NCSC and supervisors sign cooperation agreements: what happens to your incident reports

What it means for essential and important entities

• The NCSC automatically forwards a mandatory report made through the reporting portal to the supervisor concerned (article 10). That a report reaches the supervisor was known; the agreements set out how.
• A voluntary report goes to the supervisor only if you explicitly consent when reporting. Without that consent, the NCSC shares voluntary reports monthly, anonymised and aggregated, by sector (article 9).
• Supervisors get access to the register data of the entities in their sector. If your organisation falls under more than one supervisor, they all see your registration and can agree among themselves who coordinates (article 8).
• If a CSIRT other than the NCSC is designated for your sector, such as Z-CERT for healthcare, your supervisor can make separate agreements with it (article 4).

What to do now

• Note in your reporting procedure that a mandatory report reaches the supervisor automatically. How the report itself works is explained in the notification duty in three stages.
• Decide in advance who determines whether a voluntary report may be shared with the supervisor.
• Check that your registration states the right sector. It determines which supervisor sees your data and reports.

What does not change

The agreements apply between the NCSC and the supervisors. They add no new duties for organisations. The parties will work them out further in practical working arrangements and evaluate them one year after the Act entered into force, and at least every three years after that (article 14).

Source

Samenwerkafspraken tussen toezichthouders en het NCSC ten behoeve van de uitvoering van de Cyberbeveiligingswet, 7 October 2026 (pdf); NCSC news item, 7 October 2026.