2. Secure the EU defence ecosystem In recent years, the number of cyberattacks has increased dramatically, including supply chain attacks aiming at cyberespionage, ransomware or disruption. In 2020, the SolarWinds supply chain attack21 affected more than 18,000 organisations globally, including government agencies, major businesses, and defence companies. The exploitation of a vulnerability in Apache’s log4j22 software highlighted that even software components that are not considered high risk or critical can be weaponised to carry out successful attacks in the EU on major companies or governments, including in the defence domain. This demonstrates a clear need to strengthen further the cyber resilience of entities that are active in the EU defence ecosystem, including military entities, the defence industry, and private operators. Armed forces depend to a large extent on civilian critical infrastructure be it for mobility, communications or energy. The Russian attack on the KA-SAT satellite network23 which disrupted communication across several public authorities as well as the Ukrainian armed forces is an example of such interrelation. This demonstrates the need to secure such critical infrastructure. To address issues related to the security of their communication and information systems (CIS), Member States are developing their own security standards and requirements for military systems, which do not always consider the need for interoperability, nor the existence of civilian standards for dual-use products. This has a negative impact on the capacity of Member States to act together in cyberspace, also in the context of military CSDP missions and operations, and it creates obstacles for mutual assistance. Furthermore, it is also necessary to promote stronger synergies between military and civilian standardisation tracks as having to follow similar but different standards for civilian and military customers increases production costs for the development of dual-use products by industry. 2.1. Enhancing the cyber resilience of the defence ecosystem Enhancing the cyber resilience of the defence ecosystem requires targeted actions and investments across a broad range of entities from Member States’ military infrastructure and CSDP missions and operations to critical infrastructure, defence industry and relevant research entities. The protection of information required for informed decision-making is necessary for successful CSDP missions and operations. The EU and its’ Member States need to strengthen their military command and control structures further and develop and secure their infrastructure. This also holds true for political-military consultation in the early stages of crisis management for the effective employment of the operation headquarters, including the Military Planning and Conduct Capability (MPCC). This will be in particular addressed through the further development of the EU Operation Wide Area Network. 21 https://cybernews.com/security/solarwinds-hack-the-mystery-of-one-of-the-biggest-cyberattacks-ever/ https://english.ncsc.nl/topics/log4j-vulnerability 23 Declaration by the High Representative on behalf of the European Union on malicious cyber activities conducted by hackers and hacker groups in the context of Russia’s aggression against Ukraine: https://www.consilium.europa.eu/en/press/press-releases/2022/07/19/declaration-by-the-high-representative-onbehalf-of-the-european-union-on-malicious-cyber-activities-conducted-by-hackers-and-hacker-groups-in-thecontext-of-russia-s-aggression-against-ukraine/ 22 8