ENISA’s second State of Cybersecurity in the Union report, published November 10, puts implementation and operational readiness at the center of Europe’s next cybersecurity steps.
The agency assesses the EU’s cyber threat level as substantial. It finds progress across critical sectors, alongside uneven maturity and continuing gaps between strategic plans and execution.
Its policy recommendations emphasize more coherent NIS2 implementation across borders and overlapping legislation. Crisis coordination also needs work: ENISA identifies differences in response capacity and persistent shortcomings in shared situational awareness, including exchanges with the private sector.
Supply-chain dependencies connect these issues. The report calls for security throughout the value chain, while critical infrastructure strategies must address legacy systems and operational continuity.
For EU organizations, the practical implication is to test whether incident contacts, information-sharing arrangements and supplier dependencies are understood before disruption. This is an assessment and policy roadmap; specific compliance duties and deadlines must be checked against applicable legislation.
