The Directive on the Security of Network and Information Systems (the "NIS Directive") is the first EU-wide cybersecurity law.32 It is designed to build resilience by improving national cybersecurity capabilities; fostering better cooperation between the Member States; and requiring undertakings in important economic sectors to adopt effective risk management practices and to report serious incidents to the national authorities. These obligations also apply to three types of providers of key internet services: cloud computing, search engines and online marketplaces. It aims for a stronger and more systematic approach and a better information flow. Full implementation of the Directive by all Member States by May 2018 is essential to EU cyber resilience. The process is being supported by collective work from Member States which will result, by autumn 2017, in guidelines to support a more harmonised implementation, notably in relation to operators of essential services. The Commission is also issuing a Communication33 as part of this cybersecurity package to support their efforts by providing best practice from the Member States relevant to the implementation of the Directive and guidance on how the Directive should be operating in practice. An area where the Directive will need to be supplemented is information flow. For example, the Directive only covers key strategic sectors – but logically a similar approach by all stakeholders hit by cyberattacks would be necessary to have a systematic assessment of vulnerabilities and entry points for cyber attackers. In addition, cooperation and information sharing between the public and private sectors faces a number of obstacles. Governments and public authorities are reluctant to share cybersecurity-relevant information for fear of compromising national security or competitiveness. Private undertakings are reluctant to share information on their cyber vulnerabilities and resulting losses for fear of compromising sensitive business information, risking their reputation or risking breaching data protection rules.34 Trust needs to be strengthened for public-private partnerships to underpin wider cooperation and sharing of information across a greater number of sectors. The role of Information Sharing and Analysis Centres is particularly important in creating the necessary trust for sharing information between private and public sector. Some first steps have been taken in respect of specific critical sectors such as aviation, through the creation of the European Center for Cybersecurity in Aviation,35 and energy, by developing Information Sharing and Analysis Centres.36 The Commission will contribute in full to this approach with support from ENISA, with an acceleration needed in particular with regard to sectors providing essential services as identified in the NIS Directive. 2.4 Resilience through rapid emergency response When a cyber-attack takes place, a fast and effective response can mitigate its impact. This can also demonstrate that public authorities are not powerless in the face of cyber-attacks, and contribute to building trust. As regards the EU institutions' own response, in the first instance 32 33 34 35 36 Directive 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union. COM(2017) 476. Cybersecurity in the European Digital Single Market, High level group of Scientific Advisors, March 2017. A specific issue concerns trade secrets, where the July 2016 Communication "Strengthening Europe's Cyber Resilience System" noted the reticence to report the cyber theft of trade secrets and the importance of trusted reporting channels ensuring confidentiality. https://www.easa.europa.eu/newsroom-and-events/news/implementation-european-centre-cyber-securityaviationeccsa. These are non-profit, member-driven organisations formed by private and public entities to share information on cyber threats, risks, prevention, mitigation and response. See e.g. the European Energy Information Sharing and Analysis Centres (http://www.ee-isac.eu). 7