ENISA (EU Agency for Cybersecurity)

ENISA stands for the European Union Agency for Cybersecurity. The abbreviation comes from its original name, the European Network and Information Security Agency, and the agency kept it when the 2019 Cybersecurity Act renamed it, made it permanent and broadened its mandate. It was set up in 2004. It does three things. It helps the Commission and member states shape cybersecurity policy, publishes technical frameworks that regulated entities follow, and prepares EU certification schemes, including EUCS for cloud services, still not adopted in 2026. It has no enforcement power. National authorities (ANSSI in France) supervise and sanction; ENISA equips and coordinates. People often mix it up with those authorities, or with a European CERT, but it does not respond to company incidents. Under NIS2, its most useful document is the June 2025 technical guidance on Implementing Regulation (EU) 2024/2690, which spells out Article 21 for digital infrastructure and digital providers. It maps each obligation to existing standards, starting with ISO 27001, so an entity can lean on a certification it already holds to show compliance. On the threat side, its annual report, the ETL, ranks the attack types seen in Europe (ransomware, denial of service, social engineering). It is usually what a search for "ENISA cyber threats" is after. For an insurer these frameworks do two jobs. They set the expected level, and they give a common yardstick for judging insureds' security from one European country to the next. Cyber underwriters quote the ETL in market notes to back a frequency assumption, and rarely for more.