text: May 2024

text: May 2024

text: May 2024

text: ( ) Cybersecurity Act of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing

text: Regulation (EU) No 526/2013

text: (Cybersecurity Act) (OJ L 151, 7.6.2019, pp. 15–69, ELI: http://data.europa.eu/eli/reg/2019/881/oj). 2 ( ) ENISA, ‘Cybersecurity education’. The roadmap is not publicly available. 3 ( ) Primary data refers to information collected via stakeholder consultation when interacting directly with the target respondents (e.g. interviews, workshops, focus groups). Secondary data refers to information collected via desk research and researchers’ own investigations (e.g. websites, articles, books).

text: May 2024

text: ( ) ENISA, Cybersecurity Education initiative in the EU Member States, December 2022. Available at: https://www.enisa.europa.eu/publications/cybersecurity-education-initiatives-in-the-eu-member-states.

text: May 2024

text: May 2024

text: May 2024

text: May 2024

text: Source: Authors’ elaboration (data analysis based on the sampled countries, 13 in total).

text: May 2024

text: Source: Authors’ elaboration.

text: Directive (EU) 2016/1148

text: of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, pp. 1–30, ELI: http://data.europa.eu/eli/dir/2016/1148/oj).

text: May 2024

text: In France, the NIS Directive (2016) was transposed at the national level. Additionally, the Ministry of Education has set up guidelines relating to cybersecurity education; however, there is no written regulatory framework.

text: Cybersecurity has been introduced as an official topic of school curricula in France. In primary schools, lessons are focused on digital hygiene/security while in secondary schools, the cybersecurity topic is part of the curricula for students attending the mathematics or IT branches.

text: For the academic year 2023–2024, the digital education subject will be introduced to students in the 6ème (10–12-year-olds). Cybersecurity topics will become mandatory for students in the 3ème (14–15-yearolds) and in the end of the lycée (17–18-year-olds). Students are required pass an exam on these topics. Lastly, there is a specific mandatory curriculum with cybersecurity items for the professional branch called Baccalauréat professionnel CIEL.

text: While there is no specific policy, the Ministry of Education has rolled out over the 2 past years a roadmap to encourage students to pursue a cybersecurity career. It also provides guidance for pupils who want to follow a cybersecurity career and recommendations for teachers to pupils on cybersecurity topics for primary and secondary schools, through the éduscol platform.

text: The Ministry of Education uses the Pix platform to assess the digital skills of the population. The platform was built in collaboration with ANSSI and Cybermalveillance.gouv.fr. The platform evaluates students’ skills based on five domains (the fourth being ‘Protection and security’). The test is based on the EU Digital Skills Assessment Tool and helps understand the level of digital skills of French students and adapt their cybersecurity education experience.

text: Sub- Good practice Case study from a Member State dimension

text: The National Cyber Security Centre of Ireland has produced Develop a national guidelines entitled ‘Quick Guide: Cyber Security for Schools’, policy or guidelines to https://www.ncsc.gov.ie/pdfs/NCSC_Quick_Guide_Schools.pdf. guide education National 1 This guide aims at assisting primary, post-primary and specialised stakeholders in their policy schools in particular to implement the key priority measures that can adoption and teaching help to reduce the likelihood of a school becoming a victim of a of cybersecurity topics cyberattack or to reduce its impact. Explicitly include Cybersecurity is mandatory in some secondary school sections. cybersecurity There is a new course called Digital Sciences that includes six National 2 education in primary modules, one being ‘The world wide web, its network and me’, which policy and secondary school is being developed in collaboration with BEE SECURE. curricula

text: May 2024

text: In this module, students undergo 2 mandatory hours focused on online safety, which includes cybersecurity. This activity serves mostly as an awareness activity and students are not graded. Secondary level schools in Luxembourg offer different sections: Section I (Informatics), where students follow cybersecurity courses (sciences cognitives and sciences humaines) that will be introduced in the 2024–2025 academic year, will address the topic of GDPR (in the second to last year of secondary school, deuxième).

text: Schools can book BEE SECURE training sessions for their classes from grade 3 onwards. Support teachers by For the support of teaching staff, concrete examples as The providing clear Framework for Digital Competence has been created by the Finnish guidance on pupils’ government to describe the learning pathway starting from early 3 Support learning path (i.e. childhood education and care: skills / knowledge to be https://eperusteet.opintopolku.fi/#/en/digiosaaminen/8706410/osaami acquired) skokonaisuuspaaalue/8709072. The Spanish National Cybersecurity Institute is the reference entity to drive a better use of internet for minors in Spain, and it works within the framework of the EU’s BIK (Better Internet for Kids) Define clear strategy. The institute manages Internet Segura for Kids, the governance and Spanish Safer Internet Centre that takes part in the Insafe and 4 appoint an entity in Support INHOPE networks, and also operates services to promote a safer charge of supporting and better use of the internet and mobile technologies among teachers children and young people: an awareness-raising centre, a helpline, a youth participation initiative, a hotline and the organisation of the Safer Internet Day.

text: May 2024

text: ( ) European Union, ‘Education Training and Youth’, 2023. Available at: https://european-union.europa.eu/priorities-andactions/actions-topic/education-training-and-youth_en.

text: May 2024

text: May 2024

text: May 2024

text: In Czechia, many cybersecurity education initiatives were initiated during the COVID-19 pandemic. All initiatives are reported and explained in the catalogue of cyber-prevention that presents 256 initiatives. Some initiatives are local (connected mainly to schools) and some are regional and cross-regional. In total, there are 15 initiatives conducted at the national level. Most of them are managed by non-governmental organisations (NGOs).

text: The catalogue includes three types of material:

text: • programmes for students; • programmes for teachers and parents; • supporting materials and methodologies for experts in education.

text: The catalogue is organised via the filters listed below:

text: • target groups (e.g. teachers of primary and secondary schools); • formats of the materials (e.g. online / hard copy / school books); • regions, as the educational initiatives are left for the schools to implement. A limitation of this catalogue is the lack of supporting accreditation. In fact, the Ministry of Education is not responsible for the accuracy and alignment of the materials with the national requirements on education and curricula.

text: In parallel with this catalogue, one of the main outputs of the national programme was the National Cybersecurity Competition involving 7 000 students. This initiative targeted students aged from 9 to 25 years old. Participants gained new skills and experience, and how to quickly adopt a ‘safe internet’ behaviour.

text: The website of the National Cyber and Information Security Agency includes materials for all stakeholders involved in the health and medical sector, law enforcement and education.

text: Digital skills Cyberfairytales. This initiative aims at turning a ‘real world’ set-up into a virtual world to raise awareness on how to behave in a virtual environment.

text: Another initiative is called Czechitas, which focused on girls who are in interested in programming and digital skills. Around 1 000 young girls are involved, starting from high school.

text: May 2024

text: Cybersecurity education actions conducted in Luxembourg are aligned with the National Cybersecurity Strategy IV. The strategy mentions the need for cybersecurity education and refers to the BEE SECURE governmental initiative as one of the drivers toward a better cybersecurity education.

text: Operating since 2010 under the name BEE SECURE, this government initiative is coordinated by the National Youth Service (Service National de la Jeunesse, SNJ). Participation on the part of the government is ensured by the Ministry of Education, Children and Youth, the Ministry of Economy and the Ministry of Family and Integration. BEE SECURE is operated by the SNJ in collaboration with consulting service KJT, and in partnership with Luxembourg House of Cybersecurity, the Grand-Ducal Police and the Public Prosecutor’s Office of the Grand Duchy of Luxembourg. Thanks to its practical cybersecurity experience in Luxembourg and its established network of partners, BEE SECURE is able to contribute in a concrete way to the empowerment and education of young internet users.

text: In order to carry out its mission (based on four pillars), the BEE SECURE initiative relies on many partners, such as SCRIPT (Service de coordination de la recherche et de l'innovation pédagogiques et technologiques), the entity in charge of promoting, implementing and coordinating projects, initiatives and research aimed at educational and technological innovation throughout the education system in Luxembourg. In the SCRIPT department of initiatives, a new programme called Level Up focuses on federating and promoting competitions and challenges that address students and have pedagogical or educational objectives. In this respect, one of the topics of the Level Up initiative is cybersecurity, where a new competition was introduced in 2023. This complements the role of the SNJ as coordinator of BEE SECURE and main stakeholder in non-formal education. The SNJ is the stakeholder that brings innovation to education on cybersecurity.

text: Sub- Good practice Example from a Member State dimension

text: As Belgium’s national authority on cybersecurity, the role of the Centre for Cybersecurity is to coordinate with the different regions that are responsible for Enhance Cooperation education. With the creation of the national coordination centres – and therefore national, and the NCC-BE – an explicit role was assigned to improve coordination within the 1 regional and supporting national communities. The NCC-BE will continue to build relations with the municipal initiatives different regions and regional governments by providing them with expertise, cooperation resources, support and (information on) funding opportunities. A nationally supported strategy will ensure an increase in cybersecurity maturity.

text: May 2024

text: Create cooperation The cooperation with stakeholders of the private sector (Romanian Association of between Cooperation Banking) and the Romanian Police led to the creation of a platform for children to public and and test their cybersecurity knowledge.

text: private supporting This cooperation is backed by the law that established the National Cyber organisations initiatives Security Directorate, which calls for multiple ministries and institutions to be and across involved and collaborate at different levels. industries In Denmark, the Cybersecurity Challenge is carried out yearly to select 10 participants (between the ages of 15 and 25) for the European Cybersecurity Challenge and the Cyberskills project. The latter aims at increasing knowledge Create and interest in cybersecurity among young people. Activities are carried out and opportunities largely funded by the private sector (EUR 5 million for the next 3 years) to Action plan to favour and support the building of a community amongst young people. The objective of the 3 and upgrade activities is to increase cybersecurity knowledge and skills. There are currently supporting knowledge around 2 000 members in the Discord server created for the Cyberskills project. initiatives and skills The activities of the two projects include the distribution of high-quality material sharing for teachers, online training sessions for all ages and levels of expertise (2 000 users have used the training in the last spring session) and events with local clubs and experts. In some schools, the teaching materials are integrated into secondary school computer science courses. In Italy, the CyberHighSchools programme, promoted by the Cybersecurity National Lab (a collaboration involving most of the universities in the country), has established a network of secondary schools with active involvement from both students and teachers. Currently, there are more than 500 schools in the programme.

text: The teachers at these schools attend cybersecurity training courses which are Training of Cooperation currently offered at two levels: basic and advanced. In this way, universities 4 teachers and and assist in ‘teaching the teachers’ and approximately 1 000 teachers have upgrading of supporting participated so far. Students at these schools are provided with courses taught students’ skills initiatives by their teachers and are also encouraged to participate in the OliCyber competition for high school students. More than 4 000 students took part in the selection process for the 2023 OliCyber competition, and 900 of them were admitted. Out of these, 360 had the opportunity to attend a training camp and 100 reached the finals. The activities also encompass a competition specifically designed for high school girls with no prior technical background, aiming to help reduce the gender gap in the field.

text: May 2024

text: May 2024

text: May 2024

text: In Ireland, a pilot project aiming to strengthen cybersecurity in education was initiated based on a policy aligned with the National Cybersecurity Strategy. The initiative includes a representative sample of different schools (around 20 schools of different levels, geographical coverage and school types). These schools were invited on a voluntary basis to deliver cybersecurity classes to pupils. After the end of the second phase (by the end of 2024), the aim is to expand the scope of the pilot project to 50–100 schools.

text: The pilot project introduces the topic of cybersecurity as a subject in the schools participating in the pilot. Therefore, it not yet a part of the national curriculum, however the aim of the pilot is to favour its expansion to more schools in the near future.

text: The topics covered in the courses are up to the teachers, both for primary and secondary schools. In primary schools, the topics usually focus on raising awareness of the risks and threats of cybersecurity, along with cyber hygiene. For secondary education, more in-depth topics are covered, such as: • cyber hygiene; • role of regulation; • cybersecurity in society; • ethics and behaviour; • raising awareness of risks and threats of cybersecurity; • practical aspects, malware, etc.

text: The Irish initiative also implies the development and provision of materials for primary, secondary and tertiary education. A bottom-up approach is followed to share ‘hands-on’ training and ensure teachers are equipped to train pupils, and to raise awareness among students.

text: Age-appropriate material is produced in different formats, to ensure access to any teacher and pupil (e.g. research projects to be executed by pupils, online and open-source resources, access to practical materials, webinars and training days).

text: May 2024

text: In Ireland, best practices have been identified in relation to providing Apply a ‘train the guidance and training to the teachers, following a ‘teaching the teachers’ trainer’ approach by Provision of approach.

text: training education Additionally, teachers are involved in developing the course, as the course schoolteachers would need to get their approval. By involving teachers in the development of the course, their buy-in is secured. In Belgium, there are various options available to train students to reach cybersecurity learning goals. • Traditional in-class, instructor-led teaching involves the use of books with associated e-learning content created by educational publishers Ensure accessibility that incorporate the official educational objectives. Cybersecurity is then of cybersecurity typically included via blended learning in the ICT course that many Provision of 2 courses by schools have in their curricula. education providing different • Regional and national initiatives provide educational cybersecurity course formats content targeted at young pupils. This often involves some form of gamification combined with a digital learning platform. Examples are the EDUbox Cybersecurity and the international Pix platform that were cofunded by the European Commission.

text: The French Ministry of Education uses the Pix platform to assess digital skills of the population. The platform was built in collaboration with ANSSI Implementati and Cybermalveillance.gouv.fr. The platform evaluates students’ skills based Digital skills 3 on evaluation on five domains (the fourth being ‘Protection and security’). assessment mechanisms The test is based on the EU Digital Skills Assessment Tool and helps understand the level of digital skills of French students and adapt their cybersecurity education experience.

text: May 2024

text: May 2024

text: May 2024

text: May 2024

text: May 2024

text: May 2024

text: May 2024

identifier: Cybersecurity Education Maturity Assessment

title: Cybersecurity Education Maturity Assessment

text: EUROPEAN UNION AGENCY FOR CYBERSECURITY

text: CYBERSECURITY EDUCATION MATURITY ASSESSMENT

text: MAY 2024 SC-Restricted CYBERSECURITY EDUCATION MATURITY ASSESSMENT

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

text: CONTACT

text: For media enquiries about this paper, please use press@enisa.europa.eu.

text: AUTHORS

text: Christina Skouloudi (ENISA), Evangelos Kantas (ENISA)

text: Solène Drugeot (Wavestone), Débora Lopes Goncalves (Wavestone), Francesco Principe (Wavestone), Solène Vossot (Wavestone)

text: LEGAL NOTICE

text: This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to

text: Regulation (EU) 2019/881

text: ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source.

text: Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources, including external websites, referenced in this publication.

text: Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: ENISA maintains its intellectual property rights in relation to this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2024

text: Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence (https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided that appropriate credit is given and any changes are indicated.

text: For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the respective copyright holders.

text: ISBN 978-92-9204-674-3, DOI 10.2824/3832

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 4

text: 1.1 CONTEXT OF THE STUDY 4

text: 1.2 OBJECTIVES AND SCOPE 4

text: 1.3 DOCUMENT STRUCTURE 5

text: 2. MATURITY ASSESSMENT OF EU MEMBER STATES 6

text: 2.1 MATURITY AT THE GOVERNMENTAL LEVEL (DIMENSION 1) 7

text: 2.1.1 Assessment of regulatory framework (sub-dimension 1.1) 7 2.1.2 Assessment of national policies (sub-dimension 1.2) 9 2.1.3 Assessment of national support (sub-dimension 1.3) 9 2.1.4 Good practices on governmental aspects (Dimension 1) 10

text: 2.2 MATURITY AT THE STRATEGIC LEVEL (DIMENSION 2) 11

text: 2.2.1 Assessment of national educational strategies (sub-dimension 2.1) 11 2.2.2 Assessment of national action plans (sub-dimension 2.2) 13 2.2.3 Assessment of national initiatives to foster cooperation (sub-dimension 2.3) 15 2.2.4 Good practices on strategic aspects (dimension 2) 16

text: 2.3 MATURITY AT THE OPERATIONAL LEVEL (DIMENSION 3) 17

text: 2.3.1 Assessment of initiatives for providing cybersecurity education (sub-dimension 3.1) 18 2.3.2 Considerations on the implementation of an evaluation mechanism (sub-dimension 3.2) 20 2.3.3 Good practices on the operational aspects (Dimension 3) 21

text: 3. RECOMMENDATIONS 22

text: 3.1 RECOMMENDATIONS ON THE GOVERNMENTAL LEVEL (DIMENSION 1) 22

text: 3.2 RECOMMENDATIONS ON THE STRATEGIC LEVEL (DIMENSION 2) 23

text: 3.3 RECOMMENDATIONS ON THE OPERATIONAL LEVEL (DIMENSION 3) 25

text: 3.4 RECOMMENDATIONS AND EXPECTATIONS FROM THE MEMBER STATES ON THE ROLE AND ACTIONS TO BE TAKEN BY ENISA 27

text: 4. CONCLUSION 28

text: EXECUTIVE SUMMARY

text: As described in Article 10 of the Cybersecurity Act ( ), ENISA has the mission to focus its efforts in promoting cybersecurity in all levels of education in the EU Member States (MS). In this context, ENISA has a mandate to support closer coordination and exchange of best practices among MS on cybersecurity awareness and education, a task that has also been included in the ENISA Cybersecurity Education Roadmap ( ).

text: On one hand, this ENISA study aims at designing and developing a maturity assessment model to assess each MS maturity level regarding cybersecurity education in the primary and secondary levels and obtaining a comprehensive state of play of the EU. On the other hand, in addition to quantitative scoring reflecting national maturity levels, ENISA’s objective was to collect and disseminate recommendations and good practices among countries.

text: Quantitative results obtained from primary and secondary education data ( ) collected from 15 and 27 MS respectively show that on average a range of MS in the EU have a level of maturity of 66 %, which corresponds to level 4 out of 5 (‘Establishment’). This means that MS already have a series of initiatives in place for cybersecurity education. However, national approaches strongly vary from one country to another and mostly rely on decentralised initiatives or stand at the infancy stage of implementation.

text: More specifically, ENISA assessed maturity levels according to three dimensions: ‘Governmental’ (70 %), ‘Strategic’ (64 %) and ‘Operational’ (63 %). One of the main takeaways is that while cybersecurity education initiatives are generally supported by a national regulatory framework, they strongly rely on national cybersecurity strategies. In fact, these tools usually provide European stakeholders with guidelines and support to include the cybersecurity topic into school curricula; this significantly fosters the adoption of cybersecurity in the primary and secondary levels of education. The involvement of government-appointed entities and cooperation with private sector actors was identified as a major pillar for fostering cybersecurity in education.

text: Lastly, in this study ENISA lists best practices and recommendations addressed to MS per maturity level, available for each dimension of the maturity assessment model, along with concrete examples of country initiatives and contact points of national organisations.

text: 1. INTRODUCTION

text: 1.1 CONTEXT OF THE STUDY

text: Along with the increased use of technology in recent decades, the field of cybersecurity has received more attention due to the greater exposure of citizens to ways in which they can be subjected to data theft and damage. The role of cybersecurity experts in protecting critical information and infrastructure, while relevant, remains insufficient to cover all internet users due to the shortage of professionals in the market. The solution, which is to increase the cybersecurity knowledge level of citizens, requires reaching out to internet users of all age groups, including the new generation.

text: Schoolchildren are often considered as being introduced early to digital technologies (also called ‘digital natives’) and are a critical group to address to ensure that the next generation is well equipped with the skills to safely use the online space. According to Article 10 of the Cybersecurity Act, ENISA is mandated to support closer coordination and exchange of best practices among MS on cybersecurity awareness and education, as shown in the Cybersecurity Education Roadmap and demonstrated through initiatives such as European Cybersecurity Month, the European Cyber Security Challenge, the European Cybersecurity Skills Framework and the Cybersecurity Higher Education Database, known as CYBERHEAD.

text: At the MS level, the introduction of the cybersecurity topic in school curricula and activities alone can help ensure that young users are more exposed to and aware of the cybersecurity field and requirements, potentially leading them to choose this domain professionally and helping to address the cybersecurity expert shortage in the labour market. Nevertheless, there are still variations across MS in term of cybersecurity education maturity. Consequently, one of the main priorities identified by ENISA in its European Cybersecurity Roadmap was the need to identify the level of maturity of each MS and obtain an EU state of play, along with favouring exchanges of good practices and providing recommendations on different cybersecurity education dimensions covered in the report (e.g. guidelines, educational toolkits, standards and partnerships with stakeholders).

text: 1.2 OBJECTIVES AND SCOPE

text: As a continuation of the ENISA report Cybersecurity Education Initiatives in the EU Member States ( ), ENISA aims to understand the maturity of cybersecurity in primary and secondary education in each MS to further allow the creation of specific material to support cybersecurity education according to the different maturity levels identified. This project will then lead to the outlining of concrete activities over multiple years, such as the development of educational tool kits, guidelines, standards and stakeholder partnerships. In light of this ultimate goal, ENISA will develop this report on maturity assessment for cybersecurity education. The objectives of this project are to:

text: • select the maturity model suitable for assessing maturity of cybersecurity education in each MS and support the maturity assessment; • define relevant maturity levels and assess maturity of cybersecurity educational activities per MS; • draw recommendations on national initiatives and good practices per dimension of the maturity assessment model and per maturity level.

text: CYBERSECURITY EDUCATION MATURITY ASSESSMENT 1.3 DOCUMENT STRUCTURE

text: Section 2 presents the maturity assessment results across dimensions and countries. This section is illustrated by country use cases including relevant practical applications of good practices. Lastly, Section 3 summarises recommendations per dimension addressed to the MS and presents MS expectations toward ENISA. The methodology selected and applied to the maturity assessment framework and the data collection approach is presented in the Annex of this report, which is distributed as a separate document.

text: 2. MATURITY ASSESSMENT OF EU MEMBER STATES

text: This section presents the main results of the maturity assessment carried out as part of this study in the field of cybersecurity in primary and secondary education’. Readers should note

text: that the calculations and graphs presented in this study take into account the

text: contributions of the 15 MS that participated in the data collection. Unanswered questions were treated as ‘Not available’, i.e. N/A. In order to present statistically representative quantitative data, countries with more than a third of ‘Not applicable’ responses were not included in these calculations. The sample is therefore reduced to 13 countries (i.e. two consulted countries provided more than a third of their responses as ‘Not applicable’, so their results were not statistically representative for the quantitative part of the analysis. However, for the qualitative part, more specifically for the overall state of play of the MS and their good practices around cybersecurity in education, their relevant contributions were taken into account).

text: Three dimensions were specifically developed to reflect the different ways in which cybersecurity in education could be ensured, promoted and implemented within and across the MS, as depicted in Table 1.

text: Table 1 – Dimensions and sub-dimensions of the maturity model

text: Dimension Sub-dimension

text: 1.1 Regulatory framework

text: 1. Governmental 1.2 Policies

text: 1.3 Support

text: 2.1 Strategies

text: 2. Strategic 2.2 Action plan

text: 2.3 Cooperation

text: 3.1 Provision of education

text: 3. Operational

text: 3.2 Uptake of education

text: The following table illustrates the different levels of maturity in terms of cybersecurity education per dimension of the model, along with the average of a range of EU MS. The EU average is calculated by taking into account the maturity levels of the 13 MS in the sample.

text: Table 2 – Maturity levels

text: Maturity level Score in %

text: 1. Non-existent 0–20 %

text: 2. Initial/ad hoc 20–40 %

text: 3. Definition 40–60 %

text: 4. Established 60–80 %

text: 5. Optimised/refined 80–100 %

text: The methodology selected and employed to the maturity assessment framework and the data collection approach is presented in the Annex of this report, which is distributed as a separate document.

text: 2.1 MATURITY AT THE GOVERNMENTAL LEVEL (DIMENSION 1)

text: This subsection aims to provide a more detailed assessment of the governmental dimension of the maturity model governing the implementation of cybersecurity education. It builds on the insights collected through the detailed desk research on the 27 MS and the detailed insights gathered through the 14 interviews and 3 responses received from the online survey. Liaising with MS representatives enabled ENISA to identify good practices that complemented the findings issued from desk research. These good practices are presented later in this section in Table 6.

text: As indicated in the previous section, the governmental dimension encompasses all actions and aspects taken at the political level with regard to cybersecurity education in primary and secondary education, including regulations and policies defining the regulatory framework (planned or implemented). In order to measure the level of maturity of MS in the field of cybersecurity education, it was essential to analyse their political maturity in this area. The governmental dimension is assessed through three main sub-dimensions relating to governmental initiatives at the national level. As presented in the theoretical framework (Table 1), these three sub-dimensions are Regulatory framework, Policy and Support.

text: A majority of the countries indicated that they had implemented or planned to implement a policy to support the adoption of cybersecurity education measures at the national level, translating to a 78 % maturity level. However, MS tend to be less advanced when it comes to having a comprehensive regulatory framework in place to shape policy, as shown by the average maturity level of 64 %. Finally, the countries show a medium maturity level (56 %) in relation to supporting education and/or cybersecurity stakeholders and organisations through national programmes. In fact, less than half of the countries reported having programmes in place involving activities that would be fully or partially funded by national budget schemes.

text: The analysis of each sub-dimension is detailed in the following sections: Assessment of regulatory framework, Section 2.1.1; Assessment of national policies, Section 2.1.2; and Assessment of national support, Section 2.1.3.

text: 2.1.1 Assessment of regulatory framework (sub-dimension 1.1)

text: Referring to the regulatory framework indicators, Figure 1 shows that 5 MS over the 13 countries represented have implemented a regulatory framework. In most countries, regulatory frameworks tend to be aimed at political decision-makers. However, it was also observed that regulatory frameworks can be aimed at private organisations. Two other countries are in the process of defining a regulatory framework (‘Establishment phase’) to support the development of a multiannual educational programme applicable at the national level. The two remaining

text: countries, with a maturity score of 33 %, tend to be more ‘strategic’-oriented and devote fewer resources to policy work. The 33 % means that these countries are either in the development phase of these policy initiatives or are only acting politically on an ad hoc basis. As for the four countries with a maturity score of 0 %, they have no policy initiatives at all.

text: The findings from the desk research show that all 27 MS rely on national cybersecurity to define actions relating to cybersecurity education. While the emphasis varies greatly from one national strategy to another, these strategies focus on concrete actions and a definition of governance based on national cybersecurity strategies. This will be discussed in more detail in Section 2.2.

text: Figure 1 – Member States’ maturity on the implementation of regulatory framework to support cybersecurity education (by numbers of countries)

text: The idea behind defining a regulatory framework for MS is to define common goals, scope and objectives for ministries of education, ministries responsible for digital and cybersecurity issues, government entities and public and private stakeholders involved in cybersecurity education. However, MS representatives often pointed out that education and cybersecurity are generally seen as two different subjects, dealt with and supported separately. It was also observed that countries with a federal or regional structure manage education in a relatively heterogeneous way. Consequently, the development and implementation of a single national regulatory framework on cybersecurity education is seen as a complex and inadequate task, due to the diversity of stakeholders and organisations involved, and sometimes language barriers.

text: Finally, the mandatory inclusion of cybersecurity education in school curricula is seen as an effective way of ensuring the adoption of these measures in schools. However, geographical and demographic issues similar to those mentioned above apply when it comes to developing a single programme for a country. Currently, 4 of the 27 MS are not considering the implementation of a cybersecurity curriculum.

text: CYBERSECURITY EDUCATION MATURITY ASSESSMENT 2.1.2 Assessment of national policies (sub-dimension 1.2)

text: All the MS consulted stated that they had transposed the NIS Directive ( ) enacted in 2016. In addition to legal transposition, of the 6 countries that said that they had drawn up national policies, 3 pointed out that the policies tended to target universities rather than the primary and secondary levels or provided no details at all. Lastly, of the two countries with a maturity level of 50 %, one indicated that it acted as a national organisation available to share advice and support the adoption of cybersecurity education; however, national coverage of a policy is compromised due to the nation’s regional government structure. Only one country out of 13 indicated that there was no national policy in place or planned.

text: One should note that 4 countries did not provide data for this indicator. These are shown as N/A in Figure 2.

text: Figure 2 – Member States’ maturity on the implementation of a national policy to support cybersecurity education

text: 2.1.3 Assessment of national support (sub-dimension 1.3)

text: As mentioned in Section 2.1, ‘national support’ refers to the launch of programmes or initiatives that would concretely support MS in setting up measures to promote cybersecurity in education from a regulatory point of view. A total of six countries reported having a national programme in place or planned, including a series of initiatives developed at the governmental level.

text: One of the best performers has had a national programme in place since 2023, supported by an active working group and aimed at developing digital and ecological skills in all vocational curricula.

text: Eight other countries have indicated that there is no national programme in place, but rather ad hoc initiatives that are not necessarily part of a structured national programme.

text: Figure 3 – Country example of national policy actions conducted at the national level

text: 2.1.4 Good practices on governmental aspects (Dimension 1)

text: In addition to concrete governmental initiatives, the objective of the targeted consultation was to collect good practices around cybersecurity education at the governmental level. Table 3 presents a series of good practices illustrated by inspiring national actions.

text: Table 3 – Good practices identified at the national level (Governmental dimension)

text: CYBERSECURITY EDUCATION MATURITY ASSESSMENT 2.2 MATURITY AT THE STRATEGIC LEVEL (DIMENSION 2)

text: This subsection aims to provide a more detailed assessment of the second dimension of the maturity assessment model, the strategic dimension governing the implementation of cybersecurity education. This section will build on the insights collected through the detailed desk research on the 27 MS and the detailed insights gathered through the 13 countries represented, thanks to the data collection activities and result computations within the theoretical framework. Additionally, good practices identified through interviews and/or the detailed desk research will be highlighted in Section 2.2.4.

text: As per the theoretical framework presented in Section 2.2, the ‘strategic’ dimension is divided into three sub-dimensions: Cooperation, National strategies and Action plan. The EU average shows results from 64 % to 74 % in terms of maturity level across this sub-dimension. This means that the MS position themselves in the ‘Establishment’ phase of any strategy action fostering the adoption of cybersecurity education measures.

text: Each sub-dimension is detailed in the section below as follows: Assessment of national educational strategies, Section 2.2.1; Assessment of national action plans, Section 132.2.2; and Assessment of national initiatives to foster cooperation, Section 2.2.3.

text: 2.2.1 Assessment of national educational strategies (sub-dimension 2.1)

text: National education policy is defined as ‘a comprehensive framework for elementary education to higher as well as vocational training’. This aims at supporting quality education, training and

text: social cohesion at the national level ( ). In the context of this study, national education policy informs about the different mandatory/voluntary topics included in curricula for the primary and secondary levels.

text: As observed in all MS, national cyber security strategies (NCSS) are the tools most frequently used to support the implementation of cybersecurity education initiatives at the national level (for both primary and secondary education, or for secondary education only). In most countries, elements relating to cybersecurity education are fully taken into account in their NCSS (7 countries show an ‘Optimised/adapted’ level; 100 %). In some of these countries, national strategies indicate that cybersecurity topics and aspects should be covered in primary and secondary schools, and eventually integrated into official national curricula. In 4 other countries, cybersecurity education is briefly mentioned in the NCSS (showing an ‘Establishment’ level; 66 %). Of the 13 countries in the sample, only 1 does not consider cybersecurity education as part of its national cybersecurity strategy.

text: Alternatively, or additionally, MS may choose to communicate cybersecurity education in their national education policy (or in an equivalent legal instrument used at the national level to frame educational aspects in the country). Figure 5 shows that, on the one hand, 8 countries have reached a maturity level of 100 % on this aspect. On the other hand, a third (4) of the countries consulted claim not to mention cybersecurity education in their national education policy. In fact, representatives from these countries reported difficulties in cooperating with education ministries at the national level, as they tend to be inflexible and reticent about cybersecurity topics and innovations. It has also been reported that ministries of education may have other priorities for the school system, leaving no room for cybersecurity-related topics as part of the curriculum or additional electives for students. This difficult cooperation therefore presents national organisations with the opportunity and need to adapt and follow a bottom-up approach, taking into account centralised initiatives (e.g. safer internet centres, national cybersecurity centres, working groups, government entities created specifically for cybersecurity education) and/or industry initiatives. As discussed further in the ‘Operational dimension; Section 4.3’, this tends to result in heterogeneity between schools’ initiatives (including between regions of the same country) in cybersecurity education and in unequal access to cybersecurity knowledge between public and private schools.

text: Figure 4 – Member States’ maturity on the Figure 5 – Member States’ maturity on the

text: consideration of cybersecurity education within consideration of cybersecurity within their national

text: their national cybersecurity strategy education strategy (or equivalent national initiative)

text: National cybersecurity strategies are usually accompanied by national action plans designed to implement the strategy pragmatically within the MS, and sometimes imply the creation of working groups and cross-sector cooperation.

text: 2.2.2 Assessment of national action plans (sub-dimension 2.2)

text: As illustrated in Figure 6, the majority of the MS (7) consulted had set a cybersecurity multiannual action plan in order to ensure the implementation of the NCSS. These countries, therefore, display a maturity level equal to 100 %. Among these countries, only 4 reported that their action plan specifically mentioned actions regarding cybersecurity education for the primary and secondary levels. Despite the creation of a national action plan, 1 country reported difficulties in the concrete implementation of the latter. In fact, the organisation in charge of cybersecurity education often faces reluctance from the ministry of education to implement the action plan (as mentioned in previous sections), often due to insufficient resources. Moreover, the shortage of trained teachers in primary and secondary schools is an obstacle often put forward. Indeed, as further developed in the ‘Operational dimension, Section 2.3’, it can be difficult to deliver courses in schools, as advocated by the NCSS and the corresponding action plan, due to teachers’ lack of cybersecurity skills and knowledge, and the absence of IT infrastructure. Because of these obstacles, national action plans may remain unimplementable in some countries.

text: In all, 4 countries remain at the ‘Non-existent’ maturity level, with no action plan foreseen or implemented.

text: Figure 6 – Member States’ maturity on the implementation of a cybersecurity action plan – and portion of cybersecurity action plans specifying primary and secondary education

text: Aside from action plans theoretically centralising all country initiatives, all represented countries have stand-alone initiatives in place, managed by different stakeholders and sometimes involving cross-national cooperation (e.g. the Cybersecurity Challenge). In fact, in each country there are various efforts that focus on different age groups, on raising awareness and on building content for schools, but these initiatives may not be connected to a specific national action plan.

text: Figure 7 – Country example of cybersecurity initiatives at the national level

text: In addition to actions addressed to schools and teachers, NSCCs may include recommendations and guidance relating to the creation of cooperation groups, as presented in Section 2.2.3.

text: 2.2.3 Assessment of national initiatives to foster cooperation (subdimension 2.3)

text: Cooperation may include collaborations at the national level across the government entities, but also the participation of municipalities, academia, private-sector stakeholders and NGOs.

text: Figure 8 – Country example of national governance and cooperation across education and cybersecurity stakeholders

text: As a general trend, cybersecurity education cooperation and initiatives usually follow a bottomup approach, often led by associations and NGOs. The aim of such cooperation is usually to create synergies among various stakeholders, including teachers. Considering this approach, teachers would have the possibility to express their needs (e.g. training material, schoolbooks, infrastructure) and share challenges and best practices. As cybersecurity is a fast-evolving topic, different stakeholders with different skill sets would benefit from working collaboratively. For instance, schoolteachers would need to frequently update their course content to cope with technology evolution. They would surely benefit from the support and knowledge-sharing practices from private-sector stakeholders who confront this evolution on a daily basis.

text: 2.2.4 Good practices on strategic aspects (dimension 2)

text: Table 4 – Good practices identified at the national level (Strategic dimension)

text: CYBERSECURITY EDUCATION MATURITY ASSESSMENT 2.3 MATURITY AT THE OPERATIONAL LEVEL (DIMENSION 3)

text: This subsection aims to provide a more detailed assessment of the operational dimension governing the implementation of cybersecurity education. It will build on the insights collected through the detailed desk research on the 27 MS and the detailed insights shared by the 13 countries represented within the data collection activities and result computations within the theoretical framework. Additionally, good practices identified through interviews and/or the detailed desk research will be highlighted in Section 2.3.3.

text: As per the theoretical framework presented in Section 2.2, the ‘operational’ dimension is divided into two sub-dimensions: Provision of cybersecurity education and Monitoring mechanism

text: and/or framework. The EU average is at 78 % when it comes to providing primary and secondary pupils with cybersecurity education, regardless of the methods employed. Referring to the 13-country sample of this study, the EU displays an ‘Establishment’ maturity level, which means that while sometimes lacking formal and uniform national approaches, most of the MS manage to provide pupils with relevant cybersecurity knowledge.

text: An important aspect of cybersecurity education and the underlying initiatives is the regular control, monitoring and assessment of their effectiveness. The EU’s maturity level with regard to monitoring and evaluation practices for cybersecurity education initiatives remains ad hoc or in its infancy (maturity level: ‘Initial/ad hoc’, 23 %).

text: Each sub-dimension is detailed in the below section as follows: Provision of cybersecurity education, Section 2.3.1 and Monitoring mechanism and/ or framework, Section 2.3.2.

text: 2.3.1 Assessment of initiatives for providing cybersecurity education (sub-dimension 3.1)

text: In all consulted countries (13), cybersecurity courses are delivered to primary and/or secondary schools wheretwelve (12) of them reported that cybersecurity is included in either primary or secondary school curricula. However, the level of maturity on the topic differs across MS. The majority of the countries stands in the ‘Initial/ad hoc’ maturity level, where cybersecurity topics are only provided on a voluntary basis. This means that schools are either not obliged to deliver courses on cybersecurity or that they are optional. Additionally, classes may be delivered to pupils, but they are not evaluated (i.e. pupils do not take exams on cybersecurity).

text: A major blocking point limiting the adoption of cybersecurity courses in EU schools reported by the MS is the knowledge gap faced by primary and secondary schoolteachers. Because of this, the quality of classes usually varies across schools, resulting in unequal chances for pupils to learn about cybersecurity topics. Schoolteachers tend not to be trained and equipped (i.e. insufficient training materials and/or IT infrastructure) enough to feel comfortable in delivering cybersecurity courses. To cope with this problem, NCSS and ministries of education (sometimes with the support of private-sector stakeholders) provide training materials addressed to teachers, i.e. following a ‘train the trainer’ approach. Some countries have also launched working groups in order to share experience, ideas on relevant cybersecurity topics and use cases. Some NCSS representatives reported facing a high demand of training, bootcamps and material from motivated schoolteachers willing to learn and teach about cybersecurity, and from school directors eager to upgrade their curricula.

text: Additionally, the 4 most advanced countries (i.e. with maturity levels equal to 100 % and 84 %; ‘Optimisation/Adaptions’ and ‘Establishment’ respectively) have mandated cybersecurity courses in curricula for the secondary and primary levels (more in-depth courses for the secondary level). It was also observed that in most countries, the school system offers different paths for pupils. Cybersecurity tends to also be mandatory for certain specialised academic paths relating to applied sciences, digital sciences or IT in general.

text: The MS showing an ‘Early definition’ maturity level shared that cybersecurity per se is not currently mentioned in the curricula for primary and secondary schools, however ‘Digital literacy’ is. The existence of topics touching upon cybersecurity in these classes strongly depends on the teacher’s motivation and knowledge.

text: Lastly, only 1 country among the 13 sampled countries stated having no cybersecurity or digitalrelated courses in its school curricula.

text: Figure 9 – Member States’ maturity on the inclusion of cybersecurity topics in primary and secondary education curricula

text: As an illustration of a bottom-up and gradual approach for including cybersecurity into school curricula, the pilot organised by Ireland is presented in Figure 10. One should note that regardless of countries’ maturity level, all MS have produced materials addressed to teachers and pupils in different formats and available in multiple sources, to ensure accessibility and demographic coverage.

text: Figure 10 – Country example of operational implementation of cybersecurity education actions

text: Besides the consideration of cybersecurity topics in curricula at the national level, the organisation of challenges, events and bootcamps was frequently mentioned as an efficient and motivating initiative to promote cybersecurity topics among pupils. In fact, either autonomously or in anticipation of the European Cybersecurity Challenge organised by ENISA, most consulted countries reported having organised national Cybersecurity National Challenges. These events gathered between 200 and 2 000 pupils and sometimes involved cross-border cooperation. The events provided opportunities to raise awareness among pupils, generate interest for cybersecurity topics and classes and share training materials and online content.

text: 2.3.2 Considerations on the implementation of an evaluation mechanism (sub-dimension 3.2)

text: In this context, an ‘evaluation mechanism’ means a framework that would help MS and responsible authorities assess the performance, efficiency and coverage of implemented actions and initiatives.

text: Only 2 countries (showing a ‘Optimisation/adaptions’ maturity level) reported having set monitoring measures, even if they are not part of a coordinated monitoring process for the overall action plan.

text: In one of the consulted countries, teachers usually receive quantitative feedback from the participation of pupils in their modules. Additionally, a final report relating to the overall implementation of cybersecurity in education will be published, which should include quantitative assessments of the participation of pupils across the participating schools.

text: The other national authority reported a monitoring framework at the national level. However, every stakeholder tries to promote cybersecurity awareness in the most effective way. Therefore, the monitoring is carried out separately. This authority, which oversees EU projects, has to meet key performance indicators that are linked to brand awareness and the reach of social media campaigns. Lastly, the organisation usually shares questionnaires to obtain qualitative feedback on initiatives, teaching material, events and publications. As of today, around 1 300 training sessions are carried out yearly and qualitative evaluations are obtained from the participants (students) and teachers, educators and trainers.

text: 2.3.3 Good practices on the operational aspects (Dimension 3)

text: Table 5 – Good practices identified at the national level (Operational dimension)

text: 3. RECOMMENDATIONS

text: This section provides recommendations aiming to support the development and provision of materials on cybersecurity education. For each maturity level defined in our maturity assessment framework and drawing from the inputs received in the targeted consultation, the team identified and listed recommendations for cybersecurity education-related actions and activities to be developed by the MS. These recommendations aim to provide guidance to develop, reuse and deploy appropriate materials, activities and campaigns in primary and secondary schools. Moreover, the recommendations provide the relevant stakeholders with guidance for setting the objectives, addressing the needs of students and maturity gaps.

text: 3.1 RECOMMENDATIONS ON THE GOVERNMENTAL LEVEL (DIMENSION 1)

text: t t n/ io en n 4) 5) 1) hmen at tion

text: st l 3) is

text: Recommendations l/ad c l 2) rly itio lis ve evel ap evel

text: exi evel ho ve Ea fin im

text: itia ab (L ad (L n- (Le pt

text: (L In (Le de

text: Est O No

text: 1. Incorporate cybersecurity within one of the pillars of a greater policy focused on media

text: x x

text: literacy.

text: 2. Involve the Ministry of Education and academic and research networks and institutions in

text: the creation and implementation of general and broad curricula to ensure that all students

text: x x x

text: attain the same skills and in the development of activities that will foster cybersecurity

text: education.

text: x

text: 3. Make cybersecurity education binding and a high priority of the government.

text: 4. Have the Ministry of Education help provide access to EU grants and private initiatives for x x x

text: funding of cybersecurity education.

text: 5. Be part of and develop a communication strategy alongside the strategy on cybersecurity

text: x x

text: education.

text: t t n/ io en n 4) 5) 1) hmen at tion

text: st l 3) is

text: exi evel ho ve Ea fin im

text: itia ab (L ad (L n- (Le pt

text: (L In (Le de

text: Est O No

text: 6. Implement pilot projects in a number of schools based on the national strategy’s objective

text: x

text: to strengthen cybersecurity in education.

text: 7. Account for the maturity level of schools that has been previously measured, in

text: x x x

text: compliance with EU and/or international frameworks.

text: 3.2 RECOMMENDATIONS ON THE STRATEGIC LEVEL (DIMENSION 2)

text: t t n n/

text: c io

text: en itio 4) 5) ho hmen at tion

text: st 1) in l 3)

text: Recommendations l 2) is ef lis ap ve evel evel exi evel l/ad ve im d ab (L ad (L n- (L (Le pt

text: itia (Le rly O

text: No Est

text: In Ea

text: 1. Engage teachers in course development and consider the utilisation of a bottom-up and

text: x X

text: ‘teach the teacher’ approach to support the concrete implementation of cybersecurity

text: education and ensure their commitment and buy-in.

text: 2. Collaborate with universities to offer cybersecurity courses to primary and secondary

text: x x

text: school students, and simultaneously certify teachers to validate their competency in

text: teaching cybersecurity.

text: 3. Provide support for projects aimed at adapting existing cybersecurity content for effective x x

text: classroom integration.

text: t t n n/

text: c io

text: en itio 4) 5) ho hmen at tion

text: st 1) in l 3)

text: itia (Le rly O

text: No Est

text: In Ea

text: 4. Provide schools the opportunity to schedule certified cybersecurity trainers for in-school x x x x x

text: sessions.

text: 5. Build a continuous and coherent plan and learning path that starts from primary school x x x

text: and combine cybersecurity with the formal qualification of teachers.

text: 6. Introduce cybersecurity concepts through interactive challenges and gamified e-learning x x x

text: resources.

text: 7. Integrate essential cybersecurity skills and concepts into digital competences and skills x x

text: courses and in other educational areas (e.g. economics, social studies).

text: 8. Emphasise understanding, practical know-how, prevention and the ability to self-assess r x x

text: risky online behaviou and apply safety measures from a positive perspective (‘what to do’

text: instead of ‘what not to do’).

text: 9. Develop national-level targets while granting schools autonomy to select materials and x x x x x

text: content for cybersecurity education.

text: 10. Consider the development of a working group that includes stakeholders of the education

text: x x

text: ecosystem and their involvement in the implementation and extension of cybersecurity

text: education initiatives.

text: 11. Cooperate with the private sector and universities in developing training materials for

text: x x x x x

text: primary and secondary school students that are aligned with current trends.

text: 12. Involve students in promoting and teaching cybersecurity to other students (peer x x x

text: learning).

text: t t n n/

text: c io

text: en itio 4) 5) ho hmen at tion

text: st 1) in l 3)

text: itia (Le rly O

text: No Est

text: In Ea

text: 13. Promote comprehensive cybersecurity education and career paths by partnering with x x x

text: industry-led programmes and launching media-backed campaigns to highlight

text: cybersecurity professions.

text: 3.3 RECOMMENDATIONS ON THE OPERATIONAL LEVEL (DIMENSION 3)

text: t n/ t io n en n 4) 5) hmen at tio st 1) l 3) Recommendations c l 2) itio is

text: l/ad rly lis ap

text: ve evel evel

text: exi ve Ea fin im

text: evel ho ab (L ad (L

text: n- itia pt (L de (Le In (Le O

text: No Est

text: X 1. Engage in cybersecurity activities carried out in other MS. x x x x

text: 2. Involve external experts and/or universities in the facilitation of the cybersecurity x x x

text: courses/classes.

text: 3. Pilot test the implementation of cybersecurity curricula before mandating its inclusion. x x

text: x 4. Introduce mandatory hours of instruction on cybersecurity awareness. x

text: 5. Provide a certification after the completion of cybersecurity courses. x x

text: t t n/ io n en n 4) 5) 1) hmen at tio

text: st l 3) is

text: exi evel ho ve Ea fin im

text: itia ab (L ad (L n- (Le pt

text: (L In (Le de

text: Est O No

text: 6. Develop a monitoring framework centred on the effectiveness of implemented cybersecurity x x

text: education initiatives, using surveys to assess their impact.

text: 7. Introduce a roadmap to encourage and guide students to pursue a cybersecurity career. x x

text: 8. Consider different requirements based on school type and the geographical and social x x

text: background of pupils when implementing curricula.

text: 9. Build and refer to advisory boards which engage with various cybersecurity stakeholders, in

text: x

text: particular the ones who have access to very large online platforms.

text: CYBERSECURITY EDUCATION MATURITY ASSESSMENT 3.4 RECOMMENDATIONS AND EXPECTATIONS FROM THE MEMBER STATES ON THE ROLE AND ACTIONS TO BE TAKEN BY ENISA

text: A set of recommendations and expectations shared by the MS introduces how ENISA can help increase the maturity level of cybersecurity education in Europe. The role and actions proposed by the MS were distributed per dimension of the maturity assessment model.

text: Dimension 1 – Governmental level

text: • Support the dissemination of information across the EU and the implementation of policies and programmes to support the cyber resilience of citizens. • Provide a harmonised framework for curricula for both primary and secondary school levels. These should be accompanied by quantitative key performance indicators that the MS should track. • Be the main liaison and/or organiser of events between different MS and stakeholders of the cybersecurity sector who are involved in the education sector.

text: Dimension 2 – Strategic level

text: • Provide guidance and support on how to address the challenge of finding, upskilling and maintaining teachers with cybersecurity knowledge at both the primary and secondary school levels. • Promote the sharing of tools, assessment frameworks, trainings and best practices. • Provide a centralised platform to share and promote initiatives and projects (tools, materials, expertise, glossary) developed by the MS relating to cybersecurity education, that can be repurposed by teachers. • Offer direction regarding the various aspects of cybersecurity suitable for exploration with primary and secondary school students.

text: Dimension 3 – Operational level

text: • Develop and provide training programmes that can be repurposed and used by teachers. • Consult children and teenagers in the development of cybersecurity material and activities based on their experiences. • Focus on raising awareness beyond the school environment (real-life scenarios) and on the preparation and recruitment of the next generation of cybersecurity specialists. • Consider the addition of cybersecurity to cultural or linguistic exchanges done at the school level.

text: 4. CONCLUSION

text: The aim of this ENISA study on assessing the maturity of cybersecurity education was to present the current outlook in the MS. For this purpose, a maturity model was selected and designed to meet the objective of this study. This model is structured into key dimensions and objectives, which are assessed using a series of indicators. Its ultimate aim is to assign a level of maturity to each MS in the field of cybersecurity in education and to gain a better understanding of the advances and challenges in the EU. In summary, the main findings reveal that, based on data obtained from stakeholders in 13 countries, MS have an average maturity level of 66 % in cybersecurity in education, corresponding to level 4 ‘Establishment’.

text: The first tier of the maturity model was designed to comprehensively assess the strategy for ensuring, promoting and implementing cybersecurity education across MS. This tier further dissects the ‘Establishment’ level, encompassing three key dimensions: Governmental (70 % EU average), Strategic (64 % EU average) and Operational (63 % EU average). These figures and the breakdown of the data presented in the report reveal that MS have taken significant steps to follow European cybersecurity directives (NIS) and execute actions aligned with existing national and regional efforts that aim to support students in acquiring knowledge in cybersecurity. However, the implementation of curricula and initiatives continues to progress at a moderate pace due to the numerous stakeholders involved in the operationalisation of the education sector from top to bottom.

text: Additional factors that add to the challenges of implementing cybersecurity curricula and classes stem from the difficulty in cooperating with the various entities involved and the priorities set at the governmental level that often do not leave space for cybersecurity-related topics to be included in the curricula. Stakeholders interviewed for this study also proposed an alternative approach, involving a bottom-up strategy in which teachers actively participate in cybersecurity activities organised by national and local entities. However, this approach introduces other challenges: the need to have enough adequately prepared teachers for instructing this topic and ensuring they have access to adequate materials.

text: Nevertheless, MS have shown a high level of voluntary engagement in initiatives aimed at primary and secondary school students with the involvement of schools. These initiatives, requiring fewer agreements and restructuring of the existing curricula, have proven to be an opportunity to introduce the cybersecurity topic and foster the development of academic content to support the integration.

text: It is important to consider these and various other challenges when interpreting the findings in this study. The MS surveyed do not encompass the entire EU spectrum, and the stakeholders interviewed often presented various involvement levels across the three dimensions of the maturity model examined during this study, requiring follow-up with additional entities and bodies. These factors have led to certain data points being less representative and the exclusion of two MS from the analysis.

text: Integrating cybersecurity into national education curricula within the education policies at the Member State (MS) level is progressing at a moderate pace, therefore highlighting the need for a strategic and coordinated approach to engage educational stakeholders in MS. ENISA is systematically working with these stakeholders and develops relevant work that may assist in gradually integrating more cybersecurity content into national curricula, ensuring a comprehensive and unified effort to enhance cybersecurity education across the EU.

text: -N -EN -366 -24 -09 TP

text: ABOUT ENISA

text: ISBN 978-92-9204-674-3 doi: 10.2824/3832


text: Regelbundna revisioner bör genomföras av personer med lämplig kunskap, kompetens och erfarenhet. Revisorerna ska vara oberoende, och det kan vara antingen en utomstående entreprenör eller en internrevisor på företaget som är oberoende av den dagliga it-driften.

text: Enligt EU:s allmänna dataskyddsförordning ska alla små och medelstora företag som behandlar eller lagrar personuppgifter som tillhör personer med hemvist i EU/EES PUBLICERA CYBERSÄKERHETSPOLICYER säkerställa att lämpliga säkerhetskontroller finns på plats för att skydda sådana uppgifter. Företaget ska ha cybersäkerhetspolicyer med tydliga och Detta inkluderar att säkerställa att eventuella specifika regler som anger hur medarbetarna förväntas uppföra tredje parter som arbetar för företagets sig när de använder företagets miljö, utrustning och tjänster räkning har lämpliga säkerhetsåtgärder på avseende IKT. Dessa policyer ska också tydliggöra plats. konsekvenserna om en medarbetare inte efterlever policyerna. Policyerna ska revideras och uppdateras regelbundet. 1 Den allmänna dataskyddsförordningen https://ec.europa.eu/info/law/law-topic/dataprotection_en

text: Uppmuntra alla att använda en lösenfras, en grupp av minst tre slumpmässiga, vanliga ord kombinerade till en fras som är både säker och UTVECKLA EN lätt att komma ihåg. Tänk på följande om du väljer ett typiskt lösenord:

text: Se till att det är långt, består av små och stora bokstäver, eventuellt även siffror och specialtecken. INCIDENTRES Undvik uppenbara val av lösenord, t.ex. ”lösenord”, sekvenser av

text: bokstäver eller siffror, t.ex. ”abc” eller ”123”. Undvik att använda personlig information som går att hitta på internet.

text: Oavsett om du använder lösenfraser eller lösenord ska du tänka på följande:

text: Återanvänd dem inte på andra platser. Dela dem inte med kollegor. Utarbeta en formell incidentresponsplan som Aktivera multifaktorsautentisering. innehåller tydliga riktlinjer, roller och Använd en lösenordshanterare. ansvarsområden som säkerställer att alla säkerhetsincidenter hanteras i rätt tid och på ett professionellt och korrekt sätt. För att snabbt kunna reagera på säkerhetshot är ett förslag att undersöka vilka verktyg som finns för att övervaka och skapa varningar när misstänkt aktivitet eller säkerhetsöverträdelser inträffar.

text: Ett avgörande steg i cybersäkerhetsprogrammet ANVÄND VERKTYG SOM

text: är att hålla de enheter som medarbetarna SKYDDAR E-POST OCH WEBB

text: använder säkra, oavsett om det är stationära eller bärbara datorer, surfplattor eller smarttelefoner. Använd lösningar som blockerar skräppost och e-post med länkar till osäkra webbplatser, skadliga bilagor, som kan innehålla virus, och

text: PROGRAMVARAN Skydda data genom kryptering. Små och

text: medelstora företag bör säkerställa att data i Använd helst en central plattform för mobila enheter, däribland bärbara datorer, patchhantering. Små och medelstora smarttelefoner och surfplattor, är krypterade. företag bör Se till att data som överförs via offentliga regelbundet uppdatera all sin programvara, nätverk, t.ex. wifi-nätverk på hotell eller SÄKRA alltid aktivera automatiska uppdateringar

text: flygplatser, krypteras, antingen med hjälp av när det är möjligt, ett VPN (virtuellt privat nätverk) eller genom identifiera programvara och maskinvara som att använda en säker anslutning via ett kräver manuell uppdatering, ENHETER SSL/TLS-protokoll för åtkomst till webbplatser.

text: även räkna med mobila enheter och enheter Säkerställ att de egna webbplatserna för sakernas internet. använder lämplig krypteringsteknik för att skydda klientdata som färdas genom internet.

text: En centralt hanterad virusskyddslösning bör implementeras på alla enheter och hållas uppdaterad för att säkerställa fortsatt effektivitet. Installera inte piratkopierade program, eftersom de kan innehålla sabotageprogram.

text: Lämpliga fysiska kontroller bör användas varhelst det finns För att möjliggöra återställning av viktig information ska det viktig information. Ett företags bärbara dator eller en finnas säkerhetskopior, eftersom det är ett effektivt sätt att smarttelefon får exempelvis inte lämnas oövervakad i återhämta sig från katastrofer såsom angrepp med baksätet på en bil. Varje gång en användare lämnar sin utpressningsprogram. Nedanstående regler bör följas när dator bör den låsas. Alternativt kan en autolåsfunktion det gäller säkerhetskopiering: aktiveras på enheter som används för affärssyften. Känsliga Säkerhetskopiering ska ske regelbundet och automatiskt utskrifter får heller inte lämnas utan uppsikt och ska när de när så är möjligt. inte används låsas in. Säkerhetskopior ska förvaras separat från företagets produktionsmiljö. Säkerhetskopior ska krypteras, i synnerhet om de flyttas mellan olika platser. Möjligheten att regelbundet återställa data från säkerhetskopiorna ska testas. Helst ska man regelbundet testa att göra en fullständig återställning från början till slut.

identifier: Cybersecurity guide for SMEs - 12 steps to securing your business

nummer: cybersecurity-guide-for-smes

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: sv

serie: rapporter

text: EUROPEISKA UNIONENS CYBERSÄKERHETSBYRÅ

type: stycke

text: Cybersäkerhetsvägledning för små och medelstora företag STEG

type: rubrik

text: FÖR ATT

text: SKYDDA DIN VERKSAMHET

text: Under covid-19-krisen framgick det tydligt vilken stor betydelse internet och datorer har för små och medelstora företag. För att kunna driva sin verksamhet under pandemin blev många små och medelstora företag tvungna att vidta kontinuitetsåtgärder, bland annat börja använda molntjänster, förbättra sina internettjänster, uppgradera sina webbplatser och möjliggöra för personalen att distansarbeta. I den här broschyren lyfter vi fram tolv övergripande steg som små och medelstora företag kan vidta för att trygga sina system och sin verksamhet. Den kompletterar den mer detaljerade Enisarapporten Cybersecurity for SMES – Challenges and Recommendations.

text: SKAPA EN BRA CYBERSÄKERHETS KULTUR

text: TILLDELA LEDNINGSANSVAR

text: En god cybersäkerhet är avgörande för små och medelstora företags fortsatta framgångar. Ansvaret för denna kritiska funktion bör tilldelas en person i organisationen som kan säkerställa att lämpliga resurser i form av mantimmar avsätts för cybersäkerhet, att programvara, tjänster och maskinvara för cybersäkerhet köps in, att personalen får utbildning i ämnet och att effektiva cybersäkerhetspolicyer utarbetas.

text: VINN MEDARBETARNAS ENGAGEMANG

text: Vinn medarbetarnas engagemang genom effektiv kommunikation om cybersäkerhet från ledningen, ledningens öppna stöd för cybersäkerhetsinitiativ, lämplig utbildning till medarbetarna samt tydliga och specifika regler för medarbetarna samlade i cybersäkerhetspolicyer.

text: GENOMFÖR CYBERSÄKERHETSREVISIONER GLÖM INTE DATASKYDD

text: SÄKERSTÄLL TILLHANDAH EFFEKTIV ÅLL LÄMPLIG HANTERING AV UTBILDNING

text: Tillhandahåll alla medarbetare regelbunden utbildning i cybersäkerhetsmedvetenhet för att TREDJE PART

text: säkerställa att de känner igen och kan hantera de olika cybersäkerhetshoten. Dessa utbildningar bör Säkerställ att alla leverantörer, i synnerhet de skräddarsys efter företaget och fokusera på som har åtkomst till känsliga uppgifter verkliga situationer. och/eller system, hanteras aktivt och uppfyller överenskomna säkerhetsnivåer. Tillhandahåll särskild cybersäkerhetsutbildning till Det ska finnas avtal som reglerar hur de som är ansvariga för hanteringen av leverantörerna ska uppfylla säkerhetskraven. cybersäkerhet inom företaget för att säkerställa att de har den kunskap och kompetens som krävs för jobbet.

text: SÄKERSTÄLL SYSTEMÅTKO MST PONSPLAN

text: SE TILL ATT INSTALLERA nätfiske. PATCHAR OCH UPPDATERINGAR AV KRYPTERING VIRUSSKYDD

text: SÄKRA

text: IMPLEMENTERA HANTERING AV MOBILA

text: NÄTVERK

text: ENHETER

text: För att underlätta distansarbete tillåter många små och medelstora företag medarbetarna att ET

text: använda sina egna bärbara datorer, surfplattor

text: och/eller smarttelefoner. Det medför allvarliga

text: ANVÄND BRANDVÄGGAR

text: säkerhetsproblem när det gäller känsliga Brandväggar hanterar all trafik in och ut från nätverket och är företagsdata som finns lagrade i dessa enheter. ett kritiskt verktyg för att skydda företagets system. Ett sätt att hantera risken är att använda en Brandväggar bör användas för att skydda alla kritiska system, MDM-lösning (Mobile Device Management), vilket i synnerhet för att skydda företagets nätverk från internet. gör att företaget kan

text: kontrollera vilka enheter som har behörighet

text: SE ÖVER LÖSNINGAR FÖR FJÄRRÅTKOMST

text: till företagets system och tjänster, Små och medelstora företag bör regelbundet se över sina säkerställa att enheten har ett uppdaterat verktyg för fjärråtkomst för att säkerställa att de är säkra, i virusprogram installerat, synnerhet avgöra om enheten är krypterad, säkerställa att alla patchar och uppdateringar i bekräfta att enheten har uppdaterade programvara för fjärråtkomst körs, patchar installerade, begränsa fjärråtkomst från misstänkta geografiska platser se till att enheten är skyddad av en eller vissa IP-adresser, pinkod och/eller ett lösenord, begränsa medarbetarnas fjärråtkomst till de system och rensa alla företagsdata från enheten datorer som de behöver för sitt arbete, på distans om ägaren till enheten kräva starka lösenord för fjärråtkomst och där så är skulle rapportera att den försvunnit möjligt aktivera multifaktorsautentisering, eller blivit stulen, eller om ägarens säkerställa att övervakning och larm är aktiverat som varnar anställning i företaget skulle upphöra. för misstänkta attacker eller ovanlig misstänkt aktivitet.

text: FÖRBÄTTRA DEN FYSISKA SÄKERHETSK SÄKERHETEN OPIERA

text: MOLNTJÄNSTER

text: Molnbaserade lösningar erbjuder många fördelar, men innefattar även en del unika risker, vilket små och medelstora företag bör överväga innan de väljer en molnleverantör. Enisa har publicerat vägledningen Cloud Security Guide for SMEs , som små och medelstora företag bör läsa innan de migrerar till molnet.

text: När företaget väljer molnleverantör bör man säkerställa att inga lagar eller förordningar överträds vad gäller lagring av data, i synnerhet personuppgifter, utanför EU/EES. I EU:s dataskyddsförordning krävs exempelvis att personuppgifter som tillhör personer med hemvist i EU/EES inte lagras eller överförs utanför EU/EES om inte särskilda villkor är uppfyllda.

text: SÖKA OCH SÄKRA WEBBPL DELA ATSER INFORMATION

text: Små och medelstora företag måste säkerställa att deras Ett effektivt verktyg i kampen mot it-brottslighet är webbplatser är konfigurerade och underhålls på ett informationsdelning. Informationsdelning gällande itsäkert sätt och att alla personuppgifter och finansiella brottslighet är avgörande för att små och medelstora data, t.ex. kreditkortsuppgifter, är skyddade på lämpligt företag ska få en bättre förståelse för de risker de står sätt. Detta innefattar regelbundna säkerhetstester av inför. Det är mer sannolikt att ett företag vidtar åtgärder webbplatser för att identifiera potentiella svagheter i för att säkra sina system om det hör talas om säkerheten och regelbundna revisioner för att säkerställa cybersäkerhetsutmaningar från sina konkurrenter och korrekt underhåll och uppdatering av webbplatser. hur de övervann dem, än om det skulle få liknande uppgifter från branschrapporter eller cybersäkerhetsenkäter.

text: EUROPEISKA UNIONENS CYBERSÄKERHETSBYRÅ

text: OM ENISA

text: Europeiska unionens cybersäkerhetsbyrå, Enisa, är ett EU-organ som har till uppgift att säkerställa en hög nivå av cybersäkerhet i Europa. Europeiska unionens cybersäkerhetsbyrå, som grundades 2004 och stärktes genom EU:s cybersäkerhetsakt, bidrar till EU:s cyberpolitik och förbättrar tillförlitligheten hos produkter, tjänster och processer inom IKT genom program för cybersäkerhetscertifiering. Dessutom samarbetar byrån med medlemsstater och andra EU-organ, och hjälper Europa att förbereda sig inför morgondagens cyberutmaningar. Genom kunskapsspridning, kapacitetsuppbyggnad och åtgärder för att öka medvetenheten arbetar byrån tillsammans med sina huvudintressenter för att uppnå ökad tillit i den uppkopplade ekonomin, stärka motståndskraften i unionens infrastruktur och slutligen upprätthålla digital säkerhet för Europas samhälle och allmänhet. För mer information, besök www.enisa.europa.eu.

text: Enisa

text: Europeiska unionens cybersäkerhetsbyrå

text: Aten-kontoret Heraklion-kontoret

text: Ethnikis Antistaseos 72 & 95 Nikolaou Plastira Agamemnonos 14, 700 13 Vassilika Vouton, Chalandri 15231, Attiki, Heraklion, Grekland Grekland

text: enisa.europa.eu

type: vagledning

utgivare: enisa