As cybersecurity challenges increase, the cyberattack surface continues to expand. This calls for better and clearer cooperation, which led to the revision of the EU Cyber Blueprint. The new Blueprint for cyber crisis management, adopted in June 2025, aims to strengthen the mechanisms supporting the response to large-scale cybersecurity incidents and crises in the EU by clarifying roles, responsibilities and coordination arrangements across the technical, operational and political levels.
In line with the Blueprint, ENISA specifically contributes to preparedness, operational coordination, common situational awareness and support to decision-making. ENISA is therefore a key enabler of effective cyber crisis management given the roles and responsibilities of ENISA established by the new Blueprint.
ENISA tested the coordinated crisis management procedures across technical, operational and political levels, including aspects relevant to the operational deployment of the EU Cybersecurity Reserve during the 2026 edition of Cyber Europe. The EU Cybersecurity Reserve itself is established under the Cyber Solidarity Act, while the Blueprint provides the broader crisis management framework within which such capabilities may be mobilised and coordinated.
Within its policy remit, ENISA has been supporting European cyber incident and crisis management for several years, by also providing support for the daily operations of the CSIRTs Network and of EU-CyCLONe, crisis simulation exercises, training, and assistance to Member States in developing their crisis plans and structures.
As an active actor in the context of the EU-coordinated response to cybersecurity incidents and crises, ENISA assists the Union whenever required, notably within the framework of the Integrated Political Crisis Response (IPCR) arrangements.
ENISA works closely with Member States to develop EU-level cyber crisis management procedures, helping to improve situational awareness in the event of cross-border cyber incidents. The Agency also assists both national and European decision-makers in taking the most appropriate decisions. This reflects the emphasis made in the Blueprint on structured interaction between the technical level, the operational level and political decision-making channels.
- enabling the operations of the EU CSIRTs Network and EU-CyCLONe by providing the Secretariat team, resources and expertise;
- providing the IT infrastructure and tools that allow ENISA stakeholders, in particular the CSIRTs Network and EU-CyCLONe, to securely exchange information on incidents and ongoing threats;
- contributing to the drafting and establishment of operational procedures to prepare for and respond to large-scale cross-border incidents and crises at Union level;
- designing and delivering tailored exercises and training to support the testing of procedures at European and national level in the field of cyber crisis management;
- contributing to Union-wide situational awareness based on ENISA’s monitoring, as well as through ENISA’s Cyber Partnership Programme, by sharing accurate and timely information on ongoing incidents and threats and producing regular in-depth technical reports in line with Article 7(6) of the CSA;
- contributing to EU-level common situational awareness by providing relevant and timely information to the EEAS, the Horizontal Working Party on Cyber Issues (HWPCI), and other relevant EU stakeholders;
- supporting, where relevant, the operationalisation and use of capabilities available to Member States under the wider EU cyber crisis management framework, including incident response services from trusted managed security services providers;
- supporting the cooperation and information flows foreseen in the Blueprint between the technical community, the operational community and the political level, including where relevant in the context of IPCR arrangements;
- contributing to preparedness for coordinated public communication and, where appropriate, to cooperation with relevant strategic partners in line with the Blueprint.
ENISA’s activities provide guidance to the cybersecurity bodies of EU Member States on crisis management, situational awareness, coordination and political decision-making capacities. The Agency serves as an information hub and facilitates cooperation and coordination among the CSIRTs Network, EU-CyCLONe and all other relevant EU institutions, bodies and agencies, such as CERT-EU, the EEAS and Europol, in times of large-scale incidents and crises. Areas of effort include:
- preparedness and incident-response capabilities;
- the maturity and capabilities of operational communities, including cooperation with law enforcement;
- coordinated response and recovery in relation to large-scale cyber incidents and crises across different communities;
- the evolution of the EU joint response through support for the development, coordination and deployment of EU-level measures and proposals.
