the cyber aspects should be mainstreamed into existing EU crisis management mechanisms: the EU integrated political crisis response, coordinated by the Presidency of the Council37 and the EU's general rapid alert systems38. The need to respond to a particularly serious cyber incident or attack could constitute sufficient ground for a Member State to invoke the EU Solidarity Clause.39 A fast and effective response also relies on a swift information exchange mechanism between all key players at national and EU level, which in turn requires clarity on their respective roles and responsibilities. The Commission has consulted institutions and Member States on a "Blueprint" to provide an effective process for an operational response at Union and Member State level to a large-scale cyber incident. The Blueprint presented in a Recommendation40 in this package explains how cybersecurity is mainstreamed to existing Crisis Management mechanisms at EU level and sets out the objectives and modes of cooperation between the Member States as well as between Member States and relevant EU Institutions, services, agencies and bodies41 when responding to large scale cybersecurity incidents and crises. The Recommendation also requests Member States and EU institutions to establish an EU Cybersecurity Crisis Response Framework to operationalise the Blueprint. The Blueprint will be regularly tested in cyber and other crisis management exercises42 and updated as necessary. Given that cybersecurity incidents might substantially impact the functioning of economies and the daily lives of people, an option would be to investigate the possibility of a Cybersecurity Emergency Response Fund, following the example of other such crisis mechanisms in other EU policy areas. This would allow Member States to seek help at the EU level during or following a major incident, provided that the Member State had put in place a prudent system of cybersecurity prior to the incident, including full implementation of the NIS Directive, mature risk management and supervisory frameworks at national level. Such a Fund, complementing existing crisis management mechanisms at EU level, could deploy a rapid response capability in the interests of solidarity and finance specific emergency response actions such as replacing compromised equipment or deploying mitigation or response tools, drawing on national expertise along the lines of the EU Civil Protection Mechanism. 2.5 A cybersecurity competence network with a European Cybersecurity Research and Competence Centre The technological tools of cybersecurity are strategic assets, as well as being key growth technologies for the future. It is in the EU's strategic interest to ensure that the EU retains and develops the essential capacities to secure its digital economy, society and democracy, to protect critical hardware and software and to provide key cybersecurity services. The Public-Private Partnership on Cybersecurity43 created in 2016 was an important first step, triggering up to EUR 1.8 billion of investment by 2020. However, the scale of the investment 37 38 39 40 41 42 43 This enables the coordination of responses to major cross-sectorial crises at the highest political level. These enable internal information sharing and coordination on emerging multi-sectoral crises or foreseeable or imminent threats requiring action at EU level. Under Article 222 of the Treaty on the Functioning of the European Union. C(2017) 6100. Including Europol, ENISA, the EU's Computer Emergency Response Team for the EU institutions, bodies and agencies (CERT-EU) and the EU Intelligence and Situation Centre (INTCEN). For example, those run by ENISA: https://www.enisa.europa.eu/topics/cyber-exercises/cyber-europeprogramme. C(2016) 4400 final. 8