Euralarm and CoESS call for a practical approach to securing Europe's ICT supply chains

Euralarm and the Confederation of European Security Services (CoESS) have issued a joint statement on the European Commission's proposed Cybersecurity Act 2. While strongly supporting the EU's ambition to strengthen cybersecurity and resilience, the two organisations emphasise that new measures to secure ICT supply chains must take account of the entire security value chain and safeguard the continuity of essential security systems and services.

The European Commission's proposal for a revised Cybersecurity Act introduces a Trusted ICT Supply Chain Framework aimed at reducing cybersecurity risks associated with critical ICT technologies and suppliers. Under Title IV of the proposed legislation, EU-level risk assessments could lead to mitigation measures, including restrictions on certain suppliers or the gradual phase-out of technologies considered to pose unacceptable risks.

Euralarm and CoESS welcome the objective of strengthening Europe's cybersecurity and reducing vulnerabilities in critical supply chains. However, they underline that the practical consequences of such measures may extend considerably beyond the organisations directly covered by the NIS2 Directive.

Looking beyond individual organisations

Fire safety and security systems protecting critical infrastructure and essential services depend on complex networks of manufacturers, technology suppliers, system integrators, installers, maintenance providers and monitoring companies. These organisations play an important role in ensuring that security technologies remain reliable, operational and resilient throughout their lifecycle. Restrictions on specific ICT products, technologies or suppliers could therefore affect not only the entities operating critical infrastructure but also the companies responsible for designing, installing and maintaining their security systems. For example, replacing components in an existing security installation may require more than simply selecting an alternative product. Compatibility, system integration, certification, maintenance arrangements and operational continuity may all need to be considered.

The two organisations therefore argue that cybersecurity risk assessments and subsequent mitigation measures should reflect the interconnected nature of the European security industry.

Four priorities for effective implementation

In their joint statement, Euralarm and CoESS identify several principles that should guide the development and implementation of the Trusted ICT Supply Chain Framework. First, structured consultation with relevant industry stakeholders is essential to ensure that decisions are informed by technical expertise and practical experience across the security value chain. Second, risk assessments should be transparent, proportionate and evidence-based, allowing appropriate measures to be taken without creating unnecessary disruption to security operations. Third, operational and economic consequences should be assessed across the entire value chain, including the potential impact on manufacturers, installers, service providers and end users. Finally, realistic alternatives and transition periods must be available where existing technologies or suppliers need to be replaced. This is particularly important for security systems with long operational lifecycles, where changes may involve substantial technical adaptations and investments.

Cybersecurity and operational resilience must go hand in hand

For Euralarm, the joint statement reflects a broader principle: cybersecurity measures must contribute to the resilience of the systems and services on which European society depends.

Connected fire safety and security technologies are increasingly important for protecting buildings, infrastructure and essential operations. Strengthening their cybersecurity is necessary, but implementation must also preserve their availability, reliability and effectiveness. The statement also builds on the longstanding cooperation between Euralarm and CoESS on cybersecurity. In September 2026, the two organisations published updated Cybersecurity Guidelines for the Security and Fire Safety Industry, providing practical recommendations for managing cybersecurity risks throughout the lifecycle of security products, systems and services.

Through their joint contribution to the debate on Cybersecurity Act 2, Euralarm and CoESS aim to support a European regulatory framework that strengthens trust in ICT supply chains while recognising the technical and operational realities of the security industry. The shared objective is clear: stronger cybersecurity must reinforce, rather than compromise, the continuity and resilience of the systems protecting Europe's critical and essential entities.

Read the joint Euralarm–CoESS statement on Cybersecurity Act 2