Sign in

ENISA

ENISA Guidelines and Publications — ENISA (European Union Agency for Cybersecurity)

Also known as: European Union Agency for Cybersecurity, ENISA publications, ENISA threat landscape, ETL

Official site Official change log Subscribe to ENISA (RSS)

Current version
ENISA Threat Landscape 2026
Published 22 September 2026. source
Status
In force
Next deadline
None announced
Who must comply
ENISA's guidance is non-binding; it helps entities and authorities apply NIS2, the Cyber Resilience Act and the Cybersecurity Act, and ENISA runs EU tools such as the vulnerability database and the CRA reporting platform. source source
How it is assessed
Following ENISA guidance is voluntary; nobody is audited or certified against ENISA publications as such. source
Written by
ENISA, the European Union Agency for Cybersecurity, has its mandate and tasks set by the Cybersecurity Act, Regulation (EU) 2019/881, and is established for an indefinite period. source
Enforced by
ENISA has no power to fine; obligations are enforced by national authorities under the acts its guidance supports. source
Last change

Publications, threat landscape reports, and technical guidelines issued by the EU Agency for Cybersecurity. ENISA is the issuing body for guidance under NIS2 and the Cybersecurity Act, including incident reporting thresholds and certification schemes.

Recent changes

  1. Low
    ENISA publishes Technical Advisory on Secure Update Mechanisms

    ENISA has published a new Technical Advisory on Secure Update Mechanisms. The advisory provides practical technical guidance for manufacturers of products with digital elements, specifically teams …

    New document

  2. Medium
    ENISA publishes Technical Advisory on Secure Update Mechanisms

    ENISA published a technical advisory providing practical guidance on secure update mechanisms for manufacturers of products with digital elements. The advisory helps micro-, small and medium-sized …

    New document Action required

  3. Low
    ENISA publishes Technical Advisory for Software Bill of Materials

    ENISA published a Technical Advisory for Software Bill of Materials on 22 October 2026. The document provides practical guidance on SBOM adoption and is intended for …

    New document

  4. Low
    ENISA publishes Technical Advisory for Software Bill of Materials

    ENISA has published a Technical Advisory providing practical guidance on Software Bill of Materials (SBOM) adoption, primarily targeting micro-, small and medium enterprises (SMEs) and supply …

    Guidance

That is the last 90 days. Sign in to read further back.

Key dates

No upcoming dates
  1. CRA Single Reporting Platform upgraded to version 1.1
  2. ENISA publishes the Threat Landscape 2026
  3. ENISA launches the initial operating capability of the CRA Single Reporting Platform as manufacturers' reporting duties start
  4. ENISA publishes the Threat Landscape 2025
Show 2 earlier dates
  1. ENISA publishes the NIS2 Technical Implementation Guidance
  2. The European Vulnerability Database (EUVD) becomes operational

Version history

  1. ENISA Threat Landscape 2026 Major versionCurrent

    Annual threat report covering incidents observed from 1 January to 31 December 2025. source

  2. ENISA Threat Landscape 2025 Major version

    Previous annual threat report; ENISA issued version 1.3 on 22 September 2026 with corrected figures and updated links. source

  3. NIS2 Technical Implementation Guidance (v1.0) Major version

    Non-binding guidance on the risk-management requirements of Commission Implementing Regulation (EU) 2024/2690, with examples of evidence and mappings to standards. source

Who it applies to

ENISA's publications are guidance, not law; their weight comes from the EU acts they help apply.

Legal status
ENISA states that its NIS2 technical guidance is not legally binding and does not replace national frameworks or guidance. source
Vulnerability database
NIS2 tasks ENISA with developing and maintaining a European vulnerability database (NIS2 Article 12(2)); ENISA announced it operational on 13 May 2025. source source
CRA reporting
ENISA establishes the single reporting platform for manufacturers' CRA notifications (CRA Article 16). source source
Certification
At the Commission's request ENISA prepares candidate European cybersecurity certification schemes, after open consultation (Cybersecurity Act Article 49). source

How compliance is assessed

Following ENISA guidance is voluntary; nobody is audited or certified against ENISA publications as such.

Voluntary use
The NIS2 technical guidance gives examples of evidence and maps requirements to standards, but is not legally binding. source

Enforcement and penalties

ENISA has no power to fine; obligations are enforced by national authorities under the acts its guidance supports.

Penalties
None. The Cybersecurity Act gives ENISA tasks, not sanctioning powers; penalties under the certification framework are set by Member States (Article 65). source

Documents

  1. Guidance ENISA Threat Landscape 2026
  2. Guidance NIS2 Technical Implementation Guidance
  3. Guidance European Vulnerability Database (EUVD)
  4. Guidance CRA Single Reporting Platform
  5. Guidance EU cybersecurity certification framework
Show 1 more document
  1. Guidance ENISA publications

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 11 September 2026. Subscribe to ENISA (RSS)