On 15 August 2026, the Dutch Cyber Security Act (Cbw) will come into force, introducing legal obligations for government organisations. These include registration, incident reporting, and duty-of-care requirements, as well as support from a Computer Security Incident Response Team (CSIRT) in the event of cyber incidents.
For municipalities and joint municipal arrangements, the decision on which CSIRT will be formally designated, and the safeguards required, is still being finalised. Until then, the National Cyber Security Centre (NCSC) will temporarily provide CSIRT services to these entities, at least until the end of 2026.
What does this mean for the services municipalities and joint municipal arrangements will receive?
The Cbw requires municipalities and joint municipal arrangements to register and report significant incidents. They can fulfil these obligations through the NCSC portal. Incident reports submitted via this portal will be forwarded to the CSIRT for support and to the supervisory authority. Previously, the Information Security Service (IBD) provided incident support to municipalities. During this transitional period, the NCSC will assume CSIRT responsibilities for these organisations. To comply with the registration obligation and access CSIRT services, municipalities and joint municipal arrangements are urged to register via the NCSC portal starting 15 August 2026. While many have already done so, those that haven’t are strongly encouraged to act.
The IBD’s role during the transition
Municipalities can still turn to the IBD for support in fulfilling their legal duty-of-care obligations and for questions about information security and privacy. The IBD also offers various knowledge products tailored to the municipal context.
