The European Union is giving its cybersecurity agency a bigger operational role by tasking it with running a new EU Cybersecurity Reserve, backed by 36 million euros over three years. This reserve is meant to provide rapid incident response support when major cyberattacks hit, especially in critical sectors covered by NIS2, as well as EU institutions and certain partner countries. ENISA will use the funding to procure services from trusted managed security service providers, monitor how those services are delivered, and handle requests for help from national cyber crisis authorities and CERT-EU. The reserve is designed so that if its pre-committed incident response capacity is not fully used, it can be redirected into preparedness and prevention activities, making sure the money still strengthens resilience.

The initiative sits under the EU’s Cyber Solidarity Act and complements ENISA’s existing programmes, such as the Cybersecurity Support Action, which is scheduled to wind down in 2026. The timing is intentional: the reserve is expected to be fully operational by the end of 2025, giving Member States a transition period to plug into the new mechanism and adjust their procedures for requesting support. The 36 million euros come on top of ENISA’s core 2025 budget, signaling a shift from a primarily advisory role toward more hands-on operational responsibility during crises. At the same time, the selection and certification of providers for the reserve is expected to boost Europe’s cybersecurity industry, pushing managed security services to meet higher trust and quality requirements while building a shared European “shield” against large-scale cyber incidents.

‍

Source: https://www.enisa.europa.eu/news/enisa-to-operate-the-eu-cybersecurity-reserve-with-eur-36-million