Cross-Border Cyber Hubs

From the Commission's own budget table for this call. Confirm against the topic page before you plan around it: these move when a work programme is amended.

Objective: The general objective of “Cross-Border Cyber Hub platforms” is to strengthen capacities to analyse, detect and prevent cyber threats and to support the production of high-quality intelligence on cyber threats, notably through the exchange of data from various sources, public and private, as well as through the sharing of state of-the-art tools and jointly developing cyber detection, analysis, and prevention capabilities in a trusted environment. They should provide new additional capacity building upon and complementing existing SOCs and CSIRTs and other relevant actors. The platforms should act as a central point allowing for broader pooling of relevant data and CTI, enabling the spreading of threat information on a large scale and among a large and diverse set of actors (e.g., CERTs/CSIRTs, ISACs, operators of critical infrastructures). Cross-Border Cyber Hub platforms will contribute to enhancing and consolidating collective situational awareness and capabilities in detection and CTI, supporting the development of better performing data analytics, detection, and response tools, through the pooling of larger amounts of data, including new data generated internally by the consortia members. The Cross-Border Cyber Hub platforms should achieve this general objective through the following specific objectives : Producing high quality, actionable information and CTI through the use of state-of-the-art tools and advanced tools and technologies (for example artificial intelligence (AI), including machine learning (ML) tools) on the large data sets of collected CTI. Contributing to better detection and response to threats. They should support quicker detection of cyber threats and incidents and more effective action plans and responses by relevant entities. Contributing to collective situational awareness. The platforms should contribute to the strengthening of the EU’s common situational awareness and enhanced coordinated detection capabilities by sharing information at three levels: Within individual platforms. Participating actors in a cross-border platform must commit to sharing operationally relevant information between one another within the same consortium. Different levels of sharing and integration of data and tools can be envisaged, ranging from the exchange of intelligence feeds and indicators of compromise (IoC) to more contextualised or sophisticated information on threats, incidents, and vulnerabilities. Between platforms. Conditions for exchanging information with other platforms are to be decided by each platform. The respective coope…