What is the NCSC?
The NCSC (Nationaal Cyber Security Centrum, the Dutch National Cyber Security Centre) is the Dutch government organisation that, as national CSIRT and central centre of expertise, detects digital threats, warns and advises organisations, and coordinates the response to major cyber incidents. The NCSC falls under the Ministry of Justice and Security. Since 1 January 2026 the Digital Trust Center (DTC) and the CSIRT for digital service providers (CSIRT-DSP) have been merged into the NCSC, so the centre no longer serves only government and vital sectors but every organisation in the Netherlands. For operators of OT and industrial control systems, the NCSC is best known as the desk where you report incidents under the Dutch Cybersecurity Act and the source of security advisories.
🕰️ How did the NCSC come about?
The NCSC’s history goes back to 2002. The key milestones:
| Year | Event |
|---|---|
| 2002 | CERT-RO, the CERT for central government, is founded (5 June) |
| 2003 | CERT-RO is renamed GOVCERT.NL (1 February) |
| 2012 | The NCSC starts on 1 January; GOVCERT.NL is absorbed and the centre sits within the NCTV |
| 2018 | The Network and Information Systems Security Act (Wbni) makes the NCSC the statutory CSIRT for vital providers and central government |
| 2019 | From 1 January the NCSC becomes a separate organisation under the Secretary-General of Justice and Security, independent of the NCTV |
| 2026 | DTC and CSIRT-DSP merge into the NCSC on 1 January; the Cybersecurity Act enters into force on 15 August |
The NCSC is therefore not part of the AIVD, the Dutch General Intelligence and Security Service. It does work closely with the intelligence services, the police and the NCTV (National Coordinator for Security and Counterterrorism), which sets the policy framework. According to its 2026 annual plan, the NCSC now employs more than 400 people.
🎯 Which roles does the NCSC fulfil?
The NCSC describes its work in four mutually reinforcing roles:
- Implementation coordinator - brings public and private parties together, for example in the Cyber Resilience Network, whose blueprint was published in September 2025
- Knowledge and advice centre - turns threat information into practical advice, factsheets and guidelines for a wide range of audiences
- National CSIRT - detects, analyses and responds 24/7 to attacks and vulnerabilities, and is the Dutch single point of contact (SPOC) in the European CSIRT network
- Sectoral CSIRT - is the direct point of contact for sectors without their own CSIRT, such as energy, drinking water, transport and digital infrastructure, covering both IT and OT
The NCSC advises and coordinates, but cannot impose measures on organisations. Nor is it a supervisory authority: supervision of the Cybersecurity Act is split by sector between bodies such as the RDI (Dutch Authority for Digital Infrastructure), the ILT and the IGJ.
🧱 For which sectors is the NCSC the CSIRT?
Under the Cybersecurity Act, the NCSC is the statutory CSIRT for most sectors. The Netherlands also has a few sectoral teams, but only CERT-WM is formally designated under the Act:
| CSIRT | Constituency | Position |
|---|---|---|
| NCSC | Energy, drinking water, transport, digital infrastructure, chemicals, food, manufacturing, ministries, provinces and more | Default CSIRT |
| CERT-WM | The 21 Dutch water boards | Statutorily designated sectoral CSIRT |
| Z-CERT | Healthcare | Designation intended; until then the NCSC acts |
| IBD-CERT | Municipalities | Sectoral team of the VNG (Association of Netherlands Municipalities); not designated under the Cbw, so the NCSC remains the statutory CSIRT |
| SURFcert | Education and research | Sectoral team of SURF; not designated under the Cbw |
A drinking water company therefore reports to the NCSC, while a water board reports via CERT-WM. In practice every report goes through the same reporting portal on MijnNCSC, which forwards it to the right CSIRT and supervisor. For more on the sector, see Water Sector OT Security.
🔧 Which services does the NCSC provide?
- Security advisories - on vulnerabilities (CVEs) in both IT and OT products. Each advisory is rated for likelihood and impact, each low, medium or high; advisories rated low on both are not distributed. Since 15 May 2024 the NCSC also publishes its advisories in CSAF, so you can process them automatically.
- Threat information - threat intelligence and indicators of compromise for connected organisations, information sharing within sectoral ISACs such as the Water-ISAC, and the National Detection Network
- Incident support - analysis, coordination and, where needed, incident response during major incidents, for example involving ransomware or the exploited Citrix and Ivanti vulnerabilities
- Vulnerability disclosure - in 2018 the NCSC published Coordinated Vulnerability Disclosure: the Guideline, a revision of its 2013 responsible disclosure guideline
- International guidance - the NCSC co-authored joint publications by CISA and partners, such as the OT asset inventory guidance (August 2025) and the principles for AI in OT (December 2025)
- Knowledge sharing - the annual ONE Conference at the World Forum in The Hague, which the NCSC organises together with the Municipality of The Hague
The annual Cyber Security Assessment Netherlands (Cybersecuritybeeld Nederland, CSBN) was prepared by the NCSC in its early years; today the NCTV draws up the CSBN, with contributions from the AIVD and MIVD among others.
⚖️ What are the NCSC’s statutory tasks?
The NCSC’s work rests on several laws:
- Cybersecurity Act (Cyberbeveiligingswet, in force since 15 August 2026, the Dutch implementation of NIS2) - the NCSC maintains the entity register on MijnNCSC, where more than 8,000 organisations must register themselves, and receives reports of significant incidents. The deadlines are set out in incident reporting under the Cbw: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.
- Cybersecurity Decree - designates the Minister of Justice and Security as CSIRT; in practice that is the NCSC
- Wwke - the Critical Entities Resilience Act, which governs the physical and organisational resilience of critical infrastructure
- Act on Promoting Digital Resilience of Businesses (Wbdwb, since 1 October 2024) - the legal basis for warning non-vital businesses, a task that came to the NCSC with the DTC
- Cyber Resilience Act - since 11 September 2026 the NCSC, as CSIRT coordinator, receives manufacturers’ reports of actively exploited vulnerabilities
🏭 How do you work with the NCSC as an OT organisation?
For a factory, grid operator or drinking water company, a good relationship with the NCSC mainly saves time during an incident. A practical approach:
- Determine your position - use the scope of the Cbw to check whether you are an essential or important entity, and which CSIRT applies to your sector
- Register on MijnNCSC - with eHerkenning (assurance level EH2+) or SSOnRijk; report changes within 14 days
- Subscribe to the advisories - and connect the CSAF feed to your vulnerability management, alongside the advisories from Siemens, Schneider Electric and other OT vendors
- Document the reporting route - include contact details, reporters, deputies and the 24-hour clock in your incident response plan
- Practise together - use a tabletop exercise to test whether the report can go out within 24 hours, including at night
- Share information - join your sector’s ISAC so you receive threat intelligence and can share indicators yourself
For water managers this ties in with the CSIR, the implementation guideline maintained by Rijkswaterstaat and Het Waterschapshuis; the NCSC does not own it.
🔄 How does the NCSC differ from comparable organisations?
| Organisation | Country | Role |
|---|---|---|
| NCSC (NL) | Netherlands | National CSIRT and centre of expertise under Justice and Security |
| NCSC-UK | United Kingdom | Part of the intelligence agency GCHQ |
| BSI | Germany | Federal office with its own certification and standards tasks |
| CISA | United States | Agency that runs, among other things, the KEV catalogue and ICS advisories |
| ENISA | European Union | EU agency for cybersecurity; operates the CRA Single Reporting Platform |
Watch out for the shared name: a news item about “the NCSC” may refer to the UK’s NCSC. Internationally, the Dutch centre often uses the label NCSC-NL.
❓ Frequently asked questions
Is the NCSC a regulator?
No, the Dutch NCSC is not a regulator but the national CSIRT: it receives reports, issues warnings and gives advice. Supervision of the Cybersecurity Act lies with other bodies per sector, such as the RDI, the ILT and the IGJ. A report to the NCSC is therefore first and foremost a request for help, not an inspection.
Do I have to report a cyber incident to the NCSC?
If your organisation falls under the Dutch Cybersecurity Act, you report a significant incident via MijnNCSC within 24 hours of becoming aware of it. The NCSC forwards the report to the right CSIRT and to your sector’s supervisor. Organisations outside the Act can inform the NCSC voluntarily and ask for help.
What is the difference between the NCSC and the DTC?
The Digital Trust Center was the Ministry of Economic Affairs’ information hub for non-vital businesses. Since 1 January 2026 the DTC, together with CSIRT-DSP, has been merged into the NCSC. The NCSC is therefore the single national cybersecurity centre for all organisations in the Netherlands.
Is the NCSC part of the AIVD?
No, the Dutch NCSC is not part of the AIVD intelligence service. From 2012 to 2018 it sat within the NCTV, and since 1 January 2019 it has been a separate organisation within the Ministry of Justice and Security. The NCSC does work with the AIVD, the MIVD and the police.
Does the NCSC publish advisories on OT vulnerabilities?
Yes, the Dutch NCSC publishes security advisories on both IT and OT products, rated for likelihood and impact. Since May 2024 the advisories have also been available as machine-readable CSAF files. For sectors such as energy and drinking water, the NCSC also shares sector-specific threat information on industrial control systems.
What is the difference between the NCSC and CERT-WM?
The NCSC is the CSIRT for most sectors under the Dutch Cybersecurity Act, including Rijkswaterstaat and the drinking water companies. CERT-WM is the statutorily designated sectoral CSIRT for the 21 water boards. Both teams exchange threat information and coordinate during major incidents.
📌 In summary
The NCSC is the Dutch national CSIRT and centre of expertise for cybersecurity, which has served all organisations since 2026 and, under the Cybersecurity Act, receives incident reports and maintains the entity register. For OT organisations the NCSC is the source of rated security advisories and threat information, and the desk where you report a significant incident within 24 hours; the security itself remains your own responsibility.