European Commission’s Cybersecurity Package Commentary in light of recent sophisticated supply chain attacks

The World Economic Forum analyzes the EU's proposed NIS 2.0 and CER directives, arguing that they should be transitioned into regulations to ensure consistent application across member states. The report emphasizes the need for a 'resilient value chain' rather than just a supply chain, citing the SolarWinds attack as evidence of systemic risk from concentrated service providers. Key recommendations include establishing a global minimum cybersecurity baseline for the energy sector, creating an Energy Sector Cyber-Resilience Profile, and fostering cross-sector collaboration based on models from the financial and aviation industries.

• The World Economic Forum recommends that the proposed NIS 2.0 and CER directives be implemented as regulations instead of directives to prevent fragmented implementation and ensure a consistent approach across all EU member states.
• The SolarWinds attack demonstrated that a highly prevalent service offering with high privileges can create a concentrated source of systemic risk that cannot be managed by individual organizations alone.
• There is a critical need to extend cybersecurity requirements to small and micro enterprises (SMEs) in the energy sector, as they can serve as entry points for cyber attacks that proliferate across the network.
• The report suggests creating an 'Energy Sector Cyber-Resilience Profile' to aggregate global regulatory requirements and map them to frameworks like NIST and ISO, reducing the compliance burden for companies operating in multiple jurisdictions.
• To improve recovery from disruptions, the report proposes establishing collective assistance capabilities, extending the electricity sector's tradition of mutual aid to include cyber-mutual assistance.
• The document argues for a shift from focusing solely on the supply chain to creating a 'resilient value chain' that defines responsibilities across the entire product lifecycle, from design to retirement.

APA

World Economic Forum (2021). European Commission’s Cybersecurity Package Commentary in light of recent sophisticated supply chain attacks. https://www3.weforum.org/docs/WEF_Commentary_in_light_of_recent_sophisticated_supply_chain_attacks_2021.pdf

Chicago

World Economic Forum. European Commission’s Cybersecurity Package Commentary in light of recent sophisticated supply chain attacks. 2021. https://www3.weforum.org/docs/WEF_Commentary_in_light_of_recent_sophisticated_supply_chain_attacks_2021.pdf.

Wikipedia

{{cite report |author=World Economic Forum |title=European Commission’s Cybersecurity Package Commentary in light of recent sophisticated supply chain attacks |date=June 2021 |url=https://www3.weforum.org/docs/WEF_Commentary_in_light_of_recent_sophisticated_supply_chain_attacks_2021.pdf |access-date=23 October 2026 |via=Climate Insights Directory}}

BibTeX

@techreport{worldeconomicforum2021european, author = {{World Economic Forum}}, title = {{European Commission’s Cybersecurity Package Commentary in light of recent sophisticated supply chain attacks}}, institution = {World Economic Forum}, year = {2021}, month = jun, url = {https://www3.weforum.org/docs/WEF_Commentary_in_light_of_recent_sophisticated_supply_chain_attacks_2021.pdf}, urldate = {2026-10-23}, note = {Indexed by Climate Insights Directory} }