Publications

Featured publications

ENISA Threat Landscape 2025

September 30, 2025 Download

Through a more threat-centric approach and further contextual analysis, this latest edition of the ENISA Threat Landscape analyses 4875 incidents over a period spanning from 1 July 2024 to 30 June 2025. At its core, this report provides an…

NIS Investments 2025

December 08, 2025 Download

The annual NIS Investments report presents the findings of a study conducted by ENISA to explore how cybersecurity policy
translates in practice across organisations in the EU and its effects on their investments, resources, and operations.…

NIS2 Technical Implementation Guidance

June 25, 2025 Download

This report provides technical guidance to support the implementation of the NIS2 Directive for several types of entities in the NIS2 digital infrastructure, ICT service management and digital providers sectors. The…

All publications

Public Private Partnerships (PPP) - Cooperative models

14 February, 2018

With this report, ENISA aims to analyse the current status of PPPs in the EU. The study identifies the main models of collaboration, the current challenges that both private and public sector face in the process of setting up and developing PPPs and…

Cyber Security Culture in organisations

6 February, 2018

To assist in promoting both the understanding and uptake of CSC programmes within organisations, this report draws from multiple disciplines, including organisational sciences, psychology, law and cybersecurity. It is complemented by knowledge and…

European Cybersecurity Month 2017 - Deployment Report

6 February, 2018

For the fifth consecutive year, last October the European Cyber Security Month (ECSM) campaign was successfully executed across Europe. The campaign was coordinated and supported by ENISA, the European Commission, Europol’s Cyber Crime Centre (EC3…

Improving recognition of ICT security standards

1 February, 2018

This report is a continuation and an extension of previously carried out ENISA work on approaches to the NIS Directive by Member States, which have provided recommendations on standardisation and have outlined the use and management of CSIRTs.

Looking into the crystal ball: A report on emerging technologies and security challenges

31 January, 2018

The time has come for ENISA to take a look at the crystal ball of technology; In particular looking at what are considered to be emerging technologies and what might be their prospective usage scenarios. Considering emerging technologies and…

Handbook on Security of Personal Data Processing

29 January, 2018

The overall scope of the report is to provide practical demonstrations and interpretation of the methodological steps of the ENISA’s 2016 guidelines for SMEs on the security of personal data processing. This is performed through specific use cases…

Privacy and data protection in mobile applications

29 January, 2018

The scope of the report is to provide a meta-study on privacy and data protection in mobile apps by analysing the features of the app development environment that impact privacy and security, as well as defining relevant best-practices, open issues…

Reference Incident Classification Taxonomy

26 January, 2018

This taxonomy resulted from collaboration initiatives such as the annual ENISA/EC3 Workshop which involved CSIRTs, LEAs, ENISA, and EC3. Other examples include the eCSIRT.net taxonomy2 which was developed in 2003, and the eCSIRT.net mkVI taxonomy3…

Mapping of OES Security Requirements to Specific Sectors

18 January, 2018

The current report provides a substantial and comprehensive mapping of the security requirements for OES, as they have been agreed in the NISD Cooperation Group, to sector specific information security standards. ENISA conducted desktop research on…

Online Tracking and User Protection Mechanisms