The European Commission awarded a multi-million, four-year contract to Capgemini, along with partners Airbus Protect, PwC, and NVISO. This contract, which falls under the Directorate-General for Digital Services (DIGIT), is aimed at expanding the cybersecurity capacity for 71 Institutions, Bodies and Agencies (IBAs) of the EU. The MC17 FREIA framework is divided into 3 lots, each focused on one of the fundamental building blocks of cybersecurity.
The MC17 FREIA framework: Building blocks of cybersecurity
The 3 lots of the MC17 FREIA framework are:
- Incident response and security operations
- Governance and Risk Management
- Training and Technical Skills
During this 4 year period, the consortium is expected to carry out:
- 24/7 cyber incident detection, threat monitoring, and response services
- Governance frameworks and structured approaches to risk assessment
- IBA Staff Empowerment via Training and Skills Transfer
The EU’s evolving cybersecurity policy and compliance
This contract is in line with the European Union’s evolving cybersecurity policy, as it helps to comply with key regulations:
- NIS2 Directive: Enhancing cybersecurity in critical infrastructure
- Digital Operational Resilience Act (DORA): Improved ICT resilience in the financial sector
- EU Cybersecurity Act: Introduction of cyber certification
- Upcoming Cyber Resilience Act: Critical digital assets
With these key contracts in place, the contract demonstrates the EU’s objectives of digital sovereignty, primarily self-sustaining in the supply of cybersecurity services.
Sectors benefiting from the contract
From the Aviation and Intelligence sector, Airbus Protect adds cybersecurity, in particular, threat detection and incident management.
In Governance and Risk Management, PwC brings expertise in the execution of risk assessment and policy frameworks.
Partners working together to fight cyber attacks
NVISO, a cyber intelligence in Europe, specializes in threat intelligence and incident response in real time.
All partners together possess the knowledge, skills, and abilities required to address the strategic, technical, and operational scope of these challenges.
The number of cyberattacks perpetrated against public sector entities has increased significantly. The EU recently stated that about 20% of cyberattacks focus on these entities, justifying the implementation of the site-wide defense strategy.
The purpose of the contract awarded to the Commission is to implement:
- A unified central headquarters for monitoring and responding to incidents pertaining to IBAs.
- A unified set of IS Governance and Risk Management.
- Institutional Threat Management skills.
This change in strategy allows the EU to shift from siloed layers of defensive strategies to overall strategic and operational cyber resilience.
A spotlight on the immediate and long-term features of governance resilience
The focus on the immediate and the long-term features of governance resilience is apparent in these encompassing statements.
Furthermore, this undertaking represents support for the EU Digital Agenda. As public administrations continue to move to the cloud, integrate AI, enhance the provision of public services, improve cybersecurity, and increase trust in the system, compliance with legal obligations and the provision of services without interruption are key.
The implementation of the system will take a phased approach, starting with:
- The introduction of core capabilities of federation incident response and monitoring.
- The establishment of the system governance and risk framework for all the IBAs.
- The gradual provision of the training, the simulation of cybersecurity exercises, and the joint maneuver.
- Leading institutions, the European Commission and the European Parliament, will serve as pilot Implementing Institutions to set the first example for EU-wide deployment.
The MC17 FREIA Cyber Framework Contract is one of the most important EU opportunities in cybersecurity to date and is the result of the contract win from the C-Suite of a Capgemini-led consortium. Given the current landscape of increasing cyber threats of unprecedented proportions, this initiative also represents the European Union’s effort to defend its digital sovereignty as fully as possible.
