Peer Reviews

The concept of Peer Reviews

The peer review mechanism, as established under Article 59 of the Cybersecurity Act, requires mandatory peer reviews between all NCCAs (national cybersecurity certification authorities) across the EU. The main goal is to make sure that all EU Member States follow equivalent and reliable procedures when it comes to EU cybersecurity certification of ICT products, ICT services and ICT processes and managed security services. This helps create trust and promotes mutual recognition and the overall acceptance of European cybersecurity certificates and EU statements of conformity, no matter which EU country they come from.

Peer reviews check if the NCCAs: separate certification activities from supervisory responsibilities, so that assessments are independent; properly supervise and monitor the compliance of ICT products, ICT services and ICT processes and managed security services with European cybersecurity certificates; efficiently monitor and enforce the obligations of manufacturers or providers that claim their ICT products, ICT services or ICT processes are secure; monitor, authorise and supervise the activities of the conformity assessment bodies.

Implementing Act for Peer Reviews

The Implementing Regulation on peer reviews was adopted and subsequently published in the Official Journal of the European Union on the 12th of December. 

Full text available here 

Complementing the provisions of Article 59 of the Cybersecurity Act (CSA), the Implementing Regulation sets out the planning and implementation details of the peer review mechanism for NCCAs, including the composition of the peer review team, the methodology to be used in peer review, the schedule and the frequency and other tasks related to it.

Presentation of the planning

According to the planned five-year peer review schedule, six peer reviews will be conducted annually, covering six Member States (NCCAs) each year from 2026 to 2030, and every five years thereafter. In total, thirty peer reviews will take place over this period, encompassing all 27 Member States as well as 3 EEA/EFTA members. 

A rotation system ensures that each authority is reviewed at least once within the five-year period, while all NCCAs need to participate as peer-reviewers of at least two NCCAs during the five-year period. 

ENISA is responsible for publishing the schedule of the peer reviews, including both the peer-reviewed NCCAs per each year, as well as their corresponding peer-reviewer NCCAs (see table below).