the Service refers to a type of offer where no transfer of ownership is performed; rather services remainder offering a are offered (except services, such as consulting, integration etc., which complement a product). service or a

text: 14 combination of Estimates have showed that approximately ¾ of NIS start-ups offer products with the majority 15 services and of the remainder offering a service or a combination of services and products. Only very few products. Only very start-ups are exclusively oriented at services, such as bug bounty or cloud security services few start-ups are (based on a subscription fee). exclusively oriented

text: at services. Determining what kind of offer a start-up provides proved to be a difficult exercise as boundaries

text: are thin. First, start-up business models are not always fully mature as they often adapt them to their first clients. For example, they can adapt to their client’s need and offer two modes of

text: billing: direct sale of the product or a subscription in the form of a monthly or yearly service.

text: Secondly, some start-ups have a hybrid model with both product and service offers. For

text: example, they have a product-oriented business model but propose additional consulting or

text: monitoring services. .

text: Estimates have showed that approximately 75% of NIS start-ups offer products with the majority of the remainder offering a service or a combination of services and products. Only very few start-ups are exclusively oriented at services, such as bug bounty or cloud security services.

text: Figure 2 and Table 1 NIS categories derived from the NIS start-ups maps analysis show the split of the topics addressed from our panel of 270+ EU NIS start-up maps as well as the 18 main categories of topics on which start-ups base their business were identified.

text: Figure 2: EU NIS start-ups trends derived from the NIS start-up maps analysis

text: CATEGORIES

text: Incident Response, Reverse & Anonymization Cryptology Forensics Anti-Fraud Data Security Industrial systems & IoT Application Security Deception Security Mobile Security Detection, Prevention, Awareness Network and Endpoint Security Surveillance Vulnerability management and threat Blockchain Email Security intelligence Cloud Security IAM Website Security

text: Table 1 NIS categories derived from the NIS start-ups maps analysis

text: NIS start-ups are today addressing mostly mature cybersecurity topics, and this is in line with customers’ expectations worldwide. Mature cybersecurity topics still represent the greatest market share as cyber threats against traditional IT are constantly evolving. Among identified key topics addressed by NIS start-ups, the following topics stand out (see Figure 3):

text:  Identity and access management  network and endpoint security  data security

text:  vulnerability and threat intelligence.

text: Even though these topics are considered as mature, there is still room for innovation. Traditional products and services are nowadays enhanced by additional technologies bringing more intelligence into security operations, analytics and reporting platforms, through machine learning, analytics and AI.

text: Figure 3: Top 10 EU NIS start-ups categories consolidated from NIS start-ups map sources

text: 2.3 EMERGING TOPICS FOR NIS START-UPS

text: There are also new emerging cybersecurity and market segments appearing that are driving the adaptation of the cybersecurity market, by fostering the creation of response capabilities from NIS start-ups in anticipation of the emergence of new threats. Such capabilities can address either new usage (such as cloud, blockchain or IoT) or new trends (such as forensics, deceptions).

text: Following are some of the main emerging cybersecurity segments that NIS start-ups address:  Deceptions – which is an innovative technique to mislead and confuse attackers, causing them to take (or not take) specific actions that help cyber security defences, a more sophisticated version of the traditional "honeypots";  Behavioural Biometrics – where using new innovative ways of verifying the identity of a person such as a complex mix of mouse dynamics (rhythm, click patterns…), keystroke dynamics (length, rhythm…) and the users’ GUI interaction (frequency, navigation) brings a higher level of security as those behavioural patterns are hard to steal compared to classic biometrics (fingerprints for example);  Post Quantum Cryptography – provides the next-generation type of encryption whilst many popular encryption and signature schemes will be breakable by quantum computers;  Awareness – innovative ways to train and alert employees or customers about cybersecurity threats such as role games and online exercises;  Industrial Security and Industrial IoT – refers to security of Industry 4.0 e.g. security of intelligent, connected devices in factories;  NIS products/services built on Automation – which is an advanced response to automated cyberattacks either at the prevention level e.g. to roll-out security patches or at the detection level e.g. to automate incident responses.

text:  NIS products/services based on Artificial Intelligence (AI) - by implementing AI and machine learning techniques which allow faster detection and remediation for real-time Information System monitoring.

text: Regulations play

text: In addition to these market trends, the impacts of regulation must be considered in the EU.

text: a large part in

text: Indeed, regulations play a large part in governing demand. This will continue in the

text: governing

text: coming years both at European level (GDPR, NIS) and at local level (national enforcement

text: demand. This

text: laws) and will be an area where innovation will play a key role in building potential market

text: will continue in

text: share for NIS start-ups.

text: the coming years both at European

text: According to the results of the study, the main topics that will need to be addressed regarding

text: and local level

text: GDPR are:

text: and will be an area where

text:  anonymization, which aims at sanitizing data to remove any personally identified information

text: innovation will

text: or to encrypt data;

text: play a key role in

text:  consent management where consumers will establish consent directives to determine who

text: building

text: will access their private data.

text: potential market share for NIS

text: The market is not yet mature in providing tools to respond to these needs. For instance, the

text: start-ups.

text: sector of anonymization has been little explored by start-ups according the NIS start-ups maps and is likely to rise with the GDPR coming into force in 2018.

text: The NIS Directive implies additional compliance and will be required in mature functions and processes such as network and infrastructure security, with key aspects on securing administration and ensuring network segregation in the Information System. There is also a focus on industrial Smart Infrastructure security already been identified by start-ups as

text: Industrial SI security and IOT in the Top 10 and is promising to be a key area where the demand will rise.

text: These trends were already partially identified and anticipated through Horizon 2020 with call for tenders in 2017 targeting the following subjects :

text:  Cryptography  Advanced Threats  Privacy  Data protection  Prevention, detection, response and mitigation of the combination of physical and cyber threats to the critical infrastructure of Europe.

text: 3. FUNDING AND INVESTMENT CHANNELS

text: 3.1 OVERVIEW

text: Start-up capital can come in different forms in the successive growth stages and NIS start-ups should be aware of the different options available to them. The provision of capital can be made by various actors, each of which have specific expectations in return. As per expert’s explanation, the following types of funding can be considered:

text: 1. Equity capital. As defined by Business dictionary , this represents funds invested in the new business, and contrasts with debt capital, which is not repaid to the investors in the normal course of business. It represents the risk capital staked by the owners through purchase of a company's stock. It includes venture capital and corporate venture. 2. Non-equity capital, which can take different forms such as grants and subsidies , tax

text: incentives

text: Figure 4 illustrates the funding and investment channel ecosystem: financing cycle and associated amount of funding per stage, funding and investment channels providing nonequity or equity financing, other stakeholders “more than money support” providing support to start-ups other than funding; and whilst presenting also the start-up project cycle.

text: Figure 4: Funding channels stakeholders at each stage of the start-up development

text: CHALLENGES AND OPPORTUNITIES FOR EU CYBERSECURITY START-UPS 3.2 PRIVATE FUNDING AND INVESTMENT

text: Private investment and funding channels stakeholders can provide either equity

text: financing which is the case for founders, love money, corporate ventures/large groups and venture capitals and non-equity financing which is the case with angels and banks through loans.

text: Access to funds is mostly difficult or very difficult for all types of private funds except

text: from the founders’ money (see Figure 5) .

text: Figure 5: Type of funding used by NIS start-ups and level of easiness to gain access to them from our panel

text: On top of the category of investment and funding channels, we identified the following types of stakeholders investing in NIS start-ups:  investors specialised in cybersecurity – who provide additional support due to their deep knowledge of the market. Accelerators specialised in cybersecurity are very efficient for connecting the start-up to the ecosystem (investors and clients) and getting the business started.  investors non-specialised in cybersecurity – who view cybersecurity like other ICT topics.  private stakeholders that provide support other than funding to NIS start-ups or “more than money support” - who are private incubators, private accelerators and corporate open innovation in large companies.

text: While looking at alternative ways of private funding on a future-looking perspective, ICO (Initial Coin Offering) recently appears as a potential new means of funding for start-ups, whose sustainability and efficiency are still to be proven in the long term.

text: CHALLENGES AND OPPORTUNITIES FOR EU CYBERSECURITY START-UPS 3.3 MEMBER STATE PUBLIC FUNDING

text: National public institutions in charge of economics, research and innovation play a role in the start-up and SME ecosystem by supporting and fostering national economic development as follows:

text:  offer early-stage funding and coaching;  develop partnership with technological and industrial actors; and  facilitate bridging with potential investors.

text: National authorities in charge of cybersecurity, which have developed in the EU, can raise cybersecurity awareness amongst citizens and the entire NIS market by highlighting and explaining key issues to the start-up ecosystem . In addition, they can provide technical expertise to the NIS start-ups when developing products to ensure they meet the nation’s requirements.

text: Tax incentives or national or regional funding mechanisms can also support start-ups through tax incentives or grants.

text: 3.4 EU FUNDING MECHANISMS

text: There are a number of European institutions and programs supporting NIS development with the main goal to ensure cyber protection for all: citizens, companies (including SMEs) and 31 32 33 public administration by supporting the development of an EU cybersecurity industry .

text:  The EC created and signed a cybersecurity contractual Public-Private Partnership (cPPP) with ECSO (European Cyber Security Organisation) with the aim to stimulate the cybersecurity industry by bridging the gap between different stakeholders and by aligning cybersecurity products and solutions with demand.  The Horizon 2020 Research and Innovation programme focuses on several cybersecurity topics .There are national contact-points (NCP) 36 in EU member states to provide guidance and practical support and information for start-ups wanting to apply for Horizon 2020 funding.  Existing EU initiatives to favour start-up development, such as Start-up Europe , the European Innovation Council (EIC) pilot and “Europe’s next leaders: the Start-up and Scale-up Initiative.  Other financial instruments provided by the EU, e.g. European Structural and Investment (ESI) Fund .

text: It seems that very few start-ups or funding channels are effectively using EU funding mechanisms. The main reasons behind this are the lack of knowledge of the EU funding mechanisms available, the difficulty in accessing this funding and the unwillingness of start-ups to divert resources from their main business to develop and submit a funding application or proposal.

text: CHALLENGES AND OPPORTUNITIES FOR EU CYBERSECURITY START-UPS 3.5 MORE-THAN-MONEY SUPPORT

text: The expression “more than money” perfectly captures the philosophy that funding alone is no longer a sufficient means for ensuring success. There are several areas of interest for fostering the growth of NIS start-ups: Numerous

text: stakeholders of

text: 1. Developing working synergies between start-ups and companies is essential to build the ecosystem trust for NIS start-ups and to initiate the commercial relationship, as business relationship are offering between start-ups and large companies are still too weak.

text: support to start-

text: 2. Developing the action of "trusted third parties", which acts as an interface between large private corporate groups, public stakeholders, start-ups and schools / universities to up founders in bridge the different parties and accelerate the transfer of mutual skills amongst the diverse ways different stakeholders and developing “open innovation” in large corporates. not only 3. Ensuring the right talent is available to NIS start-ups from creation to later growth is

text: financial.

text: also key. 4. Building a strong networking enables start-ups to bridge with the NIS ecosystem.

text: 4. OPPORTUNITIES AND OBSTACLES

text: Through our interviews of experts and our desk research, we identified a number of specific challenges and opportunities faced by NIS start-ups in their development within the EU. The primary challenges identified by the panel of experts are presented in Figure 6.

text: Figure 6: NIS start-ups panel main challenges in growing and funding a business from panel

text: Overall, the challenges and opportunities for NIS start-ups in the EU are presented in the following across 3 dimensions:  Challenges and opportunities related to funding  Challenges and opportunities specifically related to the NIS sector  Challenges and opportunities related to other factors

text: Figure 7: Opportunities and obstacles linked to funding mechanisms

text: Figure 8: NIS sector specific opportunities and obstacles

text: Figure 9: Opportunities and obstacles due to other factors

text: Among the challenges identified for NIS start-ups in the EU, a few stand-out and are worth

text: exploring in more detail:

text: Challenge to penetrate the Business-to-Business (BtoB) market

text: EU start-ups face

text:  Networking and building visibility around the start-up to win the first contract is often

text: strong

text: challenging. In several EU countries, the lack of an innovation network bridging start-ups and

text: competition from

text: companies is still an obstacle in building synergies between them.

text: Israel and US NIS

text:  Start-ups often have difficulties in understanding the customers’ expectations or assessing

text: start-ups, which

text: correctly the market maturity and hence do not offer NIS products or services that meet a

text: benefit from

text: real need in the market that would attract investors. NIS start-ups also have difficulty

text: larger and easier

text: integrating their product/service in a very complex environment with many other products

text: funding and the

text: and many players involved.

text: biggest market

text:  The NIS sector has specifically long sales cycles, and the long decision process for

text: shares, even in

text: procurement in large companies does not match start-ups business rhythm.

text: the EU.

text: Difficulties obtaining funding

text:  There is a lack of seed funding and a lack of growth stage funding (to scale up) and more

text: generally the amount of funding proposed is much lower in Europe than in the US and Israel for instance: Estimations give the level of funding to be around €5 billion in the EU, compared

text: to more than €26 billion in the US .  Finding appropriate funds (private and public funds) is also a great challenge. Some funds

text: ask start-ups to be break-even and to make profit before offering support, which is

text: incompatible with the goal of many start-ups, which is to reinvest the initial profits made. Other

text: programmes offer funds in exchange for certain conditions being met e.g. based on the

text: 65% of the NIS

text: number of employees to be hired. This can be an obstacle if start-ups need to review their

text: start-ups panel

text: business model and strategy to match these funding conditions.

text: do not find it

text:  Applying for European funding is difficult, as the application process is complex and very

text: easy to attract

text: time-consuming. Successful applications may also result in relatively benefits that are only

text: the best talents

text: realised over a very long timeframe.

text: for their business. High

text: Skills shortage

text: cost (53%) and lack of suitable

text:  There is a lack of cybersecurity educational paths, and a lack of business and entrepreneurial

text: skills (47%) are

text: skills amongst many technical entrepreneurs.

text: cited as the most

text:  It is difficult to source the right cybersecurity skills to scale-up, because of a scarcity of

text: important

text: appropriate profiles (such as developers or ethical hackers) and the cost of sourcing roles

text: factors.

text: against competition from big companies.  Highly skilled cybersecurity experts are often attracted by advance innovation

text: hotspots/clusters outside of the EU

text: 5. RECOMMENDATIONS FOR START-UPS

text: Based on the analysis of the identified challenges and opportunities, as well as on feedback collected from the panel of experts, this report proposes the following set of recommendations to start-ups and SMEs active in the NIS market.

text: These recommendations aim to serve as a non-exhaustive list of actionable good practices to help NIS start-ups better reach their objectives and potential as regards business growth.

text:  Carefully and clearly define your product/service development strategy; the product/service should address real needs and the start-up itself should be adaptable enough to pivot based on the market dynamics. Understand the commercial aspects of selling NIS solutions, especially in a B2B context; create solutions that address specific requirements and/or integrate with existing established products.  Invest in building your team with the proper mix of skills - do not underestimate the These importance of non-technical skills such as business development, marketing and sales. Aside recommendations from being critical for business success, team composition is among the key selection criteria aim to serve as a for investors, especially those not specialised in the NIS domain. non-exhaustive list of  When necessary or pragmatic, invest in compliance with standards or certification actionable good schemes that will allow you to access the entire EU market and beyond. The upcoming EU practices to help NIS Cybersecurity Certification Framework may increase the demand for compliance with start-ups better reach certification schemes and also serves as an opportunity for start-ups as it removes the current their objectives and existing fragmentation with multiple national certification schemes. potential as regards  Leverage existing European clusters specialized in cybersecurity to develop your business growth. business in close proximity with other start-ups, incubators/accelerators, universities and big corporations.  Invest in networking and build mentorship-like relationships with larger enterprises who will provide more-than-money support, get you in contact with potential customers and help you better understand the market. Seek our accelerators specialised in cybersecurity if possible.  Understand the EU funding opportunities available to you and assess their usefulness in supporting the different stages of your growth, particularly when attracting other (e.g. private) capital is most challenging.  Pursue partnerships and events that will allow you to position you solution to prospective customers. Creating joint offers with larger companies that have established relationships with customers or pursuing Proof of Concepts are two effective ways of achieving credible visibility with customers.

text: -N -EN -221 -19 -02 TP

text: ABOUT ENIS A

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its Member States, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU Member States in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU Member States by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: ISBN 978-92-9204-289-9 doi: 10.2824/466160