The limited perspectives of growth for cybersecurity companies within the single market result in a multitude of mergers and acquisitions by non-European investors26. While this trend demonstrates the innovation capacity of Europe’s entrepreneurs in cybersecurity, it also risks leading to the loss of European know-how and expertise, and to a brain drain. Urgent action is needed to foster a more integrated single market for cybersecurity products and services that will facilitate the deployment of more practical and affordable solutions. Barriers of trust among Europe’s industrial and institutional actors can be overcome by fostering cooperation at the early stage of the innovation life cycle: within the cybersecurity industry itself, between suppliers and purchasers; and in a cross-sector dimension involving industries that already are or are likely to become customers of cybersecurity solutions. At the same time, the development of dual-use products, services and technologies is becoming increasingly important in Europe. A growing number of solutions are being brought from the civilian to the defence market27. In the upcoming European Defence Action Plan, the Commission intends to identify measures to further boost civil-military synergies at the European level. 3.1 Certification and labelling Certification plays an important role in increasing trust and security in products and services. This is also valid for those new systems that make extensive use of digital technologies and which require a high level of security, such as connected and automated cars, electronic health, industrial automation control systems (IACS) or smart grids. National initiatives are emerging to set high-level cybersecurity requirements for ICT components on traditional infrastructure, including certification requirements. Albeit important, these bear the risk of creating single market fragmentation and interoperability issues. Only in a few Member States are there effective security certification schemes for ICT products28. An ICT vendor might therefore need to undergo several certification processes in order to sell in several Member States. In the worst case scenario, an ICT product or service designed to fulfil cybersecurity requirements in one Member State cannot be placed on the market in another. In order to achieve a functioning single market in cybersecurity, a possible framework for security certification of ICT products and services should strive to achieve the following goals: (i) cover a wide range of ICT systems, products and services; (ii) ensure application in all 28 Member States; and (iii) address any cybersecurity level; while taking into account developments on the international level. For this purpose, the Commission will set up a dedicated working group on security certification of ICT products and services, composed of experts from Member States and industry. Its aim will be to develop, in cooperation with ENISA and the Joint Research Centre, by end-2016 a roadmap exploring the possibility of creating such a European ICT 26 See SWD(2016) 216. In 2013 the dual use export domain already represented about 20 % of EU total exports (in value). This includes intra-EU trade. 28 See SWD(2016) 216 for Senior Officers Group for Information Systems agreement (Council Decision of March 31st 1992 (92/242/EEC)) and other existing schemes e.g. Commercial Product Assurance in the UK, Certification Sécuritaire de Premier Niveau in France. 27 9