ENISA to Operate EU Cybersecurity Reserve With €36 Million Budget — But Is It Enough?

Editor’s Note: This article examines the European Union’s decision to entrust ENISA with managing the €36 million EU Cybersecurity Reserve, created under the Cyber Solidarity Act, which entered into force on February 4, 2025. The Reserve represents a new model for incident response across Member States, EU institutions, and associated partners, relying on managed security service providers to deliver crisis support.

For cybersecurity, information governance, and eDiscovery professionals, the development highlights the EU’s increasing focus on coordinated defense and certification-based trust mechanisms. Yet concerns remain about the adequacy of resources, the balance between centralization and national agility, and the potential regulatory burden on service providers. By situating the Reserve against past cyber incidents like NotPetya and placing ENISA’s new mandate within the context of EU governance debates, this article provides professionals with insight into both the opportunities and limitations of Europe’s collective defense approach. The Reserve is an important step toward shared resilience, but whether it can meet the scale of future threats will depend on funding, independence, and trust across stakeholders.

Industry News – Cybersecurity Beat

ENISA to Operate EU Cybersecurity Reserve With €36 Million Budget — But Is It Enough?

ComplexDiscovery Staff

Europe is moving to strengthen its cyber resilience with the launch of a €36 million EU Cybersecurity Reserve, to be managed by ENISA under the recently enacted Cyber Solidarity Act. The initiative marks a new phase in the EU’s efforts to centralize and coordinate large-scale cyber incident response. But as questions surface over resources, coordination, and regulation, the debate is intensifying about whether this new model can truly meet the scale of today’s threats.

The Cyber Solidarity Act, which entered into force on February 4, 2025, created the legal framework for the Reserve as part of the Digital Europe Programme for 2025–2027. The €36 million allocation is earmarked for procuring and managing incident response services from trusted managed security service providers. These services will be made available to Member States, EU institutions, agencies, and third countries associated with the Digital Europe Programme when they face major cyber incidents. According to ENISA, the Reserve is expected to be fully operational by the end of 2025, providing a structured, pre-contracted capacity to support governments and institutions under pressure.

The Commission entrusted ENISA with operating the Reserve through a contribution agreement, leveraging the agency’s experience with the Cybersecurity Support Action, situational awareness systems, and reporting frameworks. But even as ENISA’s responsibilities expand, questions remain about whether it has been given the resources to meet its new mandate. In late 2024, national governments formally urged Brussels to provide “adequate resources – human, financial and technical – in order to fully enable the agency” to carry out its growing mission. The EU Council, in its December 2024 conclusions, welcomed ENISA’s enhanced role but stressed the importance of “prioritization of tasks and resources” and improved collaboration with national and European cyber entities to avoid duplication and bureaucratic delays.

One of the Reserve’s defining features is its reliance on managed security service providers. ENISA is developing a European certification scheme to standardize and verify the quality of these services, with a focus on incident response. Under the current plan, any MSSPs contracted for the Reserve will need to secure certification within two years of the scheme being enacted. The certification framework is intended to build trust and ensure reliability, but industry groups are voicing concern that overlapping rules and redundant certifications could slow innovation and place disproportionate burdens on smaller firms. DIGITALEUROPE has argued that certification should remain voluntary except in high-risk cases, warning that too rigid a framework could shrink the pool of eligible providers just when speed and flexibility are most needed.

Another sensitive issue is the independence of ENISA itself. Telecom operators and trade associations have urged the EU to safeguard ENISA from political pressure, arguing that its cybersecurity assessments and certification decisions must remain technically grounded. As one recent industry appeal put it, the agency’s credibility will depend on its ability to act independently of shifting political priorities while maintaining strong cooperation with Member States.

The scale of the funding also raises questions. The €36 million budget, spread over three years, averages €12 million annually—an investment that looks modest when compared with the costs of real-world cyber disasters. The 2017 NotPetya attack alone caused an estimated $10 billion in global damages, crippling global logistics and affecting major European firms such as Maersk, which reported losses in the hundreds of millions. Against this backdrop, the Reserve’s funding seems more symbolic than structural, raising concerns that its resources may be rapidly outstripped in the event of a major EU-wide incident.

At the same time, the Reserve comes at a critical transition point. Its activation in late 2025 is expected to overlap with the conclusion of ENISA’s Cybersecurity Support Action in 2026, creating continuity between older frameworks and the new centralized mechanism. Yet this timing also puts pressure on ENISA to demonstrate that a central EU-operated reserve can deliver meaningful crisis response faster than national teams already embedded in Member States.

For Brussels, the Reserve is an important political signal that the EU is taking steps toward collective defense in cyberspace. But experts caution that symbolic measures are not enough. Without additional investment, streamlined regulatory frameworks, and stronger guarantees of ENISA’s independence, the Reserve may risk falling short of its ambitions. The coming years will test whether this model of central coordination can withstand the speed and severity of Europe’s next major cyberattack—or whether the €36 million Reserve becomes another example of EU institutions outpaced by the scale of the threat.

News Sources

• ENISA to operate the EU Cybersecurity Reserve with EUR 36 million (ENISA)
• EU Cybersecurity Reserve (ENISA)
• The Untold Story of NotPetya, the Most Devastating Cyberattack in History (WIRED)
• DIGITALEUROPE, Updating the EU cybersecurity framework: Industry priorities for the Cybersecurity Act revision, June 20, 2025 .

Assisted by GAI and LLM Technologies

Additional Reading

• When Legal Privilege Isn’t Enough: Cyber Threats Escalate in the Legal Industry
• From Castle Rock to Cybersecurity: Edinburgh Insights for ILTACON 2025
• Stonehenge: Ancient Order, Modern Insight
• A Walk Through History: The Churchill War Rooms and the Power of Resilience
• The Architecture of Isolation: Cold War Cities and Corporate Silos
• Castles, Borders, and the Battle for Cyberspace

Source: ComplexDiscovery