Information security and law in Europe: Risks checked?

Abstract Information security has emerged as a necessity for organisations in order to ensure the integrity, confidentiality and availability of information. Information security, however, has shifted to the foreground of regulation in the European Union (EU) to address potential risks associated with the widespread use of information technology. Information security can be used to safeguard against risks or additionally facilitate users in meeting specific requirements with regard to pertinent legislation. The set up of a dedicated European Agency on information security (ENISA) also highlights the political significance of information security and the need to strive for greater cooperation across EU Member States as well as internationally. While the EU legal framework on information security is by no means complete, the efforts that have been made to tackle pertaining issues are likely to make a significant impact in the EU and beyond.