EU Cybersecurity Certification Scheme Changes Open Doors for Tech Giants

Key Takeaways

• The EU has eased sovereignty requirements for cybersecurity certification, opening up bids for EU cloud computing contracts to non-EU companies.
• Tech giants like Amazon, Google, and Microsoft can now bid for EU cloud computing contracts despite facing antitrust investigations in multiple countries.
• The draft cybersecurity labelling rules have dropped the requirement for vendors to be independent from non-EU laws, making it easier for non-EU companies to enter the EU market.
• The focus has shifted to concerns over potential illegal surveillance and the dominance of US cloud companies over emerging EU competitors in the cybersecurity landscape.
• With the recent changes, cloud vendors are now only required to disclose information about the location of data storage and processing.

News Content

The EU has made changes to its cybersecurity certification scheme, dropping its sovereignty requirements. This move will make it easier for non-EU companies, including tech giants like Amazon, Google, and Microsoft, to bid for EU cloud computing contracts despite facing antitrust investigations. The new draft cybersecurity labelling rules have removed the requirement for vendors to be independent from non-EU laws, which previously hindered their abilities in cloud computing.

The scheme aimed to assist governments and companies within the EU in selecting secure and trustworthy vendors, but the move is seen as a shift in interest toward lucrative government deals by tech giants. However, the EU remains concerned about potential illegal surveillance and the dominance of US cloud companies, especially in light of recent antitrust cases. As a result of the changes, cloud vendors are now only required to disclose information about the location of data storage and processing, a significant shift from the previous requirements.

The EU's decision to drop sovereignty requirements for its cybersecurity certification scheme has implications for non-EU companies, particularly tech giants, as it opens up opportunities for them to bid for EU cloud computing contracts. This change reflects a shift in focus towards lucrative government deals by tech giants and aims to address concerns about illegal surveillance and the dominance of US cloud companies, as well as simplify the requirements for cloud vendors. These developments mark a significant shift in the cybersecurity certification landscape and could have broader implications for the industry.

Analysis

The EU's decision to drop sovereignty requirements in its cybersecurity certification scheme allows non-EU tech giants like Amazon, Google, and Microsoft to bid for lucrative EU cloud computing contracts, despite facing antitrust investigations. This shift reflects a focus on government deals by tech giants and aims to address concerns about illegal surveillance and the dominance of US cloud companies. In the short term, this could lead to more competition in the EU cloud computing market. However, in the long term, it might raise issues related to potential surveillance and market dominance. This change signifies a significant shift in the cybersecurity certification landscape and may have broader implications for the industry.

Do You Know?

• EU Cybersecurity Certification Scheme Changes: The EU has made changes to its cybersecurity certification scheme, removing sovereignty requirements to make it easier for non-EU companies, including tech giants, to bid for EU cloud computing contracts. This reflects a shift in focus towards lucrative government deals by tech giants and aims to address concerns about illegal surveillance and the dominance of US cloud companies. The move also simplifies the requirements for cloud vendors, marking a significant shift in the cybersecurity certification landscape.

• Implications for Non-EU Companies and Tech Giants: The decision to drop sovereignty requirements has implications for non-EU companies, particularly tech giants like Amazon, Google, and Microsoft, as it opens up opportunities for them to bid for EU cloud computing contracts. This change reflects a shift in focus towards lucrative government deals by tech giants and aims to address concerns about illegal surveillance and the dominance of US cloud companies, as well as simplify the requirements for cloud vendors.

• Disclosure of Data Storage and Processing Locations: As a result of the changes, cloud vendors are now only required to disclose information about the location of data storage and processing, marking a significant shift from the previous requirements. This change has implications for vendors seeking to do business with the EU and reflects a broader shift in the cybersecurity certification landscape.