and security incidents. In addition to this, the EECC provides that security measures should, as a minimum, take into account all the relevant aspects of certain elements in areas such as security of networks and facilities, handling of security incidents, business continuity management, monitoring, auditing and testing as well as compliance with international standards 13. Neither the current framework nor the EECC include any provisions directly applicable to the network equipment manufacturers and other service providers in the electronic communications supply chain, since these providers do not fall under their scope. The NIS Directive requires operators of essential services in other fields (energy, finance, healthcare, transport, digital service providers, etc.) to take appropriate security measures and to notify serious incidents to the relevant national authority. The NIS Directive also foresees coordination between Member States in case of cross-border incidents affecting operators in its scope. The Cybersecurity Act, which entered into force in June 2019, creates a framework for European cybersecurity certification schemes for products, processes and services. Once in place, certification schemes will also enable producers to demonstrate that they have included specific security features in the early stages of products' design and users to ascertain the level of security assurance, on an EU-wide basis. The framework provides an essential supporting tool to promote consistent levels of security. It allows for the development of cybersecurity certification schemes to respond to the needs of users of 5G-related equipment and software. 3.1.2 Other relevant EU-level instruments: In the area of trade policy, as of 11 October 2020, the EU’s Foreign Direct Investment (FDI) Screening Regulation 14 will provide an instrument to coordinate detection and address potential security risks related to foreign direct investments into the EU, amongst others, in sensitive areas such as critical technologies and critical infrastructures. Applied to the 5G toolbox, and in order to protect key 5G assets and avoid dependencies, the FDI screening mechanism can provide an important instrument to regularly and better monitor FDI developments into the EU along the 5G value chain. Should specific FDI developments fall under the scope of the Regulation, then these can be addressed and Member States can undertake the appropriate mitigating actions. Furthermore, the EU uses trade defence instruments to re-establish a competitive environment for the EU industry when injured by dumped or subsided imports. Specifically, the European Commission is responsible for investigating allegations of dumping by exporting producers from nonEU countries, or in the case of trade-distorting subsidies. It usually opens an investigation after confidentiality of those networks and services, of stored or transmitted or processed data, or of the related services offered by, or accessible via, those electronic communications networks or services’. 13 Preamble (94): …’as regards security of networks and facilities: physical and environmental security, security of supply, access control to networks and integrity of networks; as regards handling of security incidents: handling procedures, security incident detection capability, security incident reporting and communication; as regards business continuity management: service continuity strategy and contingency plans, disaster recovery capabilities; as regards monitoring, auditing and testing: monitoring and logging policies, exercise contingency plans, network and service testing, security assessments and compliance monitoring; and compliance with international standards.’ 14 Regulation (EU) 2019/452 of 19 March, 2019 establishing a framework for the screening of foreign direct investments into the Union. 7