Cyber Solidarity Act Guide: Alert System and Reserve

When a large-scale cyber incident hits several EU countries at once, no single national CSIRT has the detection coverage or response capacity to handle it alone, and the Cyber Solidarity Act is the EU's answer to that gap. Regulation (EU) 2025/38 entered into force on 4 February 2025. It builds a network of Cyber Hubs that share threat intelligence across borders, creates a Cybersecurity Emergency Mechanism with an EU Cybersecurity Reserve of pre-contracted incident response providers, and lets ENISA review significant incidents after the fact. Unlike NIS2 or DORA, it places almost no direct duties on companies; it shapes what support is available, who provides it and what is expected of organisations that receive it. This guide is for CISOs, CSIRT and SOC leads in critical sectors, managed security service providers that want to become trusted providers, and public sector security teams.

Key takeaways

Three instruments, one regulation. The European Cybersecurity Alert System, the Cybersecurity Emergency Mechanism and the European Cybersecurity Incident Review Mechanism (Art. 1).
It is in force now. Regulation (EU) 2025/38 was dated 19 December 2024, published on 15 January 2025 and entered into force on 4 February 2025.
Companies are users, not addressees. Most duties fall on Member States, ENISA, the Commission and the ECCC; entities in critical sectors benefit through national authorities and CSIRTs.
The Reserve is run by ENISA. Under a contribution agreement signed in August 2025, ENISA operates the EU Cybersecurity Reserve with EUR 36 million over three years, and requests must be answered within 48 hours.
MSSPs face a certification hook. Trusted providers must meet the Article 17 criteria, including holding an applicable European certificate within two years of a relevant scheme applying.

Scope: who and what is covered

The Act sets up Union-level capacities funded through Specific Objective 3 (Cybersecurity and Trust) of the Digital Europe Programme (DEP), and amends Regulation (EU) 2021/694 to fund them. It respects national security competence: national security remains a Member State competence and sharing of confidential information is limited to what is relevant and proportionate (Art. 1(5) and (6)).

Actor	Role under the Act	Articles
Member States	Designate a National Cyber Hub, request Reserve support through single points of contact, provide mutual assistance	4, 15, 18
National Cyber Hubs	Single entity per participating Member State, which may be the CSIRT; may cooperate with private entities	4
Cross-Border Cyber Hubs	Multi-country platforms run by a Hosting Consortium of at least three Member States under a written consortium agreement	5, 6
ENISA	Operates the Reserve (as entrusted), maps service needs, provides request templates, conducts incident reviews, issues interoperability guidelines	6, 14, 15, 21
Commission and ECCC	Overall responsibility for the Reserve; ECCC implements most Emergency Mechanism actions	10, 14
CERT-EU and EU institutions	Reserve users; CERT-EU requests directly	14, 15
DEP-associated third countries	May use the Reserve if a Council implementing act allows, for up to one year at a time	19
Trusted managed security service providers	Deliver incident response services from the Reserve after procurement	17
Entities in highly critical sectors	May take part in coordinated preparedness testing and receive Reserve support via national users	12, 14

Key obligations

1. European Cybersecurity Alert System

Structure: a voluntary pan-European network of National and Cross-Border Cyber Hubs (Art. 3) that pool data, produce threat intelligence and issue alerts, using AI and advanced data analytics. The first phase started in November 2022, when two consortia of cross-border SOCs, now called Cyber Hubs, were selected under DEP.
Information sharing: hub members share relevant information such as indicators of compromise under their consortium agreement, which must set out sharing commitments, governance and targets for AI and analytics tools (Art. 6). ENISA had to issue interoperability guidelines by 5 February 2026.
Escalation: where hubs see signs of a potential large-scale incident they give early warning to Member State authorities and the Commission without undue delay, and cooperate closely with the CSIRTs network (Art. 7).
Security of the network: participating Member States must ensure a high level of cybersecurity and physical security for hub infrastructure (Art. 8).
Funding conditions: the Union can fund up to 50% of National Cyber Hub acquisition and operating costs and up to 75% of acquisition costs for Hosting Consortia; a Member State whose hub has not joined a Cross-Border Cyber Hub within two years loses eligibility for further support (Art. 9).

2. Cybersecurity Emergency Mechanism

Action	What it provides	Who benefits	Article
Coordinated preparedness testing	Voluntary testing such as penetration testing of entities in highly critical sectors, based on common risk scenarios from the NIS Cooperation Group	Entities in sectors the Commission identifies, for example finance, energy and healthcare	12
Other preparedness actions	Vulnerability and risk monitoring, exercises and training, mainly through grants	Member States and entities on request	13
EU Cybersecurity Reserve	Incident response services from pre-contracted trusted private providers; unused pre-committed services can convert to preparedness services	Member State cyber crisis authorities and CSIRTs, CERT-EU, eligible third countries	14 to 17
Mutual assistance	Grants supporting one Member State that helps another hit by a significant or large-scale incident	Member States	18

The Reserve has firm operating rules. Requests go through national single points of contact using an ENISA template (Art. 15). Responses to Member State and EU institution requests are due within 48 hours, users submit a summary report within two months of support ending, and the contracting authority reports to the NIS Cooperation Group at least twice a year (Art. 16). The Reserve also coordinates with the Union Civil Protection Mechanism and the Integrated Political Crisis Response arrangements (Art. 20).

3. Trusted provider criteria

Article 17(2) sets procurement criteria (points (a) to (k)) for managed security service providers in the Reserve. They include integrity and qualifications of personnel, protection of classified information, security clearance where needed, appropriate security of the provider's own IT systems, the ability to work in the user's language, and holding a European certificate under an applicable scheme within two years of that scheme applying. Regulation (EU) 2025/37, adopted the same day, amended the Cybersecurity Act so that managed security services can be certified. See the EU Cybersecurity Act and EUCS Guide.

4. European Cybersecurity Incident Review Mechanism

At the request of the Commission or EU-CyCLONe, ENISA reviews a significant or large-scale incident and delivers a report with lessons learned and, where appropriate, recommendations to EU-CyCLONe, the CSIRTs network, the Member States concerned and the Commission (Art. 21). The report must not include details of unpatched, actively exploited vulnerabilities, and a public version is optional. Organisations affected by a reviewed incident should expect requests for information routed through their national authorities.

Timeline and current status

Date	Milestone
2021 to 2022	Pilots funded with EUR 115 million; two Cross-Border SOC consortia selected in November 2022
19 December 2024	Regulation (EU) 2025/38 adopted with companion Regulation (EU) 2025/37
15 January 2025	Published in the Official Journal
4 February 2025	Entry into force
26 August 2025	ENISA and the Commission sign the contribution agreement for ENISA to operate the Reserve (EUR 36 million over three years); Reserve expected fully operational by end of 2025
5 February 2026	Deadline for ENISA interoperability guidelines for Cyber Hubs
2026	ENISA's earlier Cybersecurity Support Action ends; users move to the Reserve
Around February 2027	First evaluation due within two years of entry into force, then at least every four years (recital 60)

Funding: EUR 100 million was reallocated within DEP, bringing DIGITAL cybersecurity funding to EUR 842.8 million, and the Commission estimates up to EUR 1.109 billion including Member State contributions. Related changes are in progress: the Commission's January 2026 Cybersecurity Act 2 proposal, COM(2026) 11, would make ENISA's Reserve role part of its permanent mandate. That proposal is still under negotiation, so treat it as direction, not law.

Enforcement and penalties

The Act contains no administrative fines or penalty regime for private entities. It is a funding and cooperation instrument, and its levers are conditions rather than sanctions:

Funding conditions: Member States and Hosting Consortia lose eligibility for further Union support if they do not meet commitments such as joining a Cross-Border Cyber Hub within two years (Art. 9).
Contract terms: trusted providers are bound by procurement contracts with the contracting authority, including the Article 17 security and confidentiality criteria; breach is a contractual matter.
Reporting duties: users of the Reserve must provide a summary report within two months, and third countries report capabilities within three months of their agreement and annually after (Arts. 16 and 19).
Interaction with NIS2: receiving Reserve support does not suspend NIS2 incident reporting or supervisory obligations. Penalties for failures there come from national NIS2 law. See the NIS2 Directive Guide.

What it means for AI agents and non-human identities

The Act does not mention non-human identities, but every instrument depends on them in practice, and incident responders arriving through the Reserve will ask about them first.

Responder access: a Reserve provider deployed into your environment needs accounts, API tokens and often EDR or log platform credentials. Pre-define time-bound, least-privilege break-glass identities for external responders and a process to revoke them at handover. See the Incident Response Retainer Buyer's Guide.
Machine credentials as indicators: stolen API keys, OAuth tokens and service account credentials are common pivots in cross-border campaigns. Indicators shared through Cyber Hubs increasingly describe abused tokens, client IDs and automation accounts rather than only IP addresses and hashes.
Automated sharing pipelines: the Act expects AI and analytics tools in hubs. The connectors and agents that push telemetry to a National Cyber Hub are themselves privileged NHIs with outbound data flows; inventory them and scope them. See the Agentic AI in the SOC Guide.
Incident reviews: ENISA reviews of large-scale incidents will look at how initial access happened. Be ready to show who owned compromised machine identities and when they were last rotated. See the NHI Ownership Guide.
MSSP side: providers seeking trusted status must show strong security of their own IT systems; their multi-tenant automation accounts and stored customer credentials are the most attractive target in their estate.

Compliance steps

For most organisations "compliance" means being ready to use, and to receive, the support the Act creates. A practical sequence:

Find your national route (month 1): identify your Member State's National Cyber Hub, CSIRT and single point of contact for Reserve requests, and how your sector regulator expects you to escalate. Record them in the incident response plan.
Join information sharing: if your national hub or sector ISAC accepts private members, agree the sharing terms (TLP, data protection, legal basis) and connect feeds into your SIEM or threat intelligence platform in a test environment first.
Prepare to receive external responders: write a responder onboarding runbook: identity provisioning, access scopes, evidence handling, data protection terms and revocation. Test it in a tabletop exercise with your existing retainer provider. See the Tabletop Exercise Guide.
Volunteer for preparedness testing: if you are in a sector the Commission identifies, ask your national authority about coordinated testing under Article 12. Agree rules of engagement and a rollback plan for any production testing.
Align reporting: make sure the NIS2, DORA or GDPR notification clock is not forgotten while support is requested. Assign one owner for regulatory notifications during a crisis. See the DORA Guide for financial entities.
For MSSPs: map your controls to Article 17(2), track the EUMS certification scheme, and prepare for procurement calls from ENISA.
Review after incidents: treat ENISA review reports and your own Reserve summary report as inputs to improvement.

Decision guidance

Small entities: you will not request Reserve support directly; invest in knowing your CSIRT contact and keeping logs that responders can use.
Large critical entities: keep a private incident response retainer. The Reserve supplements national capacity in significant or large-scale incidents and is not a substitute for your own contracted response.
Multinationals: decide in advance which Member State's single point of contact leads, normally where the main establishment or most affected operations sit, and document it.

Framework mapping and measurement

Act instrument	NIST CSF 2.0	NIST SP 800-53 Rev. 5	ISO/IEC 27001:2022 Annex A
Alert System threat intelligence	ID.RA-02	PM-16	A.5.7 Threat intelligence
Early warning and information sharing	RS.CO-03	IR-6	A.5.5 Contact with authorities, A.5.6 Special interest groups
Reserve incident response support	RS.MA-01	IR-4, IR-7	A.5.24, A.5.26
Preparedness testing	ID.IM-02	CA-8, IR-3	A.5.30 ICT readiness for business continuity
Incident review and lessons learned	ID.IM-02	IR-4	A.5.27 Learning from information security incidents

CIS Controls v8.1 Control 17 (Incident Response Management) covers designated contacts and third-party responders. Metrics that show readiness:

Time to reach the national CSIRT or single point of contact in exercises.
Time to provision and revoke scoped access for an external responder (target hours, not days).
Percentage of shared indicators ingested and actioned within 24 hours.
Number of exercises per year that include an external responder or national authority.
Percentage of review recommendations implemented within an agreed period.

Common failure patterns

Assuming the EU will respond for you: the Reserve answers Member State and EU users, not companies directly; organisations without their own retainer wait in a national queue.
No responder identity plan: external teams arrive and are given shared admin passwords, which then survive the incident.
Sharing without legal basis: indicators containing personal data or customer identifiers are shared without TLP marking or a GDPR assessment.
Forgetting regulatory clocks: teams focus on recovery and miss NIS2 or DORA notification deadlines that still apply.
Unscoped sharing connectors: telemetry agents feeding hubs run with broad read access and long-lived tokens that become a new attack path.

Practitioner checklist

Record your National Cyber Hub, CSIRT and Reserve single point of contact in the incident response plan.
Confirm whether your sector is identified for coordinated preparedness testing.
Write and test a runbook for onboarding and offboarding external responders, including NHIs they use.
Keep your own incident response retainer and clarify how it would work alongside Reserve providers.
Connect national or sector threat intelligence feeds with agreed TLP and data protection terms.
Inventory and scope every connector or agent that shares telemetry externally.
Map one owner for regulatory notifications during cross-border incidents.
MSSPs: gap-assess against Article 17(2) criteria and track the EUMS scheme.

Standards and references

Related NHI Mgmt Group resources: NIS2 Directive Guide · EU Cybersecurity Act and EUCS Guide · Incident Response Guide · Crisis Management Guide · Global Cybersecurity Regulatory Map. This guide summarises the Cyber Solidarity Act (Regulation (EU) 2025/38) as at October 2026 and is not legal advice.

Cyber Solidarity Act Guide: European Cybersecurity Alert System, Emergency Mechanism and Reviews