Firewall Daily – The Cyber Express
EU Rolls Out NCAF 2.0 Framework to Boost National Cybersecurity Readiness Ashish Khaitan
The European Union Agency for Cybersecurity (ENISA) has released the updated version of the National Capabilities Assessment Framework (NCAF 2.0), providing EU Member States with a structured, adaptable methodology to evaluate and enhance their national cybersecurity capabilities. This revised framework is designed to support national authorities in assessing the maturity of their National Cybersecurity Strategies (NCSSs), ultimately strengthening the EU's collective cybersecurity posture. T
23 de Abril de 2026, 03:58

EU Rolls Out NCAF 2.0 Framework to Boost National Cybersecurity Readiness

23 de Abril de 2026, 03:58

NCAF 2.0

The European Union Agency for Cybersecurity (ENISA) has released the updated version of the National Capabilities Assessment Framework (NCAF 2.0), providing EU Member States with a structured, adaptable methodology to evaluate and enhance their national cybersecurity capabilities. This revised framework is designed to support national authorities in assessing the maturity of their National Cybersecurity Strategies (NCSSs), ultimately strengthening the EU's collective cybersecurity posture. The National Capabilities Assessment Framework (NCAF) 2.0 offers EU Member States a comprehensive tool for evaluating their cybersecurity preparedness and progress. Through this framework, countries can assess the maturity of their National Cybersecurity Strategies (NCSSs), identify strengths and weaknesses, and make targeted improvements. NCAF 2.0 is built around a flexible, evidence-based approach that provides valuable insights into both strategic and operational cybersecurity initiatives.

How is NCAF 2.0 Different?

NCAF 2.0 is a refined maturity model that helps countries assess their cybersecurity efforts across various stages of development. This model evaluates both the process and outcomes of national cybersecurity strategies, offering Member States an ongoing opportunity to track progress and align with EU cybersecurity standards. NCAF 2.0 builds upon the success of its predecessor by introducing several key updates aimed at strengthening the cybersecurity capabilities of EU Member States. These updates include:

New descriptions of maturity levels reflect the dynamic nature of cybersecurity challenges, enabling more accurate assessments of national capabilities.
The framework includes updated goals that address emerging cybersecurity threats and align with evolving EU policies, such as the NIS2 Directive, which came into force in January 2023.
A set of comprehensive questions designed to assess the maturity of various cybersecurity areas, including governance, risk management, and incident response.

NCAF 2.0 is crucial in supporting the EU’s broader cybersecurity agenda, especially in helping Member States comply with regulatory frameworks such as the NIS2 Directive. This directive requires countries to establish robust NCSSs, setting clear goals for addressing current and future cybersecurity risks.

Who Can Benefit from NCAF 2.0?

The primary beneficiaries of NCAF 2.0 are policymakers, cybersecurity experts, and government officials responsible for shaping and implementing NCSSs. The framework offers a valuable self-assessment tool for evaluating a country’s progress and improving national cybersecurity strategies. By providing a structured methodology for assessing cybersecurity efforts, NCAF 2.0 enables national authorities to make data-driven decisions that enhance their overall security posture. Additionally, the framework promotes mutual learning and best practice sharing among EU Member States, fostering collaboration on key cybersecurity issues. By aligning national strategies with EU-wide cybersecurity goals, NCAF 2.0 contributes to strengthening the EU’s collective defense against cyber threats.

The EU Cybersecurity Landscape

The release of NCAF 2.0 marks a significant step forward in enhancing EU cybersecurity. For over a decade, ENISA has supported EU Member States in developing and refining their national cybersecurity strategies. NCAF 2.0 builds this legacy, offering an updated tool for assessing progress and adapting to emerging threats. As the EU cybersecurity landscape evolves, NCAF 2.0 ensures that national cybersecurity strategies remain relevant and effective. By continuously updating the framework in response to new developments in technology and legislation, ENISA helps Member States stay ahead of cyber threats and maintain a good defense against modern cyber risks.

Challenges in Assessing National Cybersecurity Strategies

Developing and evaluating effective National Cybersecurity Strategies (NCSSs) is a complex task that presents numerous challenges for EU Member States. Some of the most common difficulties include:

Coordination Across Stakeholders: Ensuring effective collaboration between government agencies, businesses, and cybersecurity experts can be difficult, especially in countries with fragmented governance structures.
Adapting to Evolving Threats: As cyber threats continue to evolve, national strategies must be flexible and adaptive. Member States must continuously update their plans to address emerging risks.
Measuring Effectiveness: It is not enough to track the implementation of cybersecurity measures; it is also important to assess the long-term impact and success of these efforts. This requires a comprehensive evaluation of outcomes, not just outputs.

NCAF 2.0 helps address these challenges by providing a clear, structured framework for evaluating cybersecurity capabilities. The maturity model allows countries to track progress over time, identify gaps, and ensure their strategies are evolving to meet new challenges.

The Benefits of Using NCAF 2.0

NCAF 2.0 offers several advantages for EU Member States:

Self-Assessment and Continuous Improvement: The framework provides a voluntary tool for Member States to evaluate their cybersecurity maturity and track progress over time. By identifying gaps and areas for improvement, countries can strengthen their cybersecurity capabilities.
Alignment with EU Regulations: NCAF 2.0 is aligned with key EU legislation, including the NIS2 Directive and the Cyber Resilience Act. This ensures that national strategies comply with EU-wide cybersecurity standards.
Support for Peer Reviews: NCAF 2.0 can be used as part of the voluntary peer review process established under NIS2. This allows Member States to collaborate, share best practices, and enhance their collective cybersecurity efforts.

Through these benefits, NCAF 2.0 plays a crucial role in strengthening the cybersecurity posture of EU Member States and enhancing their resilience to cyber threats.

Maturity Levels in NCAF

The maturity model in NCAF 2.0 is structured around five levels, each representing a stage of development in national cybersecurity capabilities:

Level 1: Foundation: Countries at this level have begun their cybersecurity journey but lack a comprehensive, coordinated approach.
Level 2: Developing: At this stage, national strategies are in place, but implementation is still in the early stages.
Level 3: Established: Member States at this level have a well-established cybersecurity framework with clear governance structures and resource allocation.
Level 4: Mature: A mature cybersecurity strategy is aligned across all sectors, with ongoing evaluations and adjustments based on performance data.
Level 5: Advanced: Countries at this level demonstrate an adaptive, forward-looking cybersecurity strategy that is responsive to emerging threats and technological advancements.

While reaching Level 5 may be an idealized goal for many countries, the model provides a clear roadmap for progress, helping Member States identify where they currently stand and where they should aim to be.

Firewall Daily – The Cyber Express
After Funding Jolt, EU Moves to Back the CVE Vulnerability System Ashish Khaitan
The European Union is stepping forward to reinforce what many experts describe as a bedrock cyber vulnerability tracking system, as questions linger over the long-term sustainability of the Common Vulnerabilities and Exposures Program. The initiative, widely relied upon by cybersecurity professionals worldwide, has come under renewed scrutiny following a contracting scare involving MITRE, prompting discussions about diversification of support and governance. The vulnerability cataloging syst
27 de Março de 2026, 05:06

After Funding Jolt, EU Moves to Back the CVE Vulnerability System

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

27 de Março de 2026, 05:06

bedrock cyber vulnerability

The European Union is stepping forward to reinforce what many experts describe as a bedrock cyber vulnerability tracking system, as questions linger over the long-term sustainability of the Common Vulnerabilities and Exposures Program. The initiative, widely relied upon by cybersecurity professionals worldwide, has come under renewed scrutiny following a contracting scare involving MITRE, prompting discussions about diversification of support and governance. The vulnerability cataloging system, first launched in 1999, provides a standardized framework for identifying publicly known cybersecurity flaws. Each vulnerability is assigned to a unique identifier, enabling researchers, vendors, and government officials to communicate about specific issues clearly. Over time, the program has become a foundational reference point in global cybersecurity operations.

ENISA’s Role in Strengthening a Bedrock Cyber Vulnerability System

Speaking at the RSAC Conference in California, Hans de Vries, cybersecurity and operational chief at the European Union Agency for Cybersecurity, highlighted the EU’s intent to support and modernize this bedrock mechanism for addressing cyber vulnerabilities. He noted that the goal is to “build upon” the program’s existing foundation and preserve the “great work that has been done there.” The renewed focus comes after a tense moment last spring when MITRE warned that federal funding for the Common Vulnerabilities and Exposures Program could abruptly end. Although the issue was resolved within hours following strong backlash from the cybersecurity community, it exposed structural risks tied to reliance on a single U.S. government contract. In response, EU member states tasked ENISA with exploring ways to strengthen the system. De Vries highlighted the importance of ensuring continuity: “We cannot build on one contract alone, so we have to strengthen it, and make sure that foundation, that basic mechanism, and it’s a huge program, but that mechanism stays, and stays to the core that we want to build on.”

Legislative and Governance Challenges

Concerns about the resilience of the Common Vulnerabilities and Exposures Program are not limited to Europe. In the United States, congressional staff have begun drafting legislation aimed at formalizing the program’s structure and clarifying oversight responsibilities. The effort includes defining a stronger role for the Cybersecurity and Infrastructure Security Agency (CISA). Moira Bergin, who leads cyber policy work for Democratic members of the House Homeland Security Committee, highlighted a key issue: while CISA is authorized to run the program, it is not explicitly mandated to do so. “That makes it harder for us to hold an agency accountable,” she said, adding that stakeholders lack clear expectations for how the program should operate. The proposed legislative approach also aims to shield governance from political fluctuations. Bergin explained that draft provisions seek to “inoculate the [CVE] board membership from political cycles,” reducing the risk of instability in managing this bedrock cyber vulnerability framework.

AI, Speed, and the Evolution of Vulnerability Tracking

The discussion around strengthening this bedrock cyber vulnerability system also reflects broader changes in the threat landscape. Industry experts recognize that artificial intelligence is accelerating the speed and scale of cyberattacks. Bob Lord, a former CISA official involved in the Secure by Design initiative, pointed out that some still assume CVE records are primarily for human interpretation. However, modern threats demand machine-readable, high-quality data from the outset. Under the current model, vulnerability records are created when flaws are first disclosed, with additional “enrichment” added later, such as severity ratings and exploitability details. But experts argue that delays in completing records can leave defenders exposed in an era of machine-speed attacks. “Today, we’re going to really need to talk a lot more about record quality at the time of issuance, not enrichment later, but at the time of issuance,” Lord said.

Continued Support from MITRE and CISA

Despite earlier concerns, U.S. authorities have taken steps to stabilize the program. A spokesperson for CISA confirmed that a “broad internal contracting review caused a brief renewal delay in April 2025, but operations continued without disruption,” and MITRE remains the operator of the Common Vulnerabilities and Exposures Program. The Department of Homeland Security and CISA have since implemented measures to ensure continuity, maintain global vulnerability tracking, and expand usage. A spokesperson for MITRE reiterated the organization’s commitment, describing the program as a “critical global resource.”

Security Affairs
ENISA Technical Advisory on Secure Package Managers: Essential DevSecOps Guidance Pierluigi Paganini
ENISA’s first Technical Advisory on Secure Package Managers helps developers safely use third-party packages. ENISA has released its first Technical Advisory on Package Managers, focusing on how developers can safely consume third-party packages. The document (March 2026, v1.1) follows public feedback incorporating 15 contributions from stakeholders, experts, and the open-source community. “This document focuses on how developers can securely use package managers as part of their softwar
12 de Março de 2026, 05:49

ENISA Technical Advisory on Secure Package Managers: Essential DevSecOps Guidance

Security Affairs

Por:Pierluigi Paganini

12 de Março de 2026, 05:49

ENISA’s first Technical Advisory on Secure Package Managers helps developers safely use third-party packages.

ENISA has released its first Technical Advisory on Package Managers, focusing on how developers can safely consume third-party packages. The document (March 2026, v1.1) follows public feedback incorporating 15 contributions from stakeholders, experts, and the open-source community.

“This document focuses on how developers can securely use package managers as part of their software development life cycle.” states the report. “In particular, this document, outlines common risks involved in the use of third-party packages, presents secure practices for selecting, integrating, and monitoring packages and describes approaches for addressing vulnerabilities found in dependencies.”

Modern software relies on package managers like npm, pip, and Maven for code reuse and easy updates, but they carry supply chain risks, as seen in 2025 attacks (npm, XRP, Shai-Hulud 2.0). This advisory guides secure package selection, integration, monitoring, and vulnerability mitigation at the application level, using npm/GitHub examples while applying principles broadly.

Package managers are essential in modern software, automating installation, updates, and removal of libraries with their dependencies. They involve packages (reusable code), dependencies (direct or transitive), developers (publishers), applications (consumers), repositories (npm, PyPI), and the managers themselves (npm, pip).

Developers publish code, which others download and integrate. For example, npm install express fetches express plus ~68 dependencies. Not all installed code runs at runtime, reachability analysis identifies active modules, helping prioritize security risks, as vulnerabilities in unused code are less likely exploitable.

Packages boost collaboration through sharing and reuse, efficiency by avoiding reinventing the wheel, consistency with standardized components, maintainability via centralized updates, and quality from repeated testing across projects. Yet this interconnectedness amplifies risks: a vulnerability in express, with 100k+ direct dependencies and over 1M transitive ones, can devastate entire ecosystems. React’s CVE-2025-55182 (CVSS 10.0) threatened 12M sites. A single malicious dependency cascades globally, turning convenience into a massive attack surface.

Package risks come in two main forms. First, inherent vulnerabilities from poor coding (e.g., input validation flaws, path traversal, info leaks, unsafe deserialization) or abandoned packages like node-serialize or crypto-js. Second, supply chain attacks—malicious packages, compromised legit packages (event-stream, ua-parser-js), typosquatting (crossenv), or namespace confusion, can ripple widely, as seen with npm, which affects 2.6B weekly downloads and millions of downstream projects.

When selecting and integrating third-party packages, developers should follow a careful, structured approach to reduce security risks. During the selection phase, it’s crucial to choose packages from trusted sources with clear provenance and maintainers with a reliable reputation. Scanning for known vulnerabilities using tools like npm audit or OSV, verifying signatures and package integrity, and reviewing maintainer activity and popularity metrics help ensure that dependencies are both secure and actively maintained. Minimizing the number of dependencies and avoiding packages with unsafe scripts further reduces the attack surface.

During integration, developers should adopt practices that enforce transparency and control. Generating a Software Bill of Materials (SBOM) allows teams to track exactly what code is included in a project. Running vulnerability scans in CI/CD pipelines, using lockfiles and SHA hashes to enforce integrity, employing local package proxies, skipping install scripts when possible, and pinning specific package versions help prevent unexpected changes. Committing lockfiles and reviewing changelogs before upgrades ensures that updates are deliberate and safe, maintaining the security and reliability of the software supply chain.

Effective monitoring and mitigation are essential for securing third-party packages. For monitoring, integrate SBOM-based scanners like Grype or osv-scanner into CI/CD pipelines to continuously track vulnerabilities. Keep up with CVEs via EUVD, OSV.dev, Snyk, NVD, or Dependabot, and watch for outdated packages, deprecations, or changes in maintainers that could signal risks.

For mitigation, prioritize fixes using CVSS scores, EPSS, KEV catalogs, VEX statements, and reachability analysis with tools such as CodeQL or Semgrep. Address issues by patching, isolating affected components, or rolling back to safe versions, while updating SBOMs, mitigation notes, and notifying stakeholders to maintain long-term supply chain security.

“This document is intended to serve as a starting point with concise guidance on package consumption
within software projects, encouraging risk aware decision making when consuming and managing thirdparty packages. While many of the listed examples focus on npm, pip and GitHub, the recommendations are designed to apply across package manager ecosystems.” concludes the report. “The software supply chain landscape continues to evolve, with new tools, processes and risks emerging over time. Therefore, organisations should treat this subject as an ongoing activity and periodically review and update their practices to reflect changes in available tooling, threats and ecosystem-specific guidance.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ENISA)

Visualização normal