Introduction
The proliferation of connected devices across industry sectors
has led to the emergence of a significant and distinct threat to
many types of organisations. However, a majority of European
companies continue to underestimate just how exposed they are to
cyber risk9. This lack of awareness translates into low
investment in Internet of Things (IoT) cybersecurity and limited
legal risk management.
Against this backdrop, the European Commission (the
"Commission") has been developing and adopting the EU
Cybersecurity Strategy, with the European Network and Information
Security Agency (ENISA), created in 2004, making an active
contribution to policy10. Initially established for a
period of five years, ENISA's mandate has been progressively
extended11, revised and modernised.
