Toolbox measures by the second quarter of 2021. It also calls on Member States to continue monitoring together progress made and ensuring further alignment of approaches. At EU level, three main objectives will be pursued in order to support this process: ensuring further convergence in risk mitigation approaches across the EU, supporting continuous exchange of knowledge and capacity building, and promoting supply chain resilience and other EU strategic security objectives. Concrete actions related to these key objectives are set out in the dedicated Appendix to this Communication. The Commission will continue to work closely with Member States to fulfil these objectives and actions with the support of ENISA (see Annex). The EU’s 5G Toolbox approach has, moreover, raised interest in non-EU countries currently developing their approaches securing their communications networks. The Commission services together with the European External Action Service and the network of EU delegations, stands ready to provide additional information if requested on its comprehensive, objective and risk-based approach to authorities around the world. 1.5 An Internet of Secure Things Every connected thing contains vulnerabilities that can be exploited with potentially widespread ramifications. Internal Market rules include safeguards against insecure products and services. The Commission is already working to ensure transparent security solutions and certification under the Cybersecurity Act and to incentivise safe products and services without compromising on performance52. It will adopt its first Union Rolling Work Programme in the first quarter of 2021 (to be updated at least once every three years) to allow industry, national authorities and standardisation bodies to prepare in advance for future European cybersecurity certification schemes53. As the Internet of Things proliferates, enforceable rules require strengthening, both to ensure overall resilience and boost to cybersecurity. The Commission will consider a comprehensive approach, including possible new horizontal rules to improve the cybersecurity of all connected products and associated services placed on the Internal Market54. Such rules could include a new duty of care for connected device manufacturers to address software vulnerabilities including the continuation of software and security updates as well as ensuring, at the end of life, deletion of personal and other sensitive data. These rules would bolster ‘the right-to-repair obsolete software” initiative presented in the Circular Economy Action Plan and complement ongoing measures which address specific types of products, such as mandatory requirements to be proposed for market access of certain wireless products (through the adoption of a delegated 52 Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act). The Cybersecurity Act promotes ICT certification at EU level, with a European Cybersecurity Certification Framework for the establishment of voluntary European cybersecurity certification schemes for the purpose of ensuring an adequate level of cybersecurity for ICT products, ICT services and ICT processes in the Union, as well as reducing the fragmentation of the internal market with regard to cybersecurity certification schemes in the Union. In parallel, cybersecurity ‘ratings’ companies tend to be based outside the EU with limited transparency and oversight; https://www.uschamber.com/issue-brief/principles-fair-and-accurate-security-ratings 53 Required by Article 47(5) of the Cybersecurity Act. 54 Council Conclusions call for horizontal measures on the cybersecurity of connected devices; 13629/20, 2 December 2020. 9