A Toolbox to improve ICT supply chain security

The NIS Cooperation Group composed of EU Member States representatives, the European Commission and the EU Agency for cybersecurity (ENISA), has adopted an EU ICT Supply Chain Security Toolbox.

The toolbox will help Member States and public and private actors to bolster the security of ICT supply chains in the EU as set out in the revised Cybersecurity Act presented on 20 January 2026.

Practical outcomes of the Toolbox

• it provides a common approach on how to identify, assess and mitigate cybersecurity risks of ICT supply chains;
• it outlines risk scenarios and recommends mitigation measures, including overcoming the dependencies on high-risk suppliers;
• it is accompanied by two risks assessments on connected and automated vehicles and detection equipment. These two reports provide a comprehensive overview of the cybersecurity risks identified, their potential consequences, and the mitigating measures considered necessary to address them. 

More information here.