ENISA
EU Agency for Cybersecurity; NIS360 2026 placed railway, water and waste water newly in the risk zone.
ENISA's NIS360 report placed railway, drinking water and waste water in the EU's cyber risk zone for the first time on 28 May 2026, and from 1 June company directors in transposing member states can be fined personally for serious cybersecurity failures in those sectors.
Last refreshed: 2 October 2026 · Appears in 3 active topics
Which EU sectors joined ENISA's cyber risk zone in May 2026?
Timeline for ENISA
Mentioned in: CISA set three-day deadlines on 34 flaws
Cybersecurity: Threats and DefencesPublished its 2026 Threat Landscape on 22 September
Cybersecurity: Threats and Defences: ENISA finds most NoName057(16) claims failUpdated the Cyber Resilience Act Single Reporting Platform FAQ
Cybersecurity: Threats and Defences: ENISA updates its single-reporting platform FAQMentioned in: CISA tells water plants to unplug controllers
Cybersecurity: Threats and DefencesMentioned in: TfL hackers jailed five and a half years
Cybersecurity: Threats and DefencesBackground
The European Union Agency for Cybersecurity is the EU's central cybersecurity agency, responsible for developing cybersecurity certification schemes, threat-landscape assessments and supporting member-state CERTs. It publishes the annual ENISA Threat Landscape report, manages the EU cybersecurity certification framework under the Cybersecurity Act, and provides technical guidance to the European Commission on NIS2 and CRA implementation. It was established in 2004 and given a permanent, strengthened mandate under the Cybersecurity Act in 2019.
ENISA opened a public consultation on a draft EU Digital Identity Wallet certification scheme on 3 April 2026, a milestone in setting security-assurance requirements for wallet implementations under eIDAS2, and defining how the Wallet intersects with Cyber Resilience Act product-security requirements that apply from 11 December 2027. On 22 April 2026, it published the National Capabilities Assessment Framework v2, a structured member-state benchmarking tool for NIS2 maturity, alongside the European Commission's 19 reasoned opinions identifying transposition gaps.
NIS360 and NCAF 2.0 together give national regulators both a member-state maturity score and a sector-level risk map to anchor enforcement decisions; three sectors, trust services, aviation and financial market infrastructures, reached high maturity for the first time in the same report that flagged water and rail as newly at risk.
Water joins rail in the risk zone
ENISA published its third annual NIS360 report on 28 May 2026. Railway, drinking water and waste water crossed into the formal EU cyber risk zone for the first time, placed there because their criticality now exceeds their assessed security maturity; one in three water-sector entities had never carried out a basic risk assessment.
The enforcement teeth arrived within days: from 1 June 2026, company directors in EU countries that have transposed NIS2 can be fined personally at the full statutory rate for serious cybersecurity failures, and the European Commission referred non-transposing member states to the EU Court of Justice. ENISA's risk-zone finding gives national regulators a documented maturity gap in exactly the sectors where that personal liability now bites hardest.