Incident notification obligation

The Security of Network and Information Systems Act (the Dutch act containing rules on the implementation of Directive (EU) 2016/1148; Wet beveiliging netwerk- en informatiesystemen, Wbni) lays down an obligation to notify NCSC-NL of any serious cyber security incidents that could cause social disruption. This incident notification obligation applies if you have been designated by your ministry as a vital operator with a duty to report, i.e. a provider of essential services or other designated critical infrastructure provider. Digital service providers must report the incident to the CSIRT-DSP of the Ministry of Economic Affairs and Climate Policy.


Reports must be sent as soon as possible. Always make a report by telephone via the NCSC emergency number. This number will be answered 24 hours a day. Immediately after making the report, send an encrypted email to with subject: ‘Wbni’. You can also use the NCSC-NL Wbni report form.

More information about when, why and how to submit a Wbni report to us about a cyber security incident, you can find here in the factsheet.