ESS IT security framework Status and next steps

ESS IT security framework Status and next steps DIME & ITDG Plenary 2 -3 July 2019 Item 10 Alvaro DIEZ SOTO Eurostat A. 1 – IT Governance, Service and Relationship Management European Commission July 3 rd, 2019

• Status certification process • Grants • Next phase Eurostat

Status certification process • Certified (7): BE (NBB), ESTAT, NL, DK, SE, SI, LT • Endorsement requested to ITDG (2): AT, EE • In progress (9): IT, DE, HU, HR, CZ, BG, CY, FI, LT • Planned (9): PT, ES, IE, LU, MT, EL, RO, SK, PL • Not planned (2): UK, FR Eurostat

Status certification process Eurostat

Eurostat

Status certification process • • Planned Q 3 2019: PT, IE, LU, MT, EL, RO, SK, PL Planned Q 4 2019: ES Final report to ESSC 2020 From end of 2019, all countries can start sending micro data in pre-production, only certified countries can receive data Eurostat

Grants • Goal: Support countries improving security and preparing for ESS certification • 2016: DE, EL, HR, IT, LU, LV, NL, PL, SI, SK – Budget 1. 27 M€ • 2017: AT, BG, CY, DK, EE, HR, HU, LT, LU, MT, PL, PT – Budget 1. 4 M€ • 2018: AT, BG, FI, HR, HU, LU, MT, PL, RO, SK – Budget 1. 18 M€ Eurostat

Grants (2) • March 2019 – Launch of 4 th Call for proposals for mono-beneficiary grants • • Deadline for submission 14. 5. 2019 Grants to start Q 3 2019 1. 2 M€ funding budget Status: 6 proposals received, under evaluation Eurostat

Next Phase • Launch call for tender for: • Analysis of current exercise and certification results • Gather opinion and feedback of some certified ESS members • Propose recommendations and models for the process beyond 2019 • Discuss the identified models with ESS members (ITWG, ESS IT Security Task Force, ITDG) and propose options with roadmaps • Deadline for completion of the analysis: end 2019 • Presentation of the suggested option - post-2019 May 2020 ESSC for endorsement Eurostat

One more thing … Workshop on GDPR and MDE exchange • Impact on GDPR on the ESS exchange of microdata • Spain – 25 -26/9/2019 • Focus on security consequences • Audience: Security experts and/or DPOs Eurostat

Thank You Eurostat