The EU and Ukraine launch CERT-EU–CERT-UA information exchange to prevent and manage cyber incidents

CERT-EU and the Ukrainian SSSCIP service have signed an administrative arrangement aimed at opening information exchange between the European incident response team and CERT-UA. The Commission says the mechanism is intended to strengthen the prevention, detection and containment of cyber incidents on both sides. The document is not a treaty and does not mean the integration of European and Ukrainian cybersecurity systems.

The European Union and Ukraine are moving to a more operational level of cyber cooperation through an administrative arrangement signed by CERT-EU and the State Service of Special Communications and Information Protection of Ukraine, SSSCIP. The agreement, concluded during the fifth EU-Ukraine Cyber Dialogue on 9 October and announced by the Commission on 13 October, aims to initiate information exchange between CERT-EU and CERT-UA for the prevention, detection and containment of cyber incidents.

In brief

Representatives of CERT-EU and SSSCIP signed an administrative arrangement in Brussels during the fifth EU-Ukraine Cyber Dialogue.

The stated objective is to open information exchange between CERT-EU and CERT-UA and strengthen the two sides’ ability to prevent, detect and contain cyber incidents.

CERT-EU protects EU institutions, bodies, offices and agencies, while CERT-UA is Ukraine’s cyber incident response team within SSSCIP.

The dialogue also covered Ukraine’s alignment with NIS2 and the Cyber Resilience Act, 5G security, crisis management, combating cybercrime, the Cyber Diplomacy Toolbox and cooperation through the Tallinn Mechanism.

The Commission has not published the text of the arrangement and does not specify the exact categories of information that may be exchanged, the duration of the mechanism or the specific safeguards applicable to data exchange.

The arrangement brings together two structures with different roles. CERT-EU is the Union’s interinstitutional cybersecurity service and helps more than 90 European institutions, bodies, offices and agencies prevent, detect, manage and contain incidents. The service also functions as an information exchange and response coordination point for the EU’s institutional ecosystem.

CERT-UA is Ukraine’s national team for responding to cyber incidents, attacks and threats and operates within SSSCIP. Ukraine has accumulated extensive operational experience during the war, including in identifying campaigns targeting public institutions, infrastructure and other targets and in coordinating responses to attacks.

The Commission describes the new arrangement as a mechanism for “initiating information exchange” between the two teams. The announced aim is to increase both sides’ ability to prevent, detect and contain incidents in the infrastructures for which they are responsible. The wording is important: cooperation is not presented solely as European assistance for Ukraine, since Ukrainian operational experience and information may also contribute to the defense of European institutions.

The new mechanism continues cooperation that began before this agreement. In 2023, the European Union Agency for Cybersecurity, ENISA, signed a working arrangement with Ukraine’s National Cybersecurity Coordination Center and SSSCIP. It covers capacity building, the exchange of best practices and improved shared awareness of threats.

The difference is that the agreement now announced places CERT-EU and CERT-UA, two structures directly involved in preventing and managing incidents, at the center of cooperation. It thus complements the broader relationship between ENISA and the Ukrainian authorities with a channel intended for the teams actually working on threats and incidents.

However, the Commission has not published the text of the administrative arrangement. The announcement does not specify what categories of data may be exchanged, whether the mechanism includes technical indicators of compromise, information about vulnerabilities, data on attackers or other types of operational information, nor what classifications or distribution restrictions will apply.

Nor are the duration of the arrangement, procedures for urgent exchanges or specific safeguards for any personal data or sensitive information specified. These elements are important before the mechanism can be described more precisely than the Commission’s public communication allows.

CERT-EU operates under the 2023 European regulation on the cybersecurity of EU institutions and bodies. Its responsibilities include exchanging information on threats, vulnerabilities and incidents and coordinating responses within the European institutional ecosystem. The new arrangement with Ukraine does not change this institutional division and does not turn CERT-UA into a component of CERT-EU.

The two systems are therefore not integrated into a single infrastructure. The announcement does not say that Ukrainian authorities receive direct access to the networks of EU institutions or that CERT-EU gains access to Ukrainian government systems. What is confirmed is the creation of a framework for information exchange and cooperation between the two services.

The October dialogue also had a legislative component. The EU and Ukraine reviewed the progress of Ukrainian reforms and alignment with important pillars of European cybersecurity legislation, including the NIS2 Directive and the Cyber Resilience Act.

This alignment must be distinguished from the automatic application of EU law. Ukraine is a candidate country, and harmonizing its legislation with European standards forms part of the integration process. Discussions on NIS2 and the Cyber Resilience Act do not mean that all the obligations of these acts already apply to Ukraine in the same way as they apply to a member state.

Participants also discussed the implementation of the EU 5G Cybersecurity Toolbox in Ukraine. The security of telecommunications networks is treated by both sides as both a cyber resilience issue and a necessary element of closer economic and institutional ties with the EU.

Operational cooperation does not stop at CERTs. The dialogue covered cyber crisis management, cyber defense and the use of the Cyber Diplomacy Toolbox, the instrument through which the EU can combine diplomatic and, in certain situations, restrictive measures against malicious cyber activities.

Combating cybercrime, investigations, developments concerning the European Cybersecurity Reserve and support for Ukraine through the Tallinn Mechanism were also discussed. However, mentioning the Reserve in the dialogue does not mean that the new CERT-EU–CERT-UA arrangement automatically grants Ukraine access to this instrument.

Another component is the existing cooperation between ENISA and the Ukrainian authorities. The Commission describes this relationship as extensive and says that the two sides want to turn cyber cooperation into concrete operational results. The new arrangement between CERT-EU and SSSCIP is presented as one of these results.

The discussions also included partnerships between the public sector and the cybersecurity industry. For Ukraine, the experience accumulated in wartime conditions can be used to test procedures and understand the methods used by state actors. For the EU, the exchange may contribute to the faster identification of campaigns targeting Ukraine and European organizations simultaneously.

The fifth Cyber Dialogue was co-chaired, on the European side, by Despina Spanou, Deputy Director-General in DG CONNECT, Christiane Kirketerp de Viron, Acting Director for Cybersecurity and Trust, and Maciej Stadejek, Director for Security and Defense Policy at the European External Action Service. The Ukrainian delegation was led by Andrii Droniuk, Deputy Minister of Foreign Affairs.

ENISA, Europol, the European Security and Defence College and EUAM Ukraine also took part in the discussions, together with Ukrainian ministries, security services, and military and intelligence structures. EU member states participated as observers.

The next stage is to operationalize the arrangement. To assess its real scope, the types of information that will circulate between CERT-EU and CERT-UA, exchange procedures, limits on data use and protection, and how cooperation will operate in the event of incidents simultaneously affecting European and Ukrainian infrastructures must be clarified.

https://2eu.brussels/ro/news/ue-si-ucraina-deschid-schimbul-cert-eu-cert-ua-pentru-prevenirea-si-gestionarea-incidentelor-cibernetice