Further actions to strengthen the cybersecurity of critical infrastructure in the energy system is set out in the EU action plan for digitalising the energy system.30 Space-based services are of increasing relevance for defence, whether they are for surveillance, situational awareness, precise positioning, or ultra-secured communication. They are therefore key strategic assets for technological sovereignty. Disrupting space-based services could have a major impact on defence systems but also on the overall society and economy. Their resilience is central to the overall cyber defence resilience, as they can be targets of malign attacks. In particular, as seen with the attacks on KA-SAT networks, space systems are increasingly exposed to cyber threats that can affect the availability or continuity of spacebased services. This creates a risk for the EU's strategic and security interests in the space domain, and also for space capabilities enabling and assisting cyber defence. The EU Space Strategy for Security and Defence announced in the Strategic Compass31 will outline measures to improve the robustness and cyber resilience of space infrastructures and related services and to deter and respond to any threats on sensitive space systems and services in the EU, addressing specifically cyber threats. The Commission also calls on Member States to urgently achieve the implementation of the measures recommended in the EU Toolbox on 5G Cybersecurity32. Member States which have not yet enacted restrictions on high-risk suppliers should do so without further delay, considering that time lost can increase vulnerability of networks in the EU. Such risks can be relevant for military assets and can have an impact on the overall defence environment of the Member States. Regarding the cyber resilience of the European defence industry as well as defence research and development entities, such entities are covered under the scope of the NIS 2 Directive unless explicitly excluded by Member States. This would require such entities to have a cybersecurity risk-management programme in place that includes supply chain security as well as incident reporting. As the private sector plays a big role in cybersecurity service provision in the defence ecosystem, Member States should furthermore make use of cybersecurity certification schemes. An EU cybersecurity certification scheme for companies providing services to defence industry could be explored as a way to bring a harmonised level of trust to the market, building on the experience of ENISA. 2.2. Ensure EU cyber defence interoperability and coherence of standards Interoperability and commonality are important requirements to consider from the design phase of cyber defence capabilities, also taking into account the lessons learned from ongoing missions and operations as identified under the lead of the EU Military Staff, with the support of EDA. The principles, processes and standards that are agreed within the Federated Mission Networking (FMN)33 framework should provide the guiding elements for the development of national cyber defence capabilities to ensure interoperability. 30 Digitalising the energy system - EU action plan COM/2022/552 final A Strategic Compass for Security and Defence, 21 March 2022 https://www.eeas.europa.eu/sites/default/files/documents/strategic_compass_en3_web.pdf 32 Cybersecurity of 5G networks - EU Toolbox of risk mitigating measures | Shaping Europe’s digital future (europa.eu) 33 https://dnbl.ncia.nato.int/FMNPublic/SitePages/Home.aspx 31 10