terms of technology and skills, as well as helping to build a strong single market. This needs the right structures to be in place to build strong cybersecurity and to react when needed, with the full involvement of all key actors. The approach would also better deter cyber-attacks, by stepping up work to detect, trace and hold to account those responsible. It would also recognise the global dimension by developing international cooperation as a platform for EU leadership on cybersecurity. These steps build on the approaches of the Digital Single Market, the Global Strategy, the European Security Agenda9, the Joint Framework on countering hybrid threats10 and the Communication on Launching the European Defence Fund.1112 The EU is already working on many of these issues: it is now time to draw the various work streams together. In 2013, the EU set out a Cybersecurity Strategy launching a series of key workstreams to improve cyber resilience.13 Its main goals and principles, to foster a reliable, safe and open cyber ecosystem, remain valid. But the continuously evolving and deepening threat landscape calls for more action to withstand and deter attacks in the future14. The EU is well placed to address cybersecurity, given the scope of its policies and the tools, structures and capabilities at its disposal. While Member States remain responsible for national security, the scale and cross-border nature of the threat make a powerful case for EU action providing incentives and support for Member States to develop and maintain more and better national cybersecurity capabilities, while at the same time building EU-level capacity. This approach is designed to galvanise all actors – the EU, Member States, industry and individuals – to give cybersecurity the priority it needs to build resilience and deliver a better EU response to cyber-attacks. It will bring concrete steps to help detect and investigate any form of cyber incidents against the EU and its Member States and to respond appropriately, including by prosecuting criminals. It will enable EU external action to effectively promote cybersecurity on the global stage. The result will be a shift for the EU from a reactive to a proactive approach to protecting European prosperity, society and values, as well as fundamental rights and freedoms, through responding to both existing and future threats. 2. BUILDING EU RESILIENCE TO CYBER ATTACKS Strong cyber resilience needs a collective and wide-ranging approach. This calls for more robust and effective structures to promote cybersecurity and to respond to cyber-attacks in the Member States but also in the EU's own institutions, agencies and bodies. It also requires a more comprehensive, cross-policy approach to building cyber-resilience and strategic autonomy, with a strong Single Market, major advances in the EU's technological capability, and far greater numbers of skilled experts. At the heart of this is a broader acceptance that cybersecurity is a common societal challenge, so that multiple layers of government, economy and society should be involved. 9 10 11 12 13 14 COM(2015) 185 final. JOIN(2016) 18 final. COM(2017) 295. The approach is also substantiated by independent scientific advice provided by the European Commission’s Scientific Advice Mechanism High Level Group of scientific advisors (see references below). JOIN(2013) 1 final. An assessment of this strategy is available in SWD (2017) 295. Unless otherwise stated, proposals in this Communication are budgetary neutral. Any initiative having budgetary implications will duly follow the annual budget procedures and cannot prejudge the next MultiAnnual Financial Framework post-2020. 3