The European Union Agency for Cybersecurity (ENISA) has launched a public consultation on a draft candidate EU Digital (EUDI) Wallet certification scheme. The consultation seeks to validate the key principles and overall structure of the proposed scheme, while gathering feedback on its elements and annexes. This initiative follows a request from the European Commission for ENISA to support the certification of EUDI Wallets, including the development of a candidate European cybersecurity certification scheme under Regulation (EU) 2019/881, the EU Cybersecurity Act. ENISA has signed a €1.6 million contribution agreement with the Commission for a two-year period to support the development, roll-out and implementation of national certification schemes. Member States are required to provide at least one certified EUDI Wallet by the end of 2026. ENISA will facilitate this by developing national schemes, strengthening knowledge, capacity and promoting alignment with the European cybersecurity certification scheme. The consultation closes on 30 April 2026.

The European Union Agency for Cybersecurity (ENISA) has introduced a dedicated page featuring a collection of Frequently Asked Questions (FAQ) on the EU Cyber Resilience Act’s Single Reporting Platform (SRP). The FAQs explain, amongst other thing, what the SRP is, who is responsible for it, what must be reported, how the platform operates and the responsibilities of the key entities involved, supporting transparency and implementation of mandatory and voluntary reporting within the EU Digital Single Market. ENISA intends to update FAQ page as the SRP implementation progresses.

The European Union Agency for Cybersecurity (ENISA) has published the ENISA NIS360 2026 report assessing the cybersecurity maturity and criticality of sectors of high criticality under the EU NIS 2 Directive (NIS2). The report finds that cybersecurity maturity across EU critical sectors has steadily improved, with banking, electricity and telecommunications remaining the most mature and critical sectors, while trust services, aviation and financial market infrastructures (FMI)s have moved into the high-maturity band. It attributes this progress to cybersecurity legislation, including the NIS2 and the Digital Operational Resilience Act (DORA), as well as increased political attention, stronger information sharing and collaboration and improved operational preparedness. However, maturity remains uneven across and within sectors, with health, railway, maritime, ICT service management, public administrations, space, drinking water and wastewater remaining in the NIS360 risk zone, where criticality exceeds cybersecurity maturity. The report also identifies artificial intelligence (AI), supply chain and third-party risks and geopolitical volatility as key factors shaping the cybersecurity maturity and resilience of high-criticality sectors.

The European Union Agency for Cybersecurity (ENISA) has published its third annual NIS360 report, which found that cybersecurity maturity across EU critical sectors has improved, while the level of sector criticality has remained largely unchanged. The report identifies health, railway, maritime, ICT management services, space, public administration, drinking water and wastewater as sectors where cybersecurity maturity remains lower than their level of criticality. ENISA says the gas sector has begun moving out of this risk category due to improved information sharing, collaboration and risk management.

The European Union Agency for Cybersecurity (ENISA) has published the ENISA Cybersecurity Exercise Methodology. The methodology sets out an end-to-end framework for the planning, delivery and evaluation of cybersecurity exercises, intended to ensure that appropriate profiles and stakeholders are involved at the relevant stages. The publication incorporates theoretical material based on lessons learned, industry best practice and cybersecurity expertise. It is designed to be used alongside a support toolkit, which includes templates and guidance materials to assist planners in organising effective exercises.

The European Union Agency for Cybersecurity (ENISA) has published a report on engineering personal data protection in EU data spaces. The report has two main sections—section 2 deals with ‘Data Protection Considerations in EU Data Spaces’ and Section 3 deals with ‘Health–Pharmaceutical Use Cases’. Section 3 includes use cases on both the availability of pharmaceutical products in the market, and research and analysis on the efficiency of pharmaceutical products.

The EU Agency for Cybersecurity (ENISA) has published technical guidance to aid in the implementation of the cybersecurity measures stipulated by the Network and Information Security 2 (NIS2) Directive. This directive mandates cybersecurity risk management practices across 18 critical sectors, including energy, transport, health, and digital infrastructure. The guidance addresses the requirements set out in Commission Implementing Regulation 2024/2690, targeting the digital infrastructure and ICT service management sectors.

The European Union Agency for Cybersecurity (ENISA) has published version 2.0 of its national capabilities assessment framework (NCAF), designed to support EU Member States in assessing the maturity of their national cybersecurity strategies (NCSSs) in line with the evolving threat landscape and EU legislation, including the EU Network and Information Security Directive 2 (NIS2). The framework enables Member States to carry out a voluntary self-assessment of cybersecurity capabilities at both the strategic and operational levels, using a five-level maturity model ranging from foundation to advanced, across 20 strategic objectives grouped into capacity-building and awareness, cooperation and collaboration, cybersecurity governance, and regulatory and policy frameworks. The framework sets out a structured methodology, including indicators and a scoring mechanism based on maturity levels and coverage ratios, to help identify gaps, support capability building and track progress over time. It is intended to support long-term strategic planning, preparation for NIS2 peer reviews and transparency.

The European Union Agency for Cybersecurity (ENISA) has published a report examining the impact of the Directive (EU) 2022/2555 on cybersecurity investments and organisational maturity (the NIS 2 Directive). The report reveals a significant increase in information security spending, with 9% of EU IT investments now allocated to this area. ENISA found that 89% of organisations anticipate needing additional cybersecurity staff to comply with the NIS 2 Directive, while 90% expect an increase in cyberattacks in 2025. The report also highlights that entities in sectors already covered by Directive (EU) 2016/1148 (the original NIS Directive) demonstrate higher cybersecurity performance compared to newly included sectors under the NIS 2 Directive.

The European Union Agency for Cybersecurity (ENISA) has called for feedback on its draft technical guidance for the cybersecurity measures set out in Commission Implementing Regulation (EU) 2024/2690 (the Network and Information Systems 2 (NIS 2) Implementing Act). The NIS2 Implementing Act sets out technical and methodological requirements for cybersecurity management, with ENISA’s draft guidance offering advice, tips, examples of evidence, and tables to assist in assessing and implementing these requirements. The deadline for submitting feedback is 9 December 2024.

Law360, London: A London judge ordered Serious Fraud Office (SFO) investigator Antony Puddick on 8 April 2026 to disclose details of his solicitors' retainer agreement in a £1.8 million costs dispute with Eurasian Natural Resources Corp (ENRC) following the end of their legaldispute.

Law360, London: The Serious Fraud Office's (SFO) decade-long criminal and civil legal battles with Eurasian Natural Resources Corp (ENRC) have cost the crime-fighting agency more than £28m, with the true financial brunt of its ill-fated probe still to be revealed.