Establishes the permanent mandate for ENISA (EU Agency for Cybersecurity) and sets up a European cybersecurity certification framework for ICT products, ICT services, and ICT processes.

Defines core legal and technical statutory terms including 'cybersecurity', 'ICT product', 'ICT service', 'ICT process', 'cyber threat', 'European cybersecurity certification scheme', and 'assurance level'.

Grants ENISA a permanent mandate to achieve a high common level of cybersecurity across the Union, acting as a center of expertise and facilitator of cooperation.

Outlines core objectives: assisting Union institutions and Member States in policy development, operational cooperation, capability building, awareness, and certification.

Tasks ENISA with providing advice, opinions, and analyses regarding EU cybersecurity law and sector-specific policy developments.

Requires ENISA to support Member States in enhancing capabilities, developing national CSIRTs, providing cybersecurity training, and promoting cyber-hygiene.

Mandates support for operational cooperation within the CSIRTs network, handling cross-border incidents, coordinating large-scale exercises, and managing the secretariat.

Instructs ENISA to support the European cybersecurity market, analyze market trends, support certification scheme development, and promote standardisation.

Requires ENISA to perform threat analyses, collect public/voluntary incident information, and maintain a dedicated EU Information Hub portal.

Tasks ENISA with raising public awareness of cyber threats, running annual campaigns (e.g., European Cybersecurity Month), and encouraging security-by-design.

Requires ENISA to advise Union institutions on research priorities and needs in cybersecurity and liaise with research entities.

Authorizes ENISA to engage with third countries and international organisations (e.g., OECD, NATO) to promote common cybersecurity norms and international standards.

Establishes the administrative and management structure comprising a Management Board, Executive Board, Executive Director, Advisory Group, and Stakeholder Certification Group.

Creates an advisory body representing private industry, academia, consumer groups, and national data protection authorities to advise on work programs.

Sets up a dedicated expert group to assist the Commission and ENISA on strategic issues regarding cybersecurity certification.

Establishes horizontal rules for Union-wide cybersecurity certification schemes to ensure uniform security assurance for ICT products, services, and processes.

Requires the Commission to publish a multi-annual strategic work program identifying priority ICT categories for future certification schemes.

Outlines the procedure by which ENISA drafts candidate European cybersecurity certification schemes upon request from the Commission or ECCG.

Specifies functional security targets including data confidentiality, integrity, availability, vulnerability remediation, security updates, and protection against unauthorized access.

Defines three evaluation assurance levels for certified ICT assets: 'Basic', 'Substantial', and 'High', based on the rigor of testing and risk level.

Permits manufacturers or providers to issue an EU Statement of Conformity under their sole responsibility, restricted strictly to assets designated with assurance level 'Basic'.

Mandates explicit contents for each adopted scheme: scope, standards reference, evaluation criteria, rules for issuing certificates, and post-market compliance rules.

Establishes that EU cybersecurity schemes supersede conflicting national schemes, terminating duplicate national certifications once an EU scheme takes effect.

Requires each Member State to designate a national authority responsible for supervising compliance, handling complaints, and monitoring certification bodies.

Sets accreditation criteria for independent third-party bodies evaluating and issuing certificates for 'Substantial' or 'High' assurance levels.

Establishes the ECCG consisting of national representative authorities to advise the Commission and coordinate overall implementation of the framework.

Mandates Member States to establish effective, proportionate, and dissuasive penalties for infringements of European certification schemes and obligations.