Loading story…
ENISA has published a draft European cybersecurity certification scheme for Managed Security Services called EUMSS, following a request from the European Commission. The proposal is designed to reduce fragmentation across EU member states by creating common baseline and service-specific requirements for outsourced security providers, with the current draft focused on the Incident Management Lifecycle and specifically the Incident Response service profile.
ENISA said the scheme is intended to strengthen trust in managed security services and support the EU’s broader cyber resilience framework, including the EU Cybersecurity Reserve. Providers participating in that reserve will be required to obtain EUMSS certification within two years after the scheme takes effect, and the draft has been opened for public consultation through 13 September 2026. The scheme was developed with support from an ENISA Ad Hoc Working Group established under Article 48(1) of the Cybersecurity Act, and ENISA has also published dedicated certification materials through its EU certification portal.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
ENISA established an Ad Hoc Working Group on Managed Security Services Certification to support preparation of the candidate European cybersecurity certification scheme for Managed Security Services (EUMSS). The working group began its work in October 2025.
ENISA published the first draft candidate European cybersecurity certification scheme for Managed Security Services, called EUMSS, prepared at the request of the European Commission. At the same time, ENISA opened a public consultation on the draft scheme.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ETSI has launched the approval process for **17 draft European cybersecurity standards** intended to support implementation of the EU Cyber Resilience Act (CRA), expanding the compliance framework that will apply to commercial hardware and software sold in the EU. The drafts cover major product categories including network and edge devices, security products, and IoT appliances, and are designed to translate the CRA’s legal requirements into technical controls manufacturers and other suppliers can implement. The proposed standards call for baseline measures such as **modern cryptography**, **secure-by-default configurations**, **software bills of materials (SBOMs)**, and the ability to deliver security updates after sale. The drafts have entered public enquiry through late 2026, with final versions expected by December 2026 ahead of the CRA’s full application in December 2027; the resulting obligations are expected to affect manufacturers, importers, distributors, service providers, and developers placing connected products on the EU market.
Aug 18, 2026
The European Union Agency for Cybersecurity (ENISA) has been elevated to a "Root"-level participant in the Common Vulnerabilities and Exposures (CVE) program, granting it the authority to assign CVE identifiers and publish CVE records. This new role positions ENISA as a central coordinator for vulnerability disclosures across the European Union, aiming to reduce fragmentation, strengthen cross-border coordination, and accelerate responsible disclosure processes. ENISA will also serve as a primary contact point for vulnerabilities reported by or to the European Union Computer Security Incident Response Teams (CSIRTs). This development is part of broader EU efforts to enhance cybersecurity, including the launch of the European Union Vulnerability Database as a counterpart to the U.S. National Vulnerability Database. ENISA is also developing a "Single Reporting Platform" for manufacturers to disclose actively exploited vulnerabilities, a requirement that will become mandatory under the Cyber Resilience Act starting in 2026. These initiatives are expected to improve the EU's ability to manage and coordinate cybersecurity vulnerabilities and bolster digital security across the union.
Jun 29, 2026
The European Commission unveiled a revised **EU Cybersecurity Act** proposal that would allow the bloc to identify and potentially exclude **“high-risk” suppliers**—including those deemed vulnerable to *third-country influence*—from critical digital infrastructure across **18 essential sectors**. The proposal also aims to streamline and accelerate EU-wide cybersecurity certification, reflecting a shift toward treating supply-chain security as both a technical and **geopolitical** risk-management issue. Reporting highlighted that the proposal, while not naming countries, is widely viewed as targeting Chinese vendors and supply dependencies—particularly around **network equipment** and connected energy technologies such as **solar inverters** that may connect to cloud services and create potential access paths into the energy grid. Separate coverage of the same Commission initiative noted plans to expand **ENISA’s** mandate, including closer operational cooperation with national authorities to help counter threats such as **ransomware**, but emphasized that the proposal still requires negotiation and approval by the European Parliament and member states before it can take effect.
Jun 29, 2026