EU cybersecurity governance – stakeholders and normative intentions towards integration

In the last decade, the EU’s policy on cybersecurity has changed significantly, both as \nto its referent objects and priority level. While the 2013 Cybersecurity Strategy focused \nalmost exclusively on the importance of cybersecurity for the proper functioning \nof the single market, its 2017 version also contained an analysis of malicious cyber \nactivities that threaten the political integrity of Member States and the EU as a whole. \nAs the field’s level of complexity grows and forward-looking initiatives are constantly \nbeing proposed in order to promote cyber resilience across the EU, it is increasingly \nchallenging the Union in the process of coordinating and implementing the planned \nactions. \nCybersecurity has also become a national security issue entangling private and \npublic, external and internal, civilian, and military issues making it necessary, \nbut very challenging to widen and deepen ties among stakeholders in the EU. Yet \ncybersecurity governance is fragmented at the EU level, and there is an evident lack \nof trust that prevents effective cooperation among stakeholders on crucial aspects of \nthe process. This contribution argues that as a result, cybersecurity policy in the EU \nremains unsystematic and predominantly reactive in nature, addressing the issuespecific \nincidents that have already occurred, although in our technology-dependent \nsocieties more emphasis should be placed on prevention. Therefore, in a natural \nscholarly quest for explanations, this chapter focuses on the development and \nmain elements of the EU’s cybersecurity policy, followed by mapping the attitudes \nof cybersecurity stakeholders and their normative objectives in the context of EU \nintegration in this domain.