To avoid a patchwork of cybersecurity rules for essential services and critical infrastructures, regulators must ensure that the criteria of proportionality, harmonisation and efficiency are always at the core of the development of current and future cybersecurity legislation.