This page answers frequently asked questions about provisional CSIRT services for municipalities and intergovernmental arrangements.
Establishment of the sectoral CSIRT task for municipalities and intergovernmental arrangements. Which organisation has been assigned the CSIRT task?
Following a careful assessment, it was decided on 13 October 2026 to designate the National Cyber Security Centre (NCSC) as the permanent sectoral CSIRT for providing CSIRT services to municipalities and intergovernmental arrangements. The designation of the NCSC means that the Information Security Service (IBD) takes on a different role. The IBD has since been designated as the liaison organisation. It is therefore classified as a relevant party under the Dutch implementation of the NIS2 Directive, the Cyberbeveiligingswet (Cbw).
Which organisations are affected?
The Cbw applies to 342 municipalities and approximately 200 intergovernmental arrangements, including collaborations involving at least 1 municipality.
What changes for municipalities and intergovernmental arrangements?
Under the Cbw, these organisations must register and report significant incidents via the NCSC portal. During this period, the NCSC will provide CSIRT support instead of the Information Security Service for Municipalities (IBD). The IBD will not have access to incident reports submitted under the Cbw. However, efforts are underway to ensure the IBD retains visibility of vulnerabilities and threats, in collaboration with the NCSC.
Under the Cbw, municipalities and intergovernmental arrangements must, among other things, register and report significant incidents. In practice, they can do so through the NCSC portal, forwarding incident reports to the CSIRT—in this case, the NCSC—which can then provide appropriate support. The NCSC initially acted as the temporary CSIRT after the Cbw took effect on 15 August. That temporary arrangement has now ended, and the NCSC will continue providing support instead of the IBD. In the coming period, the NCSC and the IBD will determine how to safeguard the IBD’s information position so that it can effectively fulfil its role as the liaison organisation. This includes, for example, aspects of service provision that fall outside the NCSC’s statutory CSIRT task.
What services does the NCSC provide to municipalities and intergovernmental arrangements?
Through the NCSC portal, municipalities and intergovernmental arrangements can access a range of products and services (English), including knowledge and advisory resources. Some of these may overlap with the IBD’s offerings, though the IBD’s products often address the municipal context in greater detail. Both sets of resources will continue to coexist. For more information about the NCSC’s services, contact the NCSC Customer and Contact Centre (English).
How will municipalities and intergovernmental arrangements receive information about threats and vulnerabilities?
Municipalities and intergovernmental arrangements can access the NCSC portal to report incidents, upload network data, and access current information, analyses, and advice. The full range of NCSC services is available to both municipalities and intergovernmental arrangements.
What can municipalities expect from the IBD?
The IBD continues to advise municipalities on information security and privacy, including questions about the Baseline Information Security Government (BIO), the General Data Protection Regulation (GDPR), and the requirements of the Cbw. The IBD also helps conduct risk assessments. Municipalities can contact the IBD for support during business hours (Monday to Friday, 9:00–17:00) at 070-204 55 11 or info@ibdgemeenten.nl.
In addition, the IBD will provide important supplementary services to municipalities as the liaison organisation under the Cbw. The precise scope of the operational work and the information position required for it will be set out in additional (working) agreements between the IBD and the NCSC in the near future.
