EuroISPA Contribution to the proposal on CSA 2.0. and the Directive on Simplification Measures and Alignment with the Cybersecurity Act

EuroISPA welcomes the European Commission’s proposals for a revised CybersecurityAct (CSA 2.0) and the accompanying NIS2 Simplification Directive as meaningful steps towards a stronger European cybersecurity framework.

At the same time, we believe further work is needed. Our key priorities:

• Certification schemes must remain strictly technical
• Reporting obligations must be harmonised across NIS2, CRA, GDPR and DORA, with a single audit principle
• Supply chain risk assessments must be objective and evidence-based
• Mandatory ICT asset phase-out must remain proportionate and economically sustainable manner
• NIS2 simplification measures are essential to support SME and mid-cap operators and preserve competition
• Internally developed tools not placed on the market should be exempted from certification requirements
• Open source communities, SMEs, and independent developers must be recognised as key contributors to Europe’s cyber resilience

A secure and competitive European digital ecosystem requires a framework grounded in technical evidence, operational feasibility, and proportionality. We look forward to engaging with co-legislators on these important EU policy issues.