C_2008311EN.01001301.xml

on the annual accounts of the European Network and Information Security Agency for the financial year 2007 together with the Agency's replies

(3) These accounts were drawn up on 25 June 2008 and received by the Court on 4 July 2008.

(4) International Federation of Accountants (IFAC) and International Standards of Supreme Audit Institutions (ISSAI).

(6) Errors of about 105 000 euro of accrued liabilities were identified and corrected during the audit.

Table 1

European Network and Information Security Agency (Heraklion)

Areas of Community competence

Competences of the Agency

(Regulation (EC) No 460/2004 of the European Parliament and of the Council)

Governance

Resources made available to the Agency

(Data for 2006)

Products and services supplied

The representatives of the MemberState governments have, by common agreement, adopted a statement on the creation of a European Network and Information Security Agency. The Agency should operate as a point of reference and establish confidence by virtue of its independence, the quality of the advice it delivers and the information it disseminates, the transparency of its procedures and methods of operating, and its diligence in performing the tasks assigned to it.

(Council Decision of 19 February 2004, taken on the basis of Article 251 of the Treaty).

Objectives

—	The Agency enhances the capability of the Community, the Member States and the business community to prevent, address and respond to network and information security problems.

—	The Agency provides assistance and delivers advice to the Commission and the Member States on issues related to network and information security falling within its competencies.

—	The Agency develops a high level of expertise and uses this expertise to stimulate broad cooperation between actors from the public and private sectors.

—	The Agency assists the Commission, when called upon, in developing Community legislation in the field of network and information security.

Tasks

The Agency:

(a)	collects information on current and emerging risks that could have an impact on electronic communications networks;

(b)	provides the European Parliament, the Commission and European bodies or competent national bodies with advice and assistance;

(c)	enhances cooperation between actors in its field;

(d)	facilitates cooperation on common methodologies to address network and information security issues;

(e)	contributes to awareness raising on network and information security issues for all users;

(f)	assists the Commission and the Member States in relations with industry;

(g)	tracks standards;

(h)	advises the Commission on research in the area of network and information;

(i)	promotes risk assessment activities, on prevention solutions;

(j)	contributes to cooperation with third countries.

1. Management Board

It is composed of one representative of each MemberState, three representatives appointed by the Commission, and three representatives, without the right to vote, each of whom represents one of the following groups:

(a)	information and communication technologies industry;

(b)	consumer groups;

(c)	academic experts.

2.	Board members may be replaced by alternates.

2. Executive Director

1.	The Agency is managed by its Executive Director, who is independent in the performance of his duties.

2.	The Executive Director is appointed for a term of office of up to five years.

3. External audit

Court of Auditors.

4. Internal audit

The Commission's Internal Auditor.

5. Discharge authority

Parliament acting on recommendation from the Council.

Final budget:

8,3 (6,9) million euro (100 % Community subsidy)

Staff figures on 31 December 2007:

—	44 posts according to the establishment plan. Posts occupied 42;

—	Other posts: 11 Contract Agents, 2 SNEs, 2 Trainees.

Total staff: 56

operational: 31 (35)

administrative and policy: 25 (26)

The Agency produced 22 reports on various NIS topics including:

—	Security awareness initiatives and measurement of effectiveness Security policies;

—	Certification and accreditation schemes;

—	Security measures implemented by service providers;

—	Internal market of eCommunications;

—	Inventory of risk management methods;

—	Business continuity methods;

—	Governance;

—	Emerging risks;

—	Technological developments;

—	Applications and technologies;

—	Good practice;

—	Contacts directory;

—	Authentication levels;

—	CSIRT cooperation.

The Agency organised 8 Workshops on various NIS topics including Awareness Raising, technological developments, authentication, CSIRT.

The Agency updated its web site.

The Agency issued a newsletter on a quarterly basis.

The Agency delivered over 40 presentations in various NIS events and conferences.

The Agency dealt with seven requests for advice and assistance: five by MemberStates (two from Austria, two from Greece and one from Bulgaria) and two requests from the Commission.

The Agency developed contacts with specialised organs of OECD and International Telecommunication Union in order to identify possible synergies and to report on their activities to the Agency's stakeholders.

Source: Information supplied by the Agency.

Table 2

European Network and Information Security Agency (Heraklion) — Implementation of the budget for the financial year 2007

(1000 euro)
Revenue			Expenditure
Source of revenue	Revenue entered in the final budget for the financial year	Revenue collected	Allocation of expenditure	Final budget appropriations					Appropriations carried over from previous financial year(s)
Source of revenue	Revenue entered in the final budget for the financial year	Revenue collected	Allocation of expenditure	entered	committed	paid	carried over	cancelled	entered	committed	paid	cancelled
Community subsidies	8 000	7 900	Title I Staff	4 190	4 082	3 953	129	108	253	253	243	11
Other revenue	417	417 (1)	Title II Administration	1 135	1 103	883	220	32	126	126	121	5
			Title III Operating activities	3 092	3 043	1 351	1 692	49	538	538	496	42
Total	8 417	8 317	Total	8 417	8 228	6 187	2 041	189	917	917	860	58
Source: Data supplied by the Agency — this table summarises the data provided by the Agency in its annual accounts. Revenue collected and payments are estimated on a cash basis.

Table 3

European Network and Information Security Agency (Heraklion) — Economic outturn account for the financial years 2007 and 2006

(1000 euro)
	2007	2006
Operating revenue
Community subsidies	7 988	5 476
Other revenues	203	12
Total (a)	8 191	5 488
Operating expenditure
Staff expenditure	3 573	3 100
Fixed asset related expenditure	126	103
Other administrative expenditure	1 477	1 515
Operational expenditure	2 199	1 236
Total (b)	7 375	5 954
Surplus /(deficit) from operating activities (c = a – b)	816	– 466
Financial operations revenue (e)	—	—
Financial operations expenditure (f)	3	2
Surplus /(deficit) from non-operating activities (g = e – f)	–3	–2
Economic result for the year (h = c + g)	813	– 468
Source: Data supplied by the Agency — this table summarises the data provided by the Agency in its annual accounts: these accounts are drawn up on an accrual basis.

Table 4

European Network and Information Security Agency (Heraklion) — Balance sheet at 31 December 2007 and 2006

(1000 euro)
	2007	2006
Non-current assets
Intangible fixed assets	36	33
Tangible fixed assets	337	312
Current assets
Short-term receivables	101	56
Cash and cash equivalents	2 379	2 519
Total assets	2 853	2 920
Current liabilities
Provisions for risks and charges	155	66
Accounts payable	1 255	2 224
Total liabilities	1 410	2 290
Net assets	1 443	630
Reserve
Accumulated surplus/deficit	630	1 098
Economic result for the year	813	– 468
Net capital	1 443	630
Source: Data supplied by the Agency — this table summarises the data provided by the Agency in its annual accounts: these accounts are drawn up on an accrual basis.

(1) The amount includes the re-use of 234 528 euro.

Source: Data supplied by the Agency — this table summarises the data provided by the Agency in its annual accounts. Revenue collected and payments are estimated on a cash basis.