Staff Intelligence - under the Single Intelligence Analysis Capacity framework. In addition to
external information sources, the EUCDCC should establish and integrate an independent
active information technology sensor system to strengthen the monitoring of EU-owned nodes
supporting military CSDP missions and operations. It will provide stronger detection
capabilities and would create a new layer of information to further enhance the information
base for cyber risk assessment and situational awareness.
For these purposes, capabilities are required that enable and ensure the establishment and
maintenance of a 24/7 operational and where possible recognised picture of cyberspace,
including ongoing and imminent cyber operations of both adversaries and friendly forces. Such
a picture would contribute to the planning and conduct of EU military CSDP missions and
operations. It will thus become the military contribution to making the EU more aware and
responsive towards malicious actions in cyberspace.
To improve trust and to exchange reliable and timely strategic information on major cyber
incidents, the EU Cyber Commanders Conference will be further developed and
strengthened13. With the European Defence Agency (EDA) acting as secretariat and the
participation of the EU Military Staff, it will meet at least twice per year to discuss operational
matters and other topics of relevance.
An operational network for milCERTs (MICNET) will be established, supported by EDA.
All Member States are called upon to participate in MICNET, which is expected to be
operational in January 2023.
By facilitating the exchange of information among milCERTs, MICNET will foster a more
robust and coordinated response to cyber threats affecting defence systems in the EU, including
those used in military CSDP missions and operations. MICNET will also allow the processes
of training and the continuous identification of new requirements for the milCERTs community
to be sustained over time. Over the next four years, an information-sharing infrastructure, as
well as related tools and procedures, will be developed by EDA together with Member States
to support information-sharing between milCERTs. MICNET will also provide the framework
for an annual exercise to test, validate and identify new requirements and solutions.
1.2 Enhancing coordination with civilian communities
MICNET should serve as a framework and infrastructure for information-sharing among the
different levels within the cyber defence community and external stakeholders.
As MICNET reaches a higher level of maturity, EDA will support Member States in exploring
options for collaboration with the Computer Security Incident Response Teams (CSIRT)
network, which brings together national CSIRTs and the Computer Emergency Response Team
of the EUIBAs (CERT-EU). This collaboration could include joint meetings and exercises. The
involvement of the private sector in relevant information-sharing and incident response efforts
should also be explored.
To enable more efficient cyber crisis management, the EU Cyber Commanders Conference
should engage with the EU Cyber Crises Liaison Organisation Network (CyCLONe) network,
which brings together Member States and the Commission to support the coordination and
13
Building on the first two meetings of the European Cyber commanders strategic Conferences (CyberCo) in
January and June 2022, EU Cyber Commanders have decided to establish a more permanent forum at their level.
4