For the past decade, European or EU cybersecurity regulations have focused on asking public administrations what they do: what policies they have in place, what risks they’ve assessed, and how they report an incident. The new regulatory framework asks something different: what technology they have installed, and who built it This change in what’s being asked matters...