In 2022 ENISA developed a new version of the ENISA Cybersecurity Market Analysis Framework (ECSMAF) Version 2.0 (V2.0), published in March 2023. ECSMAF V2.0 is an evolution of the 2021 ECSMAF Version 1.0 (V1.0) with the lessons learned from the pilots, i.e. the EU Cybersecurity Market Analysis focused IoT in Distribution Grids and the Cloud Cybersecurity Market Analysis, as well as with the contribution of the ENISA Ad Hoc Working Group (AHWG) on EU Cybersecurity Market.
By using the ECSMAF V2.0 as guidance, and with the support of the ENISA AHWG on EU Cybersecurity Market, in 2023 ENISA is conducting a cybersecurity market analysis focusing on cryptographic products and services. This work will have as result a publicly available, anonymised cryptographic products and services cybersecurity market report. ENISA is collecting data for this analysis inter alia via a survey that will be launched in the upcoming weeks.
As initial step towards the preparation of the survey, ENISA is compiling a list of potential respondents willing to engage in the survey. When registered, ENISA will send them a message to the survey tool used.
The deadline to submit the expression of interest form is 31 August 2023, but the sooner you indicate your interest the better is for the planning, especially if you wish to have assistance with the compilation of the survey. The deadline to complete the survey is 8 October 2023.
The ENISA survey consists of four questionnaires, addressed to the foreseen stakeholder types: demand-side (i.e., users of cryptographic products and services), supply-side (i.e., suppliers, integrators and operators of cryptographic products and services), researchers (i.e., members of organisations conducting cryptographic research) and bodies involved in regulatory activities (i.e., competent national regulatory bodies active in the regulatory activities in cryptography).
The compilation of the survey is expected to take for the demand-side respondents around one to one and a half hours, for the supply-side respondents around one and half to two hours. As for research and regulatory bodies stakeholders, answering to the corresponding surveys is calculated with ca. half to one hour.
Survey respondents are expected to have a good overview of the cybersecurity policy of their organisation and be familiar with details of their products, as well as be able to provide basic financial figures of their organisation. Indicative examples of organisational roles for these stakeholder types are:
- Demand-side: IT-architects, cryptography experts, cybersecurity engineers;
- Supply-side: product or service architects, cybersecurity engineers, product or service developers;
- Research organisations: researchers conducting research in the area of cryptography;
- Regulatory bodies: regulator staff responsible for cryptography.
Following corresponding requests issued during the 2022’s survey, in 2023 ENISA offers the possibility of an assisted participation in the survey: interested stakeholders may ask for assistance to fill the survey. This will be provided by means of a team of experts who will be in the position to guide surveyees through the corresponding questionnaires and help them filling the survey. Though the survey (and consequently the collected information) will be anonymous, the activities of employed survey assistants are subject to a signed confidentiality agreement. In this way, ENISA seeks to provide the necessary assurance for anonymity and confidentiality of the entire survey process.
You can express your interest in taking part in the survey and provide your valuable input to the ENISA cybersecurity market analysis focused on cryptographic products and services by filling in the following form, indicating whether an assistance is required. Please note, that if this is the case, the survey assistant will contact you to arrange an appointment.