Tracking the EU's Cybersecurity Evolution: Four Key Takeaways From CSA2
ISACA, Monday, October 12th, 2026
ISACA outlines what the EU's proposed Cybersecurity Act 2 changes for ENISA, certification, skills and ICT supply chains.
The European Commission's proposed Cybersecurity Act 2 is the most significant revision of EU cybersecurity legislation to date, building on a framework that already includes NIS2, DORA, the Cyber Resilience Act and the Cyber Solidarity Act.
CSA2 revises ENISA's mandate, the European Cybersecurity Certification Framework and the European Cybersecurity Skills Framework, and introduces a new framework for ICT supply-chain security.
Parliament's ITRE committee expects a vote in February 2027, while member states aim for a general approach by the end of 2026.
ISACA summarizes four takeaways from its engagement with policymakers on the proposal.