Z-CERT designated by law as the healthcare CSIRT from 6 October
Published · Updated
Stichting Z-CERT has been designated by law as the CSIRT for the healthcare sector and for the subsector manufacturing of medical devices and in vitro diagnostic medical devices, with effect from 6 October 2026. This is set out in an amendment to the Cyberbeveiligingsregeling voor de zorg, the healthcare regulation under the Cyberbeveiligingswet, published in the Staatscourant on 5 October 2026.
Z-CERT has acted as the CERT for Dutch healthcare since 2017. When the regulation entered into force on 15 August, the designation could not be included yet, because the mandatory consultation with the Netherlands Court of Audit (Algemene Rekenkamer) had not been completed. That consultation has now been completed.
What it means for healthcare organisations
According to the explanatory notes to the regulation, healthcare organisations that fall under the Cyberbeveiligingswet are entitled to the support from Z-CERT that the Act describes. The Ministry of Health, Welfare and Sport (VWS) funds Z-CERT for this from 1 January 2027; until then, funding runs through the existing subsidy.
Until now, institutions paid for Z-CERT's services themselves or through their umbrella organisation. According to the explanatory notes this changes, but the regulation does not say how existing agreements will be settled.
What does not change
The regulation sets no additional requirements for essential or important entities. Registration and reporting still go through the NCSC portal, mijn.ncsc.nl; Z-CERT's existing systems will be connected to that portal. A report there reaches the sector CSIRT and the supervisor at the same time. How that report works in three stages is explained in the notification duty under the Cyberbeveiligingswet.
What to do now
- Check that your registration on mijn.ncsc.nl states the right sector: healthcare or, for manufacturers, the subsector manufacturing of medical devices. After registration you connect to the services of your sector CSIRT.
- If your incident procedure refers to a CSIRT, check that it names Z-CERT.
- If you have an agreement with Z-CERT, as a participant or through your umbrella organisation, ask Z-CERT what the designation means for it.
Source
Regulation of the Minister for Long-term Care, Youth and Sport of 22 September 2026 amending the Cyberbeveiligingsregeling voor de zorg, Staatscourant 2026, 35238. In force from 6 October 2026.
Read alsoDoes the Cyberbeveiligingswet apply to your organisation?
The three duties stay the same
This designation changes nothing about registration, the duty of care or the notification duty. See how we set them up and keep the evidence current.
See how we set up the Cbw duties