ENISA emphasizes the role of public administration and private sector cooperation in building the cybersecurity ecosystem in the Member States and at the EU level. PPP or ISAC mechanisms are complementary actions to legal regulations, such as the so-called NIS Directive, that is the directive on the security of network and information systems. Experience proves that an appropriate level of trust between stakeholders has a direct impact on raising the level of cybersecurity. The regulations alone are not sufficient, e. g. for the exchange of incidents information, well-developed cooperation based on trust is also necessary. What is more: properly operating mechanisms of public-private cooperation allow developing better legal solutions and recommendations in the field of cyber-security.
NASK experts have collected examples of solutions applied in 15 EU countries, both in the form of a public-private partnership (PPP) and in Information Sharing and Analysis Centers (ISAC).They are showcases that can be used by legislators, cross-sectoral organizations and executive authorities in the European Union countries (and not only) to design their own systemic cyber-security solutions. “The examples we have analyzed confirm the very significant importance of the cultural, legal and political circumstances of each Member State. Therefore, when implementing specific solutions it is necessary to take into account that something that works in one country does not necessarily succeed in another. For example, cooperation between the private and public sectors is generally easier and less formal in smaller countries, while the larger ones often require specific legal bases. However, there are challenges common to all. The main focus of the reports was to highlight them and to analyze these factors that make the PPP and the ISAC solutions successful – says Magdalena Wrzosek, the PM of the project at NASK.
According to the analyses, investments in the PPP, open communication between the private and public sectors and stronger involvement of small and medium-sized enterprises in such initiatives are necessary. In addition, as regards Information Sharing and Analysis Centers (ISAC), it is important to create a structure that will motivate the private sector to cooperate, exchange information and provide valuable analysis. Involvement of the public sector is also a key element for a well-functioning ISAC in order to strengthen cooperation between key sectors.