On 17 May 2019, the Council established a framework enabling the EU to impose targeted restrictive measures (sanctions) to deter and respond to cyber-attacks that constitute an external threat to the EU or its member states.
The move extended EU sanctions policy into the cyber domain and later enabled the first designations under the regime.